Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1473
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.115-2",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-46325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46325"
},
{
"name": "CVE-2026-90144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90144"
},
{
"name": "CVE-2026-99150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99150"
},
{
"name": "CVE-2026-99204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99204"
},
{
"name": "CVE-2026-53091",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53091"
},
{
"name": "CVE-2026-97962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97962"
},
{
"name": "CVE-2025-38042",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38042"
},
{
"name": "CVE-2026-43414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43414"
},
{
"name": "CVE-2026-90336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90336"
},
{
"name": "CVE-2026-43298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43298"
},
{
"name": "CVE-2026-31493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31493"
},
{
"name": "CVE-2026-89757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89757"
},
{
"name": "CVE-2026-46130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46130"
},
{
"name": "CVE-2026-99128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99128"
},
{
"name": "CVE-2026-99161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99161"
},
{
"name": "CVE-2026-68081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68081"
},
{
"name": "CVE-2026-97989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97989"
},
{
"name": "CVE-2026-53292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53292"
},
{
"name": "CVE-2026-80761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80761"
},
{
"name": "CVE-2026-99180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99180"
},
{
"name": "CVE-2026-90231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90231"
},
{
"name": "CVE-2026-64513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64513"
},
{
"name": "CVE-2026-64388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64388"
},
{
"name": "CVE-2026-98131",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98131"
},
{
"name": "CVE-2026-98043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98043"
},
{
"name": "CVE-2026-98975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98975"
},
{
"name": "CVE-2026-74571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74571"
},
{
"name": "CVE-2026-90162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90162"
},
{
"name": "CVE-2026-72440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72440"
},
{
"name": "CVE-2026-98067",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98067"
},
{
"name": "CVE-2026-74506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74506"
},
{
"name": "CVE-2026-64077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64077"
},
{
"name": "CVE-2025-39910",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39910"
},
{
"name": "CVE-2026-74690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74690"
},
{
"name": "CVE-2026-68453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68453"
},
{
"name": "CVE-2026-72488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72488"
},
{
"name": "CVE-2026-72494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72494"
},
{
"name": "CVE-2026-80698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80698"
},
{
"name": "CVE-2026-74373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74373"
},
{
"name": "CVE-2025-68359",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68359"
},
{
"name": "CVE-2026-53109",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53109"
},
{
"name": "CVE-2026-74697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74697"
},
{
"name": "CVE-2026-64006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64006"
},
{
"name": "CVE-2026-99110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99110"
},
{
"name": "CVE-2025-71285",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71285"
},
{
"name": "CVE-2026-74317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74317"
},
{
"name": "CVE-2026-53297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53297"
},
{
"name": "CVE-2026-74513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74513"
},
{
"name": "CVE-2026-74537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74537"
},
{
"name": "CVE-2026-99117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99117"
},
{
"name": "CVE-2026-23217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23217"
},
{
"name": "CVE-2026-53104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53104"
},
{
"name": "CVE-2026-63832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63832"
},
{
"name": "CVE-2025-38207",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38207"
},
{
"name": "CVE-2026-68404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68404"
},
{
"name": "CVE-2026-43294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43294"
},
{
"name": "CVE-2026-68421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68421"
},
{
"name": "CVE-2025-38137",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38137"
},
{
"name": "CVE-2026-89920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89920"
},
{
"name": "CVE-2026-74520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74520"
},
{
"name": "CVE-2026-99192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99192"
},
{
"name": "CVE-2026-99169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99169"
},
{
"name": "CVE-2026-72388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72388"
},
{
"name": "CVE-2026-74715",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74715"
},
{
"name": "CVE-2026-23143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23143"
},
{
"name": "CVE-2026-90097",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90097"
},
{
"name": "CVE-2026-90328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90328"
},
{
"name": "CVE-2026-72375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72375"
},
{
"name": "CVE-2026-43118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43118"
},
{
"name": "CVE-2026-74733",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74733"
},
{
"name": "CVE-2026-90106",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90106"
},
{
"name": "CVE-2025-38029",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38029"
},
{
"name": "CVE-2026-43311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43311"
},
{
"name": "CVE-2026-90205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90205"
},
{
"name": "CVE-2026-90234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90234"
},
{
"name": "CVE-2026-99123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99123"
},
{
"name": "CVE-2025-38187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38187"
},
{
"name": "CVE-2026-89705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89705"
},
{
"name": "CVE-2026-63979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63979"
},
{
"name": "CVE-2026-97478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97478"
},
{
"name": "CVE-2026-74559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74559"
},
{
"name": "CVE-2026-99106",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99106"
},
{
"name": "CVE-2026-63879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63879"
},
{
"name": "CVE-2026-23208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23208"
},
{
"name": "CVE-2026-23017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23017"
},
{
"name": "CVE-2026-43465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43465"
},
{
"name": "CVE-2026-74687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74687"
},
{
"name": "CVE-2026-64389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64389"
},
{
"name": "CVE-2026-23007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23007"
},
{
"name": "CVE-2026-90105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90105"
},
{
"name": "CVE-2026-46032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46032"
},
{
"name": "CVE-2026-80738",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80738"
},
{
"name": "CVE-2026-74605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74605"
},
{
"name": "CVE-2025-37743",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-37743"
},
{
"name": "CVE-2026-99103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99103"
},
{
"name": "CVE-2026-53224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53224"
},
{
"name": "CVE-2025-38284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38284"
},
{
"name": "CVE-2026-90421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90421"
},
{
"name": "CVE-2026-98916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98916"
},
{
"name": "CVE-2026-68242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68242"
},
{
"name": "CVE-2025-40355",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40355"
},
{
"name": "CVE-2026-99160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99160"
},
{
"name": "CVE-2026-52956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52956"
},
{
"name": "CVE-2025-71074",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71074"
},
{
"name": "CVE-2026-74338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74338"
},
{
"name": "CVE-2026-89642",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89642"
},
{
"name": "CVE-2026-99134",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99134"
},
{
"name": "CVE-2026-98053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98053"
},
{
"name": "CVE-2026-72031",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72031"
},
{
"name": "CVE-2026-43053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43053"
},
{
"name": "CVE-2026-23377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23377"
},
{
"name": "CVE-2026-53103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53103"
},
{
"name": "CVE-2026-100072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100072"
},
{
"name": "CVE-2026-53321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53321"
},
{
"name": "CVE-2026-68258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68258"
},
{
"name": "CVE-2026-99009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99009"
},
{
"name": "CVE-2026-43308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43308"
},
{
"name": "CVE-2026-45934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45934"
},
{
"name": "CVE-2026-99114",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99114"
},
{
"name": "CVE-2026-64146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64146"
},
{
"name": "CVE-2026-72500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72500"
},
{
"name": "CVE-2026-72366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72366"
},
{
"name": "CVE-2026-98049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98049"
},
{
"name": "CVE-2026-99187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99187"
},
{
"name": "CVE-2026-74723",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74723"
},
{
"name": "CVE-2026-90311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90311"
},
{
"name": "CVE-2026-90330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90330"
},
{
"name": "CVE-2026-68436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68436"
},
{
"name": "CVE-2026-89811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89811"
},
{
"name": "CVE-2026-90061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90061"
},
{
"name": "CVE-2026-74747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74747"
},
{
"name": "CVE-2026-64190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64190"
},
{
"name": "CVE-2025-39933",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39933"
},
{
"name": "CVE-2026-97503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97503"
},
{
"name": "CVE-2026-89833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89833"
},
{
"name": "CVE-2026-93129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93129"
},
{
"name": "CVE-2026-98974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98974"
},
{
"name": "CVE-2026-46071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46071"
},
{
"name": "CVE-2026-43022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43022"
},
{
"name": "CVE-2026-64068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64068"
},
{
"name": "CVE-2026-64038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64038"
},
{
"name": "CVE-2026-99126",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99126"
},
{
"name": "CVE-2026-74385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74385"
},
{
"name": "CVE-2026-89682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89682"
},
{
"name": "CVE-2026-72383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72383"
},
{
"name": "CVE-2026-45956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45956"
},
{
"name": "CVE-2026-46066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46066"
},
{
"name": "CVE-2026-43299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43299"
},
{
"name": "CVE-2026-80734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80734"
},
{
"name": "CVE-2026-98034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98034"
},
{
"name": "CVE-2026-74388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74388"
},
{
"name": "CVE-2026-99105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99105"
},
{
"name": "CVE-2026-90273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90273"
},
{
"name": "CVE-2026-68393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68393"
},
{
"name": "CVE-2026-90087",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90087"
},
{
"name": "CVE-2026-64213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64213"
},
{
"name": "CVE-2026-43464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43464"
},
{
"name": "CVE-2026-64076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64076"
},
{
"name": "CVE-2026-90099",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90099"
},
{
"name": "CVE-2026-99179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99179"
},
{
"name": "CVE-2026-90265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90265"
},
{
"name": "CVE-2026-90409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90409"
},
{
"name": "CVE-2026-99098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99098"
},
{
"name": "CVE-2026-74405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74405"
},
{
"name": "CVE-2026-90427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90427"
},
{
"name": "CVE-2026-53368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53368"
},
{
"name": "CVE-2025-68209",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68209"
},
{
"name": "CVE-2026-80623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80623"
},
{
"name": "CVE-2025-39859",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39859"
},
{
"name": "CVE-2026-90232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90232"
},
{
"name": "CVE-2026-89810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89810"
},
{
"name": "CVE-2026-99019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99019"
},
{
"name": "CVE-2026-100077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100077"
},
{
"name": "CVE-2026-53330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53330"
},
{
"name": "CVE-2025-38261",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38261"
},
{
"name": "CVE-2026-80668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80668"
},
{
"name": "CVE-2026-72337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72337"
},
{
"name": "CVE-2025-38064",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38064"
},
{
"name": "CVE-2026-53377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53377"
},
{
"name": "CVE-2026-68435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68435"
},
{
"name": "CVE-2026-98099",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98099"
},
{
"name": "CVE-2026-43009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43009"
},
{
"name": "CVE-2026-80920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80920"
},
{
"name": "CVE-2026-68291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68291"
},
{
"name": "CVE-2025-68368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68368"
},
{
"name": "CVE-2026-99181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99181"
},
{
"name": "CVE-2026-46256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46256"
},
{
"name": "CVE-2025-40086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40086"
},
{
"name": "CVE-2026-90417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90417"
},
{
"name": "CVE-2026-23385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23385"
},
{
"name": "CVE-2026-74449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74449"
},
{
"name": "CVE-2026-99118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99118"
},
{
"name": "CVE-2026-43213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43213"
},
{
"name": "CVE-2026-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43443"
},
{
"name": "CVE-2026-89812",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89812"
},
{
"name": "CVE-2026-80581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80581"
},
{
"name": "CVE-2026-99212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99212"
},
{
"name": "CVE-2026-90365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90365"
},
{
"name": "CVE-2026-99201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99201"
},
{
"name": "CVE-2026-90247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90247"
},
{
"name": "CVE-2025-68174",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68174"
},
{
"name": "CVE-2026-90161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90161"
},
{
"name": "CVE-2026-93176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93176"
},
{
"name": "CVE-2026-93175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93175"
},
{
"name": "CVE-2026-63859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63859"
},
{
"name": "CVE-2026-92480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92480"
},
{
"name": "CVE-2026-99182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99182"
},
{
"name": "CVE-2025-40136",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40136"
},
{
"name": "CVE-2026-80662",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80662"
},
{
"name": "CVE-2026-93100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93100"
},
{
"name": "CVE-2026-90264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90264"
},
{
"name": "CVE-2026-89788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89788"
},
{
"name": "CVE-2026-74538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74538"
},
{
"name": "CVE-2026-90346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90346"
},
{
"name": "CVE-2026-99159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99159"
},
{
"name": "CVE-2025-39775",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39775"
},
{
"name": "CVE-2026-98038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98038"
},
{
"name": "CVE-2026-53401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53401"
},
{
"name": "CVE-2026-46171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46171"
},
{
"name": "CVE-2026-80693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80693"
},
{
"name": "CVE-2026-90263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90263"
},
{
"name": "CVE-2026-68426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68426"
},
{
"name": "CVE-2025-68319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68319"
},
{
"name": "CVE-2025-38597",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38597"
},
{
"name": "CVE-2026-53178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53178"
},
{
"name": "CVE-2025-37746",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-37746"
},
{
"name": "CVE-2026-52937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52937"
},
{
"name": "CVE-2026-90267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90267"
},
{
"name": "CVE-2026-99203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99203"
},
{
"name": "CVE-2026-72439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72439"
},
{
"name": "CVE-2026-46059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46059"
},
{
"name": "CVE-2026-46181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46181"
},
{
"name": "CVE-2026-90177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90177"
},
{
"name": "CVE-2026-90142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90142"
},
{
"name": "CVE-2026-97479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97479"
},
{
"name": "CVE-2026-97975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97975"
},
{
"name": "CVE-2026-90320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90320"
},
{
"name": "CVE-2026-90363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90363"
},
{
"name": "CVE-2026-98084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98084"
},
{
"name": "CVE-2026-74729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74729"
},
{
"name": "CVE-2026-99211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99211"
},
{
"name": "CVE-2026-72495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72495"
},
{
"name": "CVE-2026-93251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93251"
},
{
"name": "CVE-2026-99131",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99131"
},
{
"name": "CVE-2026-98033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98033"
},
{
"name": "CVE-2026-92503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92503"
},
{
"name": "CVE-2026-90422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90422"
},
{
"name": "CVE-2026-43310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43310"
},
{
"name": "CVE-2026-97432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97432"
},
{
"name": "CVE-2026-99216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99216"
},
{
"name": "CVE-2026-97424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97424"
},
{
"name": "CVE-2026-90167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90167"
},
{
"name": "CVE-2026-43485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43485"
},
{
"name": "CVE-2026-90240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90240"
},
{
"name": "CVE-2026-93221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93221"
},
{
"name": "CVE-2026-23472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23472"
},
{
"name": "CVE-2026-46330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46330"
},
{
"name": "CVE-2026-53009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53009"
},
{
"name": "CVE-2026-99083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99083"
},
{
"name": "CVE-2026-68399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68399"
},
{
"name": "CVE-2026-90182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90182"
},
{
"name": "CVE-2026-99082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99082"
},
{
"name": "CVE-2026-68418",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68418"
},
{
"name": "CVE-2025-23135",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23135"
},
{
"name": "CVE-2026-68233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68233"
},
{
"name": "CVE-2026-68312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68312"
},
{
"name": "CVE-2026-80653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80653"
},
{
"name": "CVE-2026-98032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98032"
},
{
"name": "CVE-2026-93148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93148"
},
{
"name": "CVE-2026-99077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99077"
},
{
"name": "CVE-2025-71313",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71313"
},
{
"name": "CVE-2026-74374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74374"
},
{
"name": "CVE-2025-38421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38421"
},
{
"name": "CVE-2026-72341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72341"
},
{
"name": "CVE-2026-89537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89537"
},
{
"name": "CVE-2025-38656",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38656"
},
{
"name": "CVE-2026-97422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97422"
},
{
"name": "CVE-2026-74264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74264"
},
{
"name": "CVE-2024-58074",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-58074"
},
{
"name": "CVE-2026-45932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45932"
},
{
"name": "CVE-2026-80607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80607"
},
{
"name": "CVE-2026-99158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99158"
},
{
"name": "CVE-2026-72423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72423"
},
{
"name": "CVE-2026-90183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90183"
},
{
"name": "CVE-2026-89906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89906"
},
{
"name": "CVE-2026-45940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45940"
},
{
"name": "CVE-2026-63853",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63853"
},
{
"name": "CVE-2026-46302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46302"
},
{
"name": "CVE-2026-72380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72380"
},
{
"name": "CVE-2026-68211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68211"
},
{
"name": "CVE-2026-99041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99041"
},
{
"name": "CVE-2026-99191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99191"
},
{
"name": "CVE-2026-43352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43352"
},
{
"name": "CVE-2026-68400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68400"
},
{
"name": "CVE-2026-99155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99155"
},
{
"name": "CVE-2026-99202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99202"
},
{
"name": "CVE-2026-72499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72499"
},
{
"name": "CVE-2026-93282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93282"
},
{
"name": "CVE-2026-89813",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89813"
},
{
"name": "CVE-2026-97493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97493"
},
{
"name": "CVE-2026-72398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72398"
},
{
"name": "CVE-2026-53018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53018"
},
{
"name": "CVE-2026-99130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99130"
},
{
"name": "CVE-2026-90174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90174"
},
{
"name": "CVE-2026-97538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97538"
},
{
"name": "CVE-2026-74257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74257"
},
{
"name": "CVE-2026-74544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74544"
},
{
"name": "CVE-2025-68376",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68376"
},
{
"name": "CVE-2025-68353",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68353"
},
{
"name": "CVE-2026-99121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99121"
},
{
"name": "CVE-2026-64060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64060"
},
{
"name": "CVE-2026-46228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46228"
},
{
"name": "CVE-2025-39862",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39862"
},
{
"name": "CVE-2026-23259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23259"
},
{
"name": "CVE-2025-40338",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40338"
},
{
"name": "CVE-2026-89534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89534"
},
{
"name": "CVE-2026-46044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46044"
},
{
"name": "CVE-2026-90083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90083"
},
{
"name": "CVE-2026-31526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31526"
},
{
"name": "CVE-2026-98148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98148"
},
{
"name": "CVE-2026-63825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63825"
},
{
"name": "CVE-2026-99173",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99173"
},
{
"name": "CVE-2025-39789",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39789"
},
{
"name": "CVE-2026-98048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98048"
},
{
"name": "CVE-2026-89631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89631"
},
{
"name": "CVE-2026-53285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53285"
},
{
"name": "CVE-2025-68318",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68318"
},
{
"name": "CVE-2026-93216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93216"
},
{
"name": "CVE-2026-93230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93230"
},
{
"name": "CVE-2026-98019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98019"
},
{
"name": "CVE-2026-90093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90093"
},
{
"name": "CVE-2025-68745",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68745"
},
{
"name": "CVE-2026-45961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45961"
},
{
"name": "CVE-2026-43185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43185"
},
{
"name": "CVE-2026-74375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74375"
},
{
"name": "CVE-2026-99113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99113"
},
{
"name": "CVE-2026-74368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74368"
},
{
"name": "CVE-2025-71141",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71141"
},
{
"name": "CVE-2026-90111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90111"
},
{
"name": "CVE-2026-43048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43048"
},
{
"name": "CVE-2025-38359",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38359"
},
{
"name": "CVE-2026-89987",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89987"
},
{
"name": "CVE-2026-99140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99140"
},
{
"name": "CVE-2026-53024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53024"
},
{
"name": "CVE-2026-68323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68323"
},
{
"name": "CVE-2026-90259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90259"
},
{
"name": "CVE-2026-99135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99135"
},
{
"name": "CVE-2026-43337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43337"
},
{
"name": "CVE-2026-99002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99002"
},
{
"name": "CVE-2025-68360",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68360"
},
{
"name": "CVE-2026-72329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72329"
},
{
"name": "CVE-2026-99133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99133"
},
{
"name": "CVE-2026-46245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46245"
},
{
"name": "CVE-2026-99175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99175"
},
{
"name": "CVE-2026-31592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31592"
},
{
"name": "CVE-2026-74273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74273"
},
{
"name": "CVE-2026-89913",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89913"
},
{
"name": "CVE-2025-38140",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38140"
},
{
"name": "CVE-2025-40130",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40130"
},
{
"name": "CVE-2026-53118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53118"
},
{
"name": "CVE-2026-72162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72162"
},
{
"name": "CVE-2026-99132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99132"
},
{
"name": "CVE-2026-98977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98977"
},
{
"name": "CVE-2026-92520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92520"
},
{
"name": "CVE-2026-74261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74261"
},
{
"name": "CVE-2026-97960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97960"
},
{
"name": "CVE-2026-90217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90217"
},
{
"name": "CVE-2025-39834",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39834"
},
{
"name": "CVE-2026-74728",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74728"
},
{
"name": "CVE-2025-37906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-37906"
},
{
"name": "CVE-2026-99163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99163"
},
{
"name": "CVE-2026-68238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68238"
},
{
"name": "CVE-2026-80692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80692"
},
{
"name": "CVE-2026-31771",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31771"
},
{
"name": "CVE-2026-90345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90345"
},
{
"name": "CVE-2025-22109",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22109"
},
{
"name": "CVE-2026-90408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90408"
},
{
"name": "CVE-2025-23132",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23132"
},
{
"name": "CVE-2026-80747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80747"
},
{
"name": "CVE-2026-92485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92485"
},
{
"name": "CVE-2026-90335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90335"
},
{
"name": "CVE-2026-64117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64117"
},
{
"name": "CVE-2026-64079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64079"
},
{
"name": "CVE-2026-74754",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74754"
},
{
"name": "CVE-2026-43034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43034"
},
{
"name": "CVE-2026-93260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93260"
},
{
"name": "CVE-2026-80628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80628"
},
{
"name": "CVE-2026-64036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64036"
},
{
"name": "CVE-2026-80616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80616"
},
{
"name": "CVE-2026-99206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99206"
},
{
"name": "CVE-2026-23371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23371"
},
{
"name": "CVE-2026-99153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99153"
},
{
"name": "CVE-2026-43204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43204"
},
{
"name": "CVE-2026-74611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74611"
},
{
"name": "CVE-2025-39958",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39958"
},
{
"name": "CVE-2026-99147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99147"
},
{
"name": "CVE-2026-64400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64400"
},
{
"name": "CVE-2026-93081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93081"
},
{
"name": "CVE-2026-74542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74542"
},
{
"name": "CVE-2026-43346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43346"
},
{
"name": "CVE-2026-89654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89654"
},
{
"name": "CVE-2026-74752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74752"
},
{
"name": "CVE-2026-90208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90208"
},
{
"name": "CVE-2026-74600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74600"
},
{
"name": "CVE-2026-74466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74466"
},
{
"name": "CVE-2026-43127",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43127"
},
{
"name": "CVE-2026-53025",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53025"
},
{
"name": "CVE-2026-68241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68241"
},
{
"name": "CVE-2026-90333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90333"
},
{
"name": "CVE-2026-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43272"
},
{
"name": "CVE-2026-90326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90326"
},
{
"name": "CVE-2026-72367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72367"
},
{
"name": "CVE-2026-74695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74695"
},
{
"name": "CVE-2026-80905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80905"
},
{
"name": "CVE-2026-80786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80786"
},
{
"name": "CVE-2026-93125",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93125"
},
{
"name": "CVE-2026-98124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98124"
},
{
"name": "CVE-2026-53258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53258"
},
{
"name": "CVE-2026-99085",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99085"
},
{
"name": "CVE-2026-80948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80948"
},
{
"name": "CVE-2026-99166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99166"
},
{
"name": "CVE-2026-99165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99165"
},
{
"name": "CVE-2026-89808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89808"
},
{
"name": "CVE-2026-90149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90149"
},
{
"name": "CVE-2026-93105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93105"
},
{
"name": "CVE-2026-90206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90206"
},
{
"name": "CVE-2026-90347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90347"
},
{
"name": "CVE-2026-99167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99167"
},
{
"name": "CVE-2026-99156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99156"
},
{
"name": "CVE-2026-90260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90260"
},
{
"name": "CVE-2026-93058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93058"
},
{
"name": "CVE-2026-98085",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98085"
},
{
"name": "CVE-2026-80655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80655"
},
{
"name": "CVE-2026-93202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93202"
},
{
"name": "CVE-2026-43191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43191"
},
{
"name": "CVE-2026-63811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63811"
},
{
"name": "CVE-2026-99014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99014"
},
{
"name": "CVE-2026-99136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99136"
},
{
"name": "CVE-2025-68729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68729"
},
{
"name": "CVE-2025-68236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68236"
},
{
"name": "CVE-2026-99100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99100"
},
{
"name": "CVE-2026-99112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99112"
},
{
"name": "CVE-2026-90343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90343"
},
{
"name": "CVE-2025-38636",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38636"
},
{
"name": "CVE-2026-89709",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89709"
},
{
"name": "CVE-2026-90104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90104"
},
{
"name": "CVE-2026-99124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99124"
},
{
"name": "CVE-2026-90155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90155"
},
{
"name": "CVE-2026-46148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46148"
},
{
"name": "CVE-2026-46324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46324"
},
{
"name": "CVE-2026-74558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74558"
},
{
"name": "CVE-2026-68105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68105"
},
{
"name": "CVE-2026-97501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97501"
},
{
"name": "CVE-2026-90300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90300"
},
{
"name": "CVE-2026-53108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53108"
},
{
"name": "CVE-2026-74713",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74713"
},
{
"name": "CVE-2026-98079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98079"
},
{
"name": "CVE-2026-74350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74350"
},
{
"name": "CVE-2026-98058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98058"
},
{
"name": "CVE-2026-99154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99154"
},
{
"name": "CVE-2026-74272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74272"
},
{
"name": "CVE-2026-89648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89648"
},
{
"name": "CVE-2026-43172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43172"
},
{
"name": "CVE-2026-99092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99092"
},
{
"name": "CVE-2026-99127",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99127"
},
{
"name": "CVE-2026-53017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53017"
},
{
"name": "CVE-2025-71227",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71227"
},
{
"name": "CVE-2026-72397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72397"
},
{
"name": "CVE-2026-99142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99142"
},
{
"name": "CVE-2026-100076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100076"
},
{
"name": "CVE-2026-93272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93272"
},
{
"name": "CVE-2025-40113",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40113"
},
{
"name": "CVE-2026-74533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74533"
},
{
"name": "CVE-2026-93181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93181"
},
{
"name": "CVE-2026-31562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31562"
},
{
"name": "CVE-2026-97477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97477"
},
{
"name": "CVE-2026-99213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99213"
},
{
"name": "CVE-2026-53277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53277"
},
{
"name": "CVE-2026-63998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63998"
},
{
"name": "CVE-2026-97928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97928"
},
{
"name": "CVE-2025-38199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38199"
},
{
"name": "CVE-2026-43353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43353"
},
{
"name": "CVE-2026-68448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68448"
},
{
"name": "CVE-2026-99027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99027"
},
{
"name": "CVE-2025-38605",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38605"
},
{
"name": "CVE-2026-72098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72098"
},
{
"name": "CVE-2026-80884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80884"
},
{
"name": "CVE-2026-90154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90154"
},
{
"name": "CVE-2026-80614",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80614"
},
{
"name": "CVE-2026-74407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74407"
},
{
"name": "CVE-2026-72497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72497"
},
{
"name": "CVE-2026-89601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89601"
},
{
"name": "CVE-2026-80634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80634"
},
{
"name": "CVE-2026-72493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72493"
},
{
"name": "CVE-2026-90324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90324"
},
{
"name": "CVE-2026-80705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80705"
},
{
"name": "CVE-2026-98047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98047"
},
{
"name": "CVE-2026-98156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98156"
},
{
"name": "CVE-2025-38132",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38132"
},
{
"name": "CVE-2026-43083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43083"
},
{
"name": "CVE-2026-68295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68295"
},
{
"name": "CVE-2026-97480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97480"
},
{
"name": "CVE-2026-99214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99214"
},
{
"name": "CVE-2026-97515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97515"
},
{
"name": "CVE-2026-43463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43463"
},
{
"name": "CVE-2026-98993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98993"
},
{
"name": "CVE-2026-90321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90321"
},
{
"name": "CVE-2026-92482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92482"
},
{
"name": "CVE-2026-64283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64283"
},
{
"name": "CVE-2026-43263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43263"
},
{
"name": "CVE-2026-90424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90424"
},
{
"name": "CVE-2026-99174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99174"
},
{
"name": "CVE-2026-93146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93146"
},
{
"name": "CVE-2026-99044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99044"
},
{
"name": "CVE-2026-63999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63999"
},
{
"name": "CVE-2026-68409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68409"
},
{
"name": "CVE-2026-99176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99176"
},
{
"name": "CVE-2026-90086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90086"
},
{
"name": "CVE-2026-80643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80643"
},
{
"name": "CVE-2026-98062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98062"
},
{
"name": "CVE-2026-99178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99178"
},
{
"name": "CVE-2026-90359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90359"
},
{
"name": "CVE-2026-64024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64024"
},
{
"name": "CVE-2026-93144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93144"
},
{
"name": "CVE-2026-90179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90179"
},
{
"name": "CVE-2026-43101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43101"
},
{
"name": "CVE-2026-43042",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43042"
},
{
"name": "CVE-2026-99139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99139"
},
{
"name": "CVE-2025-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39830"
},
{
"name": "CVE-2026-72404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72404"
},
{
"name": "CVE-2026-46175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46175"
},
{
"name": "CVE-2026-72501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72501"
},
{
"name": "CVE-2025-68730",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68730"
},
{
"name": "CVE-2026-97513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97513"
},
{
"name": "CVE-2026-43309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43309"
},
{
"name": "CVE-2026-97988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97988"
},
{
"name": "CVE-2026-43234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43234"
},
{
"name": "CVE-2026-99171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99171"
},
{
"name": "CVE-2026-68470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68470"
},
{
"name": "CVE-2026-68447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68447"
},
{
"name": "CVE-2026-52991",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52991"
},
{
"name": "CVE-2026-98985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98985"
},
{
"name": "CVE-2026-90301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90301"
},
{
"name": "CVE-2026-68441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68441"
},
{
"name": "CVE-2026-74530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74530"
},
{
"name": "CVE-2026-74734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74734"
},
{
"name": "CVE-2026-100074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100074"
},
{
"name": "CVE-2026-63857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63857"
},
{
"name": "CVE-2025-40065",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40065"
},
{
"name": "CVE-2026-74711",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74711"
},
{
"name": "CVE-2026-72321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72321"
},
{
"name": "CVE-2026-23327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23327"
},
{
"name": "CVE-2026-93104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93104"
},
{
"name": "CVE-2026-93122",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93122"
},
{
"name": "CVE-2026-53284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53284"
},
{
"name": "CVE-2026-53281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53281"
},
{
"name": "CVE-2026-72009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72009"
},
{
"name": "CVE-2026-90084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90084"
},
{
"name": "CVE-2026-90204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90204"
},
{
"name": "CVE-2026-93116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93116"
},
{
"name": "CVE-2026-80631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80631"
},
{
"name": "CVE-2026-93168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93168"
},
{
"name": "CVE-2026-46272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46272"
},
{
"name": "CVE-2026-90367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90367"
},
{
"name": "CVE-2026-52983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52983"
},
{
"name": "CVE-2026-68412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68412"
},
{
"name": "CVE-2026-98073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98073"
},
{
"name": "CVE-2026-90351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90351"
},
{
"name": "CVE-2026-68375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68375"
},
{
"name": "CVE-2026-99152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99152"
},
{
"name": "CVE-2026-72073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72073"
},
{
"name": "CVE-2026-90256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90256"
},
{
"name": "CVE-2026-31630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31630"
},
{
"name": "CVE-2026-99157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99157"
},
{
"name": "CVE-2026-99115",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99115"
},
{
"name": "CVE-2025-68735",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68735"
},
{
"name": "CVE-2026-90289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90289"
},
{
"name": "CVE-2026-90116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90116"
},
{
"name": "CVE-2026-74529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74529"
},
{
"name": "CVE-2026-53000",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53000"
},
{
"name": "CVE-2026-98981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98981"
},
{
"name": "CVE-2025-39677",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39677"
},
{
"name": "CVE-2026-43325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43325"
},
{
"name": "CVE-2026-68383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68383"
},
{
"name": "CVE-2026-99143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99143"
},
{
"name": "CVE-2026-68401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68401"
},
{
"name": "CVE-2026-80866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80866"
},
{
"name": "CVE-2026-46014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46014"
},
{
"name": "CVE-2026-64159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64159"
},
{
"name": "CVE-2026-99028",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99028"
},
{
"name": "CVE-2026-97997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97997"
},
{
"name": "CVE-2026-90156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90156"
},
{
"name": "CVE-2026-74269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74269"
},
{
"name": "CVE-2026-74344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74344"
},
{
"name": "CVE-2026-98003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98003"
},
{
"name": "CVE-2026-72288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72288"
},
{
"name": "CVE-2025-68755",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68755"
},
{
"name": "CVE-2026-89528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89528"
},
{
"name": "CVE-2026-74527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74527"
},
{
"name": "CVE-2026-64154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64154"
},
{
"name": "CVE-2026-98147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98147"
},
{
"name": "CVE-2026-31579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31579"
},
{
"name": "CVE-2026-90337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90337"
},
{
"name": "CVE-2025-68193",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68193"
},
{
"name": "CVE-2026-97561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97561"
},
{
"name": "CVE-2026-68471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68471"
},
{
"name": "CVE-2026-99138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99138"
},
{
"name": "CVE-2026-98044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98044"
},
{
"name": "CVE-2026-98134",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98134"
},
{
"name": "CVE-2025-38041",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38041"
},
{
"name": "CVE-2026-97554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97554"
}
],
"initial_release_date": "2026-11-06T00:00:00",
"last_revision_date": "2026-11-06T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1473",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00521",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00521.html"
}
]
}
CVE-2026-99041 (GCVE-0-2026-99041)
Vulnerability from cvelistv5
Published
2026-10-23 12:22
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6_gre: remove obsolete ERSPAN PMTU update
A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,
and mirred can redirect it to a native ip6erspan device. The legacy PMTU
update in ip6erspan_tunnel_xmit() treats that metadata dst as a route.
Since it has no output device, dst_dev(dst)->mtu dereferences NULL.
On v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used
self-created user and network namespaces to trigger:
KASAN: null-ptr-deref
RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0
Kernel panic - not syncing: Fatal exception in interrupt
The update is obsolete. Commit fe1a4ca0a2b7 ("ip6_gre: process toobig
in a better way") changed IPv6 GRE Too Big handling to update the
underlay route and removed the equivalent block from __gre6_xmit().
ip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.
Remove the stale ERSPAN copy and its now-unused dst variable. This
eliminates the metadata-dst dereference and keeps ERSPAN aligned with
IPv6 GRE PMTU handling.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 Version: 5a963eb61b7c39e6c422b6e48619d19d04719358 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_gre.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2e151c74bcc53e3ed313bd1c21b0d5bb442edbc0",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
},
{
"lessThan": "ba72ed1c8476ce68eb7152dfcbc5330cefcbaa91",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
},
{
"lessThan": "b14a682ad7d45345701e08f9279d483a1da8b36c",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
},
{
"lessThan": "f5b143f4cd3fb7673df8d727550478a4b762908a",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
},
{
"lessThan": "2d06cb25a497d3a7034ef9d172626c2d6620a0f1",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
},
{
"lessThan": "8f27260b989f488760289276377db24fbfb20bfa",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
},
{
"lessThan": "8bc60db48e8cba35488bbd6e1f94aa990afa275a",
"status": "affected",
"version": "5a963eb61b7c39e6c422b6e48619d19d04719358",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_gre.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: remove obsolete ERSPAN PMTU update\n\nA tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,\nand mirred can redirect it to a native ip6erspan device. The legacy PMTU\nupdate in ip6erspan_tunnel_xmit() treats that metadata dst as a route.\nSince it has no output device, dst_dev(dst)-\u003emtu dereferences NULL.\n\nOn v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used\nself-created user and network namespaces to trigger:\n\n KASAN: null-ptr-deref\n RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThe update is obsolete. Commit fe1a4ca0a2b7 (\"ip6_gre: process toobig\nin a better way\") changed IPv6 GRE Too Big handling to update the\nunderlay route and removed the equivalent block from __gre6_xmit().\nip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.\n\nRemove the stale ERSPAN copy and its now-unused dst variable. This\neliminates the metadata-dst dereference and keeps ERSPAN aligned with\nIPv6 GRE PMTU handling."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:14.790Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e151c74bcc53e3ed313bd1c21b0d5bb442edbc0"
},
{
"url": "https://git.kernel.org/stable/c/ba72ed1c8476ce68eb7152dfcbc5330cefcbaa91"
},
{
"url": "https://git.kernel.org/stable/c/b14a682ad7d45345701e08f9279d483a1da8b36c"
},
{
"url": "https://git.kernel.org/stable/c/f5b143f4cd3fb7673df8d727550478a4b762908a"
},
{
"url": "https://git.kernel.org/stable/c/2d06cb25a497d3a7034ef9d172626c2d6620a0f1"
},
{
"url": "https://git.kernel.org/stable/c/8f27260b989f488760289276377db24fbfb20bfa"
},
{
"url": "https://git.kernel.org/stable/c/8bc60db48e8cba35488bbd6e1f94aa990afa275a"
}
],
"title": "ip6_gre: remove obsolete ERSPAN PMTU update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99041",
"datePublished": "2026-10-23T12:22:00.403Z",
"dateReserved": "2026-09-25T10:25:14.387Z",
"dateUpdated": "2026-10-30T12:41:14.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99133 (GCVE-0-2026-99133)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix the recvmsg window update
iucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without
testing the transport, so on a classic z/VM socket iucv_send_ctrl() sizes
the skb through a NULL iucv->hs_dev. SO_MSGLIMIT accepts 1, so msglimit / 2
is zero and one recvmsg() on its own socket is enough for an unprivileged
process to take a spurious disconnect.
It also calls iucv_send_ctrl() under spin_lock_bh(&message_q.lock), which
allocates GFP_KERNEL inside a section the code treats as atomic. Sending
outside that lock lets two recvmsg() reach afiucv_hs_send() at once, where
msg_recv is sampled for the advertised window and subtracted after
dev_queue_xmit() -- and sendmsg reaches that counter under lock_sock()
while recvmsg holds no socket lock, so both can subtract the same value,
the counter goes negative and the credit reaches the peer twice.
Test the transport, claim the credit with atomic_xchg() after the last
error exit and hand it back if the transmit fails, and send once the lock
is dropped.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01123990f59ce32a1a5e690a4aeee002e932bb07",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "1ebe68bbf8e75eeccaca0c7bc9694f5bc0c3f00a",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "23e7fbbdca5aaba2a9a7bb9e4f2dc179c290ee76",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "ce8aac3eb57f5366fa082b7cb8a1ac5652274f37",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "8f2efa742f4cfe7dd756154f8bc07350dbe3ec92",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "fe7393a627db2d093e8c0cae69d619b30fefae5f",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "fa5acd038ea657ad5033713d6916214cbd349151",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix the recvmsg window update\n\niucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without\ntesting the transport, so on a classic z/VM socket iucv_send_ctrl() sizes\nthe skb through a NULL iucv-\u003ehs_dev. SO_MSGLIMIT accepts 1, so msglimit / 2\nis zero and one recvmsg() on its own socket is enough for an unprivileged\nprocess to take a spurious disconnect.\n\nIt also calls iucv_send_ctrl() under spin_lock_bh(\u0026message_q.lock), which\nallocates GFP_KERNEL inside a section the code treats as atomic. Sending\noutside that lock lets two recvmsg() reach afiucv_hs_send() at once, where\nmsg_recv is sampled for the advertised window and subtracted after\ndev_queue_xmit() -- and sendmsg reaches that counter under lock_sock()\nwhile recvmsg holds no socket lock, so both can subtract the same value,\nthe counter goes negative and the credit reaches the peer twice.\n\nTest the transport, claim the credit with atomic_xchg() after the last\nerror exit and hand it back if the transmit fails, and send once the lock\nis dropped."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:06.467Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01123990f59ce32a1a5e690a4aeee002e932bb07"
},
{
"url": "https://git.kernel.org/stable/c/1ebe68bbf8e75eeccaca0c7bc9694f5bc0c3f00a"
},
{
"url": "https://git.kernel.org/stable/c/23e7fbbdca5aaba2a9a7bb9e4f2dc179c290ee76"
},
{
"url": "https://git.kernel.org/stable/c/ce8aac3eb57f5366fa082b7cb8a1ac5652274f37"
},
{
"url": "https://git.kernel.org/stable/c/8f2efa742f4cfe7dd756154f8bc07350dbe3ec92"
},
{
"url": "https://git.kernel.org/stable/c/fe7393a627db2d093e8c0cae69d619b30fefae5f"
},
{
"url": "https://git.kernel.org/stable/c/fa5acd038ea657ad5033713d6916214cbd349151"
}
],
"title": "net/iucv: fix the recvmsg window update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99133",
"datePublished": "2026-10-28T10:34:46.398Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:06.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52983 (GCVE-0-2026-52983)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: fix BQL imbalance in TX path
Fix a possible BQL imbalance in airoha_dev_xmit(), where inflight
packets are accounted only for the AIROHA_NUM_TX_RING netdev TX
queues. The queue index is computed as:
qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx)
txq = netdev_get_tx_queue(dev, qid);
However, airoha_qdma_tx_napi_poll() accounts completions across all
netdev TX queues (num_tx_queues), leading to inconsistent BQL
accounting.
Also reset all netdev TX queues in the ndo_stop callback.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/airoha/airoha_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcd6a3bb48bb661876c2743e89f0a6567f5cea2c",
"status": "affected",
"version": "ca24fcac1daaa5e8a667981d81986a3eb4b9fb04",
"versionType": "git"
},
{
"lessThan": "aaad53a55812acd2355c0e5478896381e78b0110",
"status": "affected",
"version": "1d304174106c93ce05f6088813ad7203b3eb381a",
"versionType": "git"
},
{
"lessThan": "ded2694247a55a16d0ebbe2d6f9139305c21457a",
"status": "affected",
"version": "1d304174106c93ce05f6088813ad7203b3eb381a",
"versionType": "git"
},
{
"lessThan": "2d9f5a118205da2683ffcec78b9347f1f01a820e",
"status": "affected",
"version": "1d304174106c93ce05f6088813ad7203b3eb381a",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.91",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/airoha/airoha_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: fix BQL imbalance in TX path\n\nFix a possible BQL imbalance in airoha_dev_xmit(), where inflight\npackets are accounted only for the AIROHA_NUM_TX_RING netdev TX\nqueues. The queue index is computed as:\n\n qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma-\u003eq_tx)\n txq = netdev_get_tx_queue(dev, qid);\n\nHowever, airoha_qdma_tx_napi_poll() accounts completions across all\nnetdev TX queues (num_tx_queues), leading to inconsistent BQL\naccounting.\n\nAlso reset all netdev TX queues in the ndo_stop callback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is the Airoha Ethernet transmit path, and in a reasonable router/gateway or server deployment remote unauthenticated traffic can be forwarded or elicit responses transmitted through the affected interface.\nAC:L - Once HTB offload/extra TX queues are present, packets mapped to those queues deterministically create mismatched BQL accounting and the TX completion path reaches dql_completed(); no race or hard-to-win condition is required.\nPR:N - The attacker does not need credentials to send or induce network traffic through the configured interface; CAP_NET_ADMIN is only needed to create the traffic-shaping setup and may already be present in the deployed system.\nUI:N - No victim interaction is required after the affected network interface and queue configuration are active.\nS:U - The impact remains within the Linux kernel/network device security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The bug is a BQL accounting mismatch that triggers a BUG_ON in dql_completed, not a memory disclosure or memory corruption primitive.\nI:N - The investigated path does not provide arbitrary write, data modification, or control-flow corruption; it fails through a kernel assertion.\nA:H - The mismatched completion accounting can trigger a kernel BUG/oops in the TX completion path, causing a system crash or denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:43.028Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcd6a3bb48bb661876c2743e89f0a6567f5cea2c"
},
{
"url": "https://git.kernel.org/stable/c/aaad53a55812acd2355c0e5478896381e78b0110"
},
{
"url": "https://git.kernel.org/stable/c/ded2694247a55a16d0ebbe2d6f9139305c21457a"
},
{
"url": "https://git.kernel.org/stable/c/2d9f5a118205da2683ffcec78b9347f1f01a820e"
}
],
"title": "net: airoha: fix BQL imbalance in TX path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52983",
"datePublished": "2026-06-24T16:28:58.437Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-10-21T12:41:43.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80607 (GCVE-0-2026-80607)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
Sashiko found that user can cause this WARN_ON_ONCE() easily
with adding a kprobe event based on a raw address with BTF
parameter.
Since this is not an unexpected condition, remove the
WARN_ON_ONCE().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_probe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24a753a49d06813a156695e3804dcc11c7fdef07",
"status": "affected",
"version": "b576e09701c7d045bbe5cd85d53e2f34426aa214",
"versionType": "git"
},
{
"lessThan": "e177f1530af440d9330c149080aa3b24ddefa18b",
"status": "affected",
"version": "b576e09701c7d045bbe5cd85d53e2f34426aa214",
"versionType": "git"
},
{
"lessThan": "f148f86c65b8f9ef2466ad8506e721749e4957fb",
"status": "affected",
"version": "b576e09701c7d045bbe5cd85d53e2f34426aa214",
"versionType": "git"
},
{
"lessThan": "8a662d8c05e2cf16f7a047c81bc1eb5d3b29bacd",
"status": "affected",
"version": "b576e09701c7d045bbe5cd85d53e2f34426aa214",
"versionType": "git"
},
{
"lessThan": "251a8fe1b9aedccd298b77bc28426d564c5a923f",
"status": "affected",
"version": "b576e09701c7d045bbe5cd85d53e2f34426aa214",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_probe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/probes: Remove WARN_ON_ONCE from parse_btf_arg\n\nSashiko found that user can cause this WARN_ON_ONCE() easily\nwith adding a kprobe event based on a raw address with BTF\nparameter.\n\nSince this is not an unexpected condition, remove the\nWARN_ON_ONCE()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:32.757Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24a753a49d06813a156695e3804dcc11c7fdef07"
},
{
"url": "https://git.kernel.org/stable/c/e177f1530af440d9330c149080aa3b24ddefa18b"
},
{
"url": "https://git.kernel.org/stable/c/f148f86c65b8f9ef2466ad8506e721749e4957fb"
},
{
"url": "https://git.kernel.org/stable/c/8a662d8c05e2cf16f7a047c81bc1eb5d3b29bacd"
},
{
"url": "https://git.kernel.org/stable/c/251a8fe1b9aedccd298b77bc28426d564c5a923f"
}
],
"title": "tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80607",
"datePublished": "2026-08-28T06:48:31.556Z",
"dateReserved": "2026-08-26T14:34:25.772Z",
"dateUpdated": "2026-10-21T12:46:32.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97515 (GCVE-0-2026-97515)
Vulnerability from cvelistv5
Published
2026-09-24 16:05
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
On NPCM845, when a target on the I3C bus gets stuck holding SDA low,
the controller reports a false Master Request (MR) in-band interrupt
event. The driver handles this by emitting a STOP condition to restore
the bus.
However, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that
emitting a STOP condition may spuriously set the SLVSTART interrupt
status bit. In the Master Request case, this creates a feedback loop:
the STOP triggers a new SLVSTART event, the IRQ handler fires again,
the controller still reports an MR type, another STOP is emitted, and
the cycle repeats indefinitely, resulting in an IRQ storm that can lock
up the CPU.
Clear the SLVSTART status bit explicitly after emitting the STOP in the
Master Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk
is set. This breaks the feedback loop without affecting normal SLVSTART
processing, which is already guarded in the top-level IRQ handler by
checking that MSTATUS is in SLVREQ state.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1ea4653cff35c29d1dd0b14ad9c8245e7318f337 Version: 0430bf9bc1ac068c8b8c540eb93e5751872efc51 Version: 0430bf9bc1ac068c8b8c540eb93e5751872efc51 Version: 30748ce7e156f221fb91689b338a0d7df77b732a Version: f2985a1de6f53abbc42c7a696ee6ba8bdecc9426 Version: 0541822045ae043d62c941ca31fa76871e436b5e Version: d231fb443d8d4042f0dd705b93beba8c916a7344 Version: 6.12.31 ≤ Version: 5.15.185 ≤ Version: 6.1.141 ≤ Version: 6.6.93 ≤ Version: 6.14.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/svc-i3c-master.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "335f72b1f9bbcf0f4cc5a505443b15f1af563b4f",
"status": "affected",
"version": "1ea4653cff35c29d1dd0b14ad9c8245e7318f337",
"versionType": "git"
},
{
"lessThan": "e9b139c4684ed8593a0b779ca02ea05f460b2eec",
"status": "affected",
"version": "0430bf9bc1ac068c8b8c540eb93e5751872efc51",
"versionType": "git"
},
{
"lessThan": "1effa3adfe53cb2bb28bf5640a676b791d5ab405",
"status": "affected",
"version": "0430bf9bc1ac068c8b8c540eb93e5751872efc51",
"versionType": "git"
},
{
"status": "affected",
"version": "30748ce7e156f221fb91689b338a0d7df77b732a",
"versionType": "git"
},
{
"status": "affected",
"version": "f2985a1de6f53abbc42c7a696ee6ba8bdecc9426",
"versionType": "git"
},
{
"status": "affected",
"version": "0541822045ae043d62c941ca31fa76871e436b5e",
"versionType": "git"
},
{
"status": "affected",
"version": "d231fb443d8d4042f0dd705b93beba8c916a7344",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.31",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.185",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/svc-i3c-master.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845\n\nOn NPCM845, when a target on the I3C bus gets stuck holding SDA low,\nthe controller reports a false Master Request (MR) in-band interrupt\nevent. The driver handles this by emitting a STOP condition to restore\nthe bus.\n\nHowever, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that\nemitting a STOP condition may spuriously set the SLVSTART interrupt\nstatus bit. In the Master Request case, this creates a feedback loop:\nthe STOP triggers a new SLVSTART event, the IRQ handler fires again,\nthe controller still reports an MR type, another STOP is emitted, and\nthe cycle repeats indefinitely, resulting in an IRQ storm that can lock\nup the CPU.\n\nClear the SLVSTART status bit explicitly after emitting the STOP in the\nMaster Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk\nis set. This breaks the feedback loop without affecting normal SLVSTART\nprocessing, which is already guarded in the top-level IRQ handler by\nchecking that MSTATUS is in SLVREQ state."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:00.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/335f72b1f9bbcf0f4cc5a505443b15f1af563b4f"
},
{
"url": "https://git.kernel.org/stable/c/e9b139c4684ed8593a0b779ca02ea05f460b2eec"
},
{
"url": "https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"
}
],
"title": "i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97515",
"datePublished": "2026-09-24T16:05:13.124Z",
"dateReserved": "2026-09-24T16:01:01.152Z",
"dateUpdated": "2026-10-21T12:53:00.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90208 (GCVE-0-2026-90208)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
Samsung PWM timer might be used as a clock source on some legacy systems.
When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a
sleeping lock (mutex-based), which must not be used in atomic context
such as hard interrupt handlers. Switch the samsung_pwm_lock to the
raw_spinlock, which remains a true non-sleeping spinlock even
under PREEMPT_RT.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f11899894c0a683c754ca71b45f7c9c3d35a3a1c Version: f11899894c0a683c754ca71b45f7c9c3d35a3a1c Version: f11899894c0a683c754ca71b45f7c9c3d35a3a1c Version: f11899894c0a683c754ca71b45f7c9c3d35a3a1c Version: f11899894c0a683c754ca71b45f7c9c3d35a3a1c Version: f11899894c0a683c754ca71b45f7c9c3d35a3a1c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clocksource/samsung_pwm_timer.c",
"drivers/pwm/pwm-samsung.c",
"include/clocksource/samsung_pwm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c97311a5f5d388eece66fc415167b38f35fe6a1",
"status": "affected",
"version": "f11899894c0a683c754ca71b45f7c9c3d35a3a1c",
"versionType": "git"
},
{
"lessThan": "8f823b47eb889ea70f4c360164e96453f40e3646",
"status": "affected",
"version": "f11899894c0a683c754ca71b45f7c9c3d35a3a1c",
"versionType": "git"
},
{
"lessThan": "5720fe5cabda19f395d194ca57321c7b85f8af80",
"status": "affected",
"version": "f11899894c0a683c754ca71b45f7c9c3d35a3a1c",
"versionType": "git"
},
{
"lessThan": "a25ea67a913f98b8461aff1e9e3a5f6dc2378395",
"status": "affected",
"version": "f11899894c0a683c754ca71b45f7c9c3d35a3a1c",
"versionType": "git"
},
{
"lessThan": "7eb5764d25c4ac7f5d126621660f7219b61fd2fd",
"status": "affected",
"version": "f11899894c0a683c754ca71b45f7c9c3d35a3a1c",
"versionType": "git"
},
{
"lessThan": "3b212f9d70805d91febae01d618868f4860e267c",
"status": "affected",
"version": "f11899894c0a683c754ca71b45f7c9c3d35a3a1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clocksource/samsung_pwm_timer.c",
"drivers/pwm/pwm-samsung.c",
"include/clocksource/samsung_pwm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type\n\nSamsung PWM timer might be used as a clock source on some legacy systems.\nWhen PREEMPT_RT is enabled on ARM, regular spinlock is converted to a\nsleeping lock (mutex-based), which must not be used in atomic context\nsuch as hard interrupt handlers. Switch the samsung_pwm_lock to the\nraw_spinlock, which remains a true non-sleeping spinlock even\nunder PREEMPT_RT."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:47.590Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c97311a5f5d388eece66fc415167b38f35fe6a1"
},
{
"url": "https://git.kernel.org/stable/c/8f823b47eb889ea70f4c360164e96453f40e3646"
},
{
"url": "https://git.kernel.org/stable/c/5720fe5cabda19f395d194ca57321c7b85f8af80"
},
{
"url": "https://git.kernel.org/stable/c/a25ea67a913f98b8461aff1e9e3a5f6dc2378395"
},
{
"url": "https://git.kernel.org/stable/c/7eb5764d25c4ac7f5d126621660f7219b61fd2fd"
},
{
"url": "https://git.kernel.org/stable/c/3b212f9d70805d91febae01d618868f4860e267c"
}
],
"title": "clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90208",
"datePublished": "2026-09-17T16:07:23.479Z",
"dateReserved": "2026-09-11T19:38:34.793Z",
"dateUpdated": "2026-10-30T12:34:47.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97432 (GCVE-0-2026-97432)
Vulnerability from cvelistv5
Published
2026-09-24 16:03
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix P2P-Device binding handling
Our binding handling for P2P-Device can run into the following
scenario, as observed by our testing:
- a station interface is connected on some channel
- the P2P-Device does a remain-on-channel (ROC) on that channel
- the ROC ends, and the P2P-Device is removed from the binding,
but the phy_ctxt pointer is left around as a PHY cache so we
don't need to recalibrate to the channel again and again in
case it's not shared
- a binding update by the station interface, even a removal,
will re-add the P2P-Device to the binding
- the P2P-Device is removed, which removes the PHY context, but
it's still in the binding so the firmware crashes
Since the P2P device is removed from the binding and only re-
added by unrelated code, but we want to keep the phy_ctxt around
as a cache for future ROC usage, fix it by adding a boolean that
indicates whether or not the P2P-Device should be added to the
binding, and handle that in the binding iterator. That way, the
station interface cannot re-add the P2P-Device to the binding
when that isn't active.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 64c277f6329818db3124c9759cb9acf0f6070a54 Version: 84ef7cbe90e9e54c71c1da4e645ba34e1b33da77 Version: 84ef7cbe90e9e54c71c1da4e645ba34e1b33da77 Version: 84ef7cbe90e9e54c71c1da4e645ba34e1b33da77 Version: 8ddf2212cfa5d9ef4fd289ce0d9dda728f2160b8 Version: 6.6.2 ≤ Version: 6.5.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/binding.c",
"drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c",
"drivers/net/wireless/intel/iwlwifi/mvm/mvm.h",
"drivers/net/wireless/intel/iwlwifi/mvm/time-event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50bf37362362c8f03ab1aeab866b7fb08b262204",
"status": "affected",
"version": "64c277f6329818db3124c9759cb9acf0f6070a54",
"versionType": "git"
},
{
"lessThan": "8575514a979490c9d4517fcf19b4e19119c27702",
"status": "affected",
"version": "84ef7cbe90e9e54c71c1da4e645ba34e1b33da77",
"versionType": "git"
},
{
"lessThan": "7be2fc679c8f657868988e41c0bb15bf5a454620",
"status": "affected",
"version": "84ef7cbe90e9e54c71c1da4e645ba34e1b33da77",
"versionType": "git"
},
{
"lessThan": "b74e377cad9271950c57472867c469e4b5b2ff0c",
"status": "affected",
"version": "84ef7cbe90e9e54c71c1da4e645ba34e1b33da77",
"versionType": "git"
},
{
"status": "affected",
"version": "8ddf2212cfa5d9ef4fd289ce0d9dda728f2160b8",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.2",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/binding.c",
"drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c",
"drivers/net/wireless/intel/iwlwifi/mvm/mvm.h",
"drivers/net/wireless/intel/iwlwifi/mvm/time-event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix P2P-Device binding handling\n\nOur binding handling for P2P-Device can run into the following\nscenario, as observed by our testing:\n\n - a station interface is connected on some channel\n - the P2P-Device does a remain-on-channel (ROC) on that channel\n - the ROC ends, and the P2P-Device is removed from the binding,\n but the phy_ctxt pointer is left around as a PHY cache so we\n don\u0027t need to recalibrate to the channel again and again in\n case it\u0027s not shared\n - a binding update by the station interface, even a removal,\n will re-add the P2P-Device to the binding\n - the P2P-Device is removed, which removes the PHY context, but\n it\u0027s still in the binding so the firmware crashes\n\nSince the P2P device is removed from the binding and only re-\nadded by unrelated code, but we want to keep the phy_ctxt around\nas a cache for future ROC usage, fix it by adding a boolean that\nindicates whether or not the P2P-Device should be added to the\nbinding, and handle that in the binding iterator. That way, the\nstation interface cannot re-add the P2P-Device to the binding\nwhen that isn\u0027t active."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:47.469Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50bf37362362c8f03ab1aeab866b7fb08b262204"
},
{
"url": "https://git.kernel.org/stable/c/8575514a979490c9d4517fcf19b4e19119c27702"
},
{
"url": "https://git.kernel.org/stable/c/7be2fc679c8f657868988e41c0bb15bf5a454620"
},
{
"url": "https://git.kernel.org/stable/c/b74e377cad9271950c57472867c469e4b5b2ff0c"
}
],
"title": "wifi: iwlwifi: mvm: fix P2P-Device binding handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97432",
"datePublished": "2026-09-24T16:03:45.303Z",
"dateReserved": "2026-09-24T14:53:16.869Z",
"dateUpdated": "2026-10-21T12:52:47.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90086 (GCVE-0-2026-90086)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: honor XDP_TX_METADATA in zero-copy path
The zero-copy path reads TX metadata whenever the UMEM has metadata space,
even if the descriptor does not set XDP_TX_METADATA. Pass descriptor
options through the metadata helpers and ignore metadata unless the option
is set.
This does not fix the existing per-WQE metadata handling for mlx5 MPWQEs.
Only the descriptor that starts a session passes through
xsk_tx_metadata_request() and configures offload state shared by the batch.
Metadata on descriptors joining an open session is therefore not validated
and does not configure its requested offloads. In addition, a non-NULL
metadata pointer from such a descriptor is treated as a timestamp
completion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its
metadata union can be overwritten with an unrequested timestamp. Fixing
mixed metadata states within one MPWQE requires a separate change.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c",
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c",
"include/net/libeth/xsk.h",
"include/net/xdp_sock_drv.h",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk_buff_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ba0d143e471c85f8a116707c0b42bf046b0a7b3",
"status": "affected",
"version": "48eb03dd26304c24f03bdbb9382e89c8564e71df",
"versionType": "git"
},
{
"lessThan": "53a5b262d706b572840cbe8feae392538077ee19",
"status": "affected",
"version": "48eb03dd26304c24f03bdbb9382e89c8564e71df",
"versionType": "git"
},
{
"lessThan": "bf9387488d6394845076928c6ca5315ce5d84f54",
"status": "affected",
"version": "48eb03dd26304c24f03bdbb9382e89c8564e71df",
"versionType": "git"
},
{
"lessThan": "a6e4b9a6deb9362ef7a0706c70d674e92fe1411a",
"status": "affected",
"version": "48eb03dd26304c24f03bdbb9382e89c8564e71df",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c",
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c",
"include/net/libeth/xsk.h",
"include/net/xdp_sock_drv.h",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk_buff_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: honor XDP_TX_METADATA in zero-copy path\n\nThe zero-copy path reads TX metadata whenever the UMEM has metadata space,\neven if the descriptor does not set XDP_TX_METADATA. Pass descriptor\noptions through the metadata helpers and ignore metadata unless the option\nis set.\n\nThis does not fix the existing per-WQE metadata handling for mlx5 MPWQEs.\nOnly the descriptor that starts a session passes through\nxsk_tx_metadata_request() and configures offload state shared by the batch.\nMetadata on descriptors joining an open session is therefore not validated\nand does not configure its requested offloads. In addition, a non-NULL\nmetadata pointer from such a descriptor is treated as a timestamp\ncompletion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its\nmetadata union can be overwritten with an unrequested timestamp. Fixing\nmixed metadata states within one MPWQE requires a separate change."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:45.759Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ba0d143e471c85f8a116707c0b42bf046b0a7b3"
},
{
"url": "https://git.kernel.org/stable/c/53a5b262d706b572840cbe8feae392538077ee19"
},
{
"url": "https://git.kernel.org/stable/c/bf9387488d6394845076928c6ca5315ce5d84f54"
},
{
"url": "https://git.kernel.org/stable/c/a6e4b9a6deb9362ef7a0706c70d674e92fe1411a"
}
],
"title": "xsk: honor XDP_TX_METADATA in zero-copy path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90086",
"datePublished": "2026-09-17T16:06:02.212Z",
"dateReserved": "2026-09-11T19:38:34.785Z",
"dateUpdated": "2026-10-21T12:49:45.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97997 (GCVE-0-2026-97997)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_ring: fix stale descriptor flags after a failed packed add
In a packed ring the AVAIL and USED bits sit in the descriptor itself,
so writing them makes that descriptor available. Those bit combinations
flip meaning on every round of the ring, tracked by a wrap counter, so
invalidating or validating a descriptor means inverting both bits.
Commit 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") has
virtqueue_add_packed() make every descriptor of a chain available as it
maps the chain, and write the head last. The device consumes the ring in
order and stops at a head that is not available yet, so it never reaches
the rest.
When vring_map_one_sg() fails partway, unmap_release unmaps the segments
and restores avail_used_flags, but the descriptors it wrote to in the
ring stay marked with AVAIL and USED bits. The head is now the only
entry that keeps the device from consuming these stale entries.
For example, the ring would look like this now.
Z - pre-previous command
A - previous command
B - aborted command
C - current command
[A1 DONE] [A2 DONE] <C1 EMPTY> [B2] [B3] [Z1 DONE]
When the driver now attempts to issue the C command, the next add starts
at the same head as B. If C spans less descriptors than B, there is no
end marker because AVAIL and USED bits were still in place. And that
means the device will start interpreting these stale entries (B2/B3) as
another command entry, which then blocks the queue.
This effect typically happens in swiotlb configurations under memory
pressure, because vring_map_one_sg() can then fail with larger I/O
requests which then leads to command abortions.
There are broadly 2 ways to avoid leaving those flags behind:
1) Defer those flags too until the chain is complete.
2) Rewrite those flags for the previous wrap counter.
Implement the second option in both packed add paths. The first option
traverses the chain a second time on every successful add. The second
option invalidates all added descriptors when any add fails.
With this patch applied, a packed virtqueue keeps completing requests
after a failed add.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/virtio/virtio_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ad081761a1f0b0d95ab08b61a6008309fba95f9",
"status": "affected",
"version": "1ce9e6055fa0a9043405c5604cf19169ec5379ff",
"versionType": "git"
},
{
"lessThan": "cfe8128ceb78374b0f9cebb608bb48e3928d784a",
"status": "affected",
"version": "1ce9e6055fa0a9043405c5604cf19169ec5379ff",
"versionType": "git"
},
{
"lessThan": "3e6400e3b8b858cdf0f8d70b20d8b55d703af368",
"status": "affected",
"version": "1ce9e6055fa0a9043405c5604cf19169ec5379ff",
"versionType": "git"
},
{
"lessThan": "d595358276b60e5df4d3930bc94033249b1d5adc",
"status": "affected",
"version": "1ce9e6055fa0a9043405c5604cf19169ec5379ff",
"versionType": "git"
},
{
"lessThan": "75d276e5bb68778b2916f98a2bc30f142ebadc64",
"status": "affected",
"version": "1ce9e6055fa0a9043405c5604cf19169ec5379ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/virtio/virtio_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_ring: fix stale descriptor flags after a failed packed add\n\nIn a packed ring the AVAIL and USED bits sit in the descriptor itself,\nso writing them makes that descriptor available. Those bit combinations\nflip meaning on every round of the ring, tracked by a wrap counter, so\ninvalidating or validating a descriptor means inverting both bits.\n\nCommit 1ce9e6055fa0 (\"virtio_ring: introduce packed ring support\") has\nvirtqueue_add_packed() make every descriptor of a chain available as it\nmaps the chain, and write the head last. The device consumes the ring in\norder and stops at a head that is not available yet, so it never reaches\nthe rest.\n\nWhen vring_map_one_sg() fails partway, unmap_release unmaps the segments\nand restores avail_used_flags, but the descriptors it wrote to in the\nring stay marked with AVAIL and USED bits. The head is now the only\nentry that keeps the device from consuming these stale entries.\n\nFor example, the ring would look like this now.\n\n Z - pre-previous command\n A - previous command\n B - aborted command\n C - current command\n\n [A1 DONE] [A2 DONE] \u003cC1 EMPTY\u003e [B2] [B3] [Z1 DONE]\n\nWhen the driver now attempts to issue the C command, the next add starts\nat the same head as B. If C spans less descriptors than B, there is no\nend marker because AVAIL and USED bits were still in place. And that\nmeans the device will start interpreting these stale entries (B2/B3) as\nanother command entry, which then blocks the queue.\n\nThis effect typically happens in swiotlb configurations under memory\npressure, because vring_map_one_sg() can then fail with larger I/O\nrequests which then leads to command abortions.\n\nThere are broadly 2 ways to avoid leaving those flags behind:\n\n 1) Defer those flags too until the chain is complete.\n 2) Rewrite those flags for the previous wrap counter.\n\nImplement the second option in both packed add paths. The first option\ntraverses the chain a second time on every successful add. The second\noption invalidates all added descriptors when any add fails.\n\nWith this patch applied, a packed virtqueue keeps completing requests\nafter a failed add."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:01.948Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ad081761a1f0b0d95ab08b61a6008309fba95f9"
},
{
"url": "https://git.kernel.org/stable/c/cfe8128ceb78374b0f9cebb608bb48e3928d784a"
},
{
"url": "https://git.kernel.org/stable/c/3e6400e3b8b858cdf0f8d70b20d8b55d703af368"
},
{
"url": "https://git.kernel.org/stable/c/d595358276b60e5df4d3930bc94033249b1d5adc"
},
{
"url": "https://git.kernel.org/stable/c/75d276e5bb68778b2916f98a2bc30f142ebadc64"
}
],
"title": "virtio_ring: fix stale descriptor flags after a failed packed add",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97997",
"datePublished": "2026-09-25T10:23:27.493Z",
"dateReserved": "2026-09-25T10:18:58.209Z",
"dateUpdated": "2026-10-21T12:54:01.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98099 (GCVE-0-2026-98099)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
Several places in net/ipv6/mcast.c update RCU-protected lists
(np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer
assignments instead of rcu_assign_pointer():
1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:
*map = ma->next;
without rcu_assign_pointer() while concurrent readers traverse
idev->mc_list locklessly under rcu_read_lock().
2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group
from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and
np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing
with lockless readers in inet6_mc_check().
3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to
np->ipv6_mc_list via raw assignment before publishing mc_lst.
4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers
passed into rcu_assign_pointer() lacked explicit dereference helpers.
Fix these by consistently using rcu_assign_pointer() along with
mc_dereference() / sock_dereference().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b",
"status": "affected",
"version": "456b61bca8ee324ab6c18b065e632c9a8c88aa39",
"versionType": "git"
},
{
"lessThan": "49d7e1b456ba2f3ee08b3e264d999c09992cde8e",
"status": "affected",
"version": "456b61bca8ee324ab6c18b065e632c9a8c88aa39",
"versionType": "git"
},
{
"lessThan": "afca229b39acc2590976b3e4f6e0fe76cededc60",
"status": "affected",
"version": "456b61bca8ee324ab6c18b065e632c9a8c88aa39",
"versionType": "git"
},
{
"lessThan": "2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6",
"status": "affected",
"version": "456b61bca8ee324ab6c18b065e632c9a8c88aa39",
"versionType": "git"
},
{
"lessThan": "0c8f56c583c3250408367880c98e4d6fbc929315",
"status": "affected",
"version": "456b61bca8ee324ab6c18b065e632c9a8c88aa39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use rcu_assign_pointer() for __rcu list updates\n\nSeveral places in net/ipv6/mcast.c update RCU-protected lists\n(np-\u003eipv6_mc_list, idev-\u003emc_list, idev-\u003emc_tomb) using direct pointer\nassignments instead of rcu_assign_pointer():\n\n1. In __ipv6_dev_mc_dec(), unlinking a group from idev-\u003emc_list did:\n *map = ma-\u003enext;\n without rcu_assign_pointer() while concurrent readers traverse\n idev-\u003emc_list locklessly under rcu_read_lock().\n2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group\n from np-\u003eipv6_mc_list directly assigned *lnk = mc_lst-\u003enext and\n np-\u003eipv6_mc_list = mc_lst-\u003enext without rcu_assign_pointer(), racing\n with lockless readers in inet6_mc_check().\n3. In __ipv6_sock_mc_join(), mc_lst-\u003enext was initialized to\n np-\u003eipv6_mc_list via raw assignment before publishing mc_lst.\n4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers\n passed into rcu_assign_pointer() lacked explicit dereference helpers.\n\nFix these by consistently using rcu_assign_pointer() along with\nmc_dereference() / sock_dereference()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:29.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b"
},
{
"url": "https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e"
},
{
"url": "https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60"
},
{
"url": "https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6"
},
{
"url": "https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315"
}
],
"title": "ipv6: mcast: use rcu_assign_pointer() for __rcu list updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98099",
"datePublished": "2026-09-25T10:24:28.929Z",
"dateReserved": "2026-09-25T10:19:56.077Z",
"dateUpdated": "2026-10-21T12:54:29.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43325 (GCVE-0-2026-43325)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't send a 6E related command when not supported
MCC_ALLOWED_AP_TYPE_CMD is related to 6E support. Do not send it if the
device doesn't support 6E.
Apparently, the firmware is mistakenly advertising support for this
command even on AX201 which does not support 6E and then the firmware
crashes.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:35:48.430887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:49.166Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0e380109984e5499b969230131a3e80efc1613f",
"status": "affected",
"version": "0d2fc8821a7d667180ce27732697105db843a1b9",
"versionType": "git"
},
{
"lessThan": "c0b3fa5e0eaecd38e6a9f8f78e86f468fbde719a",
"status": "affected",
"version": "0d2fc8821a7d667180ce27732697105db843a1b9",
"versionType": "git"
},
{
"lessThan": "6607d0e58ceca997816122568ce54db9e134edab",
"status": "affected",
"version": "0d2fc8821a7d667180ce27732697105db843a1b9",
"versionType": "git"
},
{
"lessThan": "323156c3541e23da7e582008a7ac30cd51b60acd",
"status": "affected",
"version": "0d2fc8821a7d667180ce27732697105db843a1b9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don\u0027t send a 6E related command when not supported\n\nMCC_ALLOWED_AP_TYPE_CMD is related to 6E support. Do not send it if the\ndevice doesn\u0027t support 6E.\nApparently, the firmware is mistakenly advertising support for this\ncommand even on AX201 which does not support 6E and then the firmware\ncrashes."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:38.291Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0e380109984e5499b969230131a3e80efc1613f"
},
{
"url": "https://git.kernel.org/stable/c/c0b3fa5e0eaecd38e6a9f8f78e86f468fbde719a"
},
{
"url": "https://git.kernel.org/stable/c/6607d0e58ceca997816122568ce54db9e134edab"
},
{
"url": "https://git.kernel.org/stable/c/323156c3541e23da7e582008a7ac30cd51b60acd"
}
],
"title": "wifi: iwlwifi: mvm: don\u0027t send a 6E related command when not supported",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43325",
"datePublished": "2026-05-08T13:31:09.536Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-11-06T15:42:49.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53109 (GCVE-0-2026-53109)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-11-06 16:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
powerpc uses pt_frag_refcount as a reference counter for tracking it's
pte and pmd page table fragments. For PTE table, in case of Hash with
64K pagesize, we have 16 fragments of 4K size in one 64K page.
Patch series [1] "mm: free retracted page table by RCU"
added pte_free_defer() to defer the freeing of PTE tables when
retract_page_tables() is called for madvise MADV_COLLAPSE on shmem
range.
[1]: https://lore.kernel.org/all/7cd843a9-aa80-14f-5eb2-33427363c20@google.com/
pte_free_defer() sets the active flag on the corresponding fragment's
folio & calls pte_fragment_free(), which reduces the pt_frag_refcount.
When pt_frag_refcount reaches 0 (no active fragment using the folio), it
checks if the folio active flag is set, if set, it calls call_rcu to
free the folio, it the active flag is unset then it calls pte_free_now().
Now, this can lead to following problem in a corner case...
[ 265.351553][ T183] BUG: Bad page state in process a.out pfn:20d62
[ 265.353555][ T183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20d62
[ 265.355457][ T183] flags: 0x3ffff800000100(active|node=0|zone=0|lastcpupid=0x7ffff)
[ 265.358719][ T183] raw: 003ffff800000100 0000000000000000 5deadbeef0000122 0000000000000000
[ 265.360177][ T183] raw: 0000000000000000 c0000000119caf58 00000000ffffffff 0000000000000000
[ 265.361438][ T183] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 265.362572][ T183] Modules linked in:
[ 265.364622][ T183] CPU: 0 UID: 0 PID: 183 Comm: a.out Not tainted 6.18.0-rc3-00141-g1ddeaaace7ff-dirty #53 VOLUNTARY
[ 265.364785][ T183] Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries
[ 265.364908][ T183] Call Trace:
[ 265.364955][ T183] [c000000011e6f7c0] [c000000001cfaa18] dump_stack_lvl+0x130/0x148 (unreliable)
[ 265.365202][ T183] [c000000011e6f7f0] [c000000000794758] bad_page+0xb4/0x1c8
[ 265.365384][ T183] [c000000011e6f890] [c00000000079c020] __free_frozen_pages+0x838/0xd08
[ 265.365554][ T183] [c000000011e6f980] [c0000000000a70ac] pte_frag_destroy+0x298/0x310
[ 265.365729][ T183] [c000000011e6fa30] [c0000000000aa764] arch_exit_mmap+0x34/0x218
[ 265.365912][ T183] [c000000011e6fa80] [c000000000751698] exit_mmap+0xb8/0x820
[ 265.366080][ T183] [c000000011e6fc30] [c0000000001b1258] __mmput+0x98/0x300
[ 265.366244][ T183] [c000000011e6fc80] [c0000000001c81f8] do_exit+0x470/0x1508
[ 265.366421][ T183] [c000000011e6fd70] [c0000000001c95e4] do_group_exit+0x88/0x148
[ 265.366602][ T183] [c000000011e6fdc0] [c0000000001c96ec] pid_child_should_wake+0x0/0x178
[ 265.366780][ T183] [c000000011e6fdf0] [c00000000003a270] system_call_exception+0x1b0/0x4e0
[ 265.366958][ T183] [c000000011e6fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
The bad page state error occurs when such a folio gets freed (with
active flag set), from do_exit() path in parallel.
... this can happen when the pte fragment was allocated from this folio,
but when all the fragments get freed, the pte_frag_refcount still had some
unused fragments. Now, if this process exits, with such folio as it's cached
pte_frag in mm->context, then during pte_frag_destroy(), we simply call
pagetable_dtor() and pagetable_free(), meaning it doesn't clear the
active flag. This, can lead to the above bug. Since we are anyway in
do_exit() path, then if the refcount is 0, then I guess it should be
ok to simply clear the folio active flag before calling pagetable_dtor()
& pagetable_free().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:19:05.651358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:24:00.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/mm/pgtable-frag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9d197c248e70278645f206defa87f085826c4c1",
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"versionType": "git"
},
{
"lessThan": "f4bc93135bfe39e7052d31e4c71f5f838e0bf516",
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"versionType": "git"
},
{
"lessThan": "c8b710655012a2993a9567873fb71a8a51f8459c",
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"versionType": "git"
},
{
"lessThan": "a32db6fca3c74b4eb8bae5470f0680deb4cbac6f",
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"versionType": "git"
},
{
"lessThan": "fda4d71651f71c44b35829d13f3c8bf920032f77",
"status": "affected",
"version": "32cc0b7c9d508efde8946a82eb3c4acfa8dfed15",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/mm/pgtable-frag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pgtable-frag: Fix bad page state in pte_frag_destroy\n\npowerpc uses pt_frag_refcount as a reference counter for tracking it\u0027s\npte and pmd page table fragments. For PTE table, in case of Hash with\n64K pagesize, we have 16 fragments of 4K size in one 64K page.\n\nPatch series [1] \"mm: free retracted page table by RCU\"\nadded pte_free_defer() to defer the freeing of PTE tables when\nretract_page_tables() is called for madvise MADV_COLLAPSE on shmem\nrange.\n[1]: https://lore.kernel.org/all/7cd843a9-aa80-14f-5eb2-33427363c20@google.com/\n\npte_free_defer() sets the active flag on the corresponding fragment\u0027s\nfolio \u0026 calls pte_fragment_free(), which reduces the pt_frag_refcount.\nWhen pt_frag_refcount reaches 0 (no active fragment using the folio), it\nchecks if the folio active flag is set, if set, it calls call_rcu to\nfree the folio, it the active flag is unset then it calls pte_free_now().\n\nNow, this can lead to following problem in a corner case...\n\n[ 265.351553][ T183] BUG: Bad page state in process a.out pfn:20d62\n[ 265.353555][ T183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20d62\n[ 265.355457][ T183] flags: 0x3ffff800000100(active|node=0|zone=0|lastcpupid=0x7ffff)\n[ 265.358719][ T183] raw: 003ffff800000100 0000000000000000 5deadbeef0000122 0000000000000000\n[ 265.360177][ T183] raw: 0000000000000000 c0000000119caf58 00000000ffffffff 0000000000000000\n[ 265.361438][ T183] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n[ 265.362572][ T183] Modules linked in:\n[ 265.364622][ T183] CPU: 0 UID: 0 PID: 183 Comm: a.out Not tainted 6.18.0-rc3-00141-g1ddeaaace7ff-dirty #53 VOLUNTARY\n[ 265.364785][ T183] Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries\n[ 265.364908][ T183] Call Trace:\n[ 265.364955][ T183] [c000000011e6f7c0] [c000000001cfaa18] dump_stack_lvl+0x130/0x148 (unreliable)\n[ 265.365202][ T183] [c000000011e6f7f0] [c000000000794758] bad_page+0xb4/0x1c8\n[ 265.365384][ T183] [c000000011e6f890] [c00000000079c020] __free_frozen_pages+0x838/0xd08\n[ 265.365554][ T183] [c000000011e6f980] [c0000000000a70ac] pte_frag_destroy+0x298/0x310\n[ 265.365729][ T183] [c000000011e6fa30] [c0000000000aa764] arch_exit_mmap+0x34/0x218\n[ 265.365912][ T183] [c000000011e6fa80] [c000000000751698] exit_mmap+0xb8/0x820\n[ 265.366080][ T183] [c000000011e6fc30] [c0000000001b1258] __mmput+0x98/0x300\n[ 265.366244][ T183] [c000000011e6fc80] [c0000000001c81f8] do_exit+0x470/0x1508\n[ 265.366421][ T183] [c000000011e6fd70] [c0000000001c95e4] do_group_exit+0x88/0x148\n[ 265.366602][ T183] [c000000011e6fdc0] [c0000000001c96ec] pid_child_should_wake+0x0/0x178\n[ 265.366780][ T183] [c000000011e6fdf0] [c00000000003a270] system_call_exception+0x1b0/0x4e0\n[ 265.366958][ T183] [c000000011e6fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n\nThe bad page state error occurs when such a folio gets freed (with\nactive flag set), from do_exit() path in parallel.\n\n... this can happen when the pte fragment was allocated from this folio,\nbut when all the fragments get freed, the pte_frag_refcount still had some\nunused fragments. Now, if this process exits, with such folio as it\u0027s cached\npte_frag in mm-\u003econtext, then during pte_frag_destroy(), we simply call\npagetable_dtor() and pagetable_free(), meaning it doesn\u0027t clear the\nactive flag. This, can lead to the above bug. Since we are anyway in\ndo_exit() path, then if the refcount is 0, then I guess it should be\nok to simply clear the folio active flag before calling pagetable_dtor()\n\u0026 pagetable_free()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:03.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9d197c248e70278645f206defa87f085826c4c1"
},
{
"url": "https://git.kernel.org/stable/c/f4bc93135bfe39e7052d31e4c71f5f838e0bf516"
},
{
"url": "https://git.kernel.org/stable/c/c8b710655012a2993a9567873fb71a8a51f8459c"
},
{
"url": "https://git.kernel.org/stable/c/a32db6fca3c74b4eb8bae5470f0680deb4cbac6f"
},
{
"url": "https://git.kernel.org/stable/c/fda4d71651f71c44b35829d13f3c8bf920032f77"
}
],
"title": "powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53109",
"datePublished": "2026-06-24T16:30:43.364Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-11-06T16:24:00.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90204 (GCVE-0-2026-90204)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate DIO orphan slot during inode read
[BUG]
A corrupted append-DIO dinode (high byte at offset 0xa1
corrupted from 0 to 1) can carry an i_dio_orphaned_slot
outside the mounted filesystem slot range and trigger a
use-after-free error:
BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102
Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85
Call Trace:
...
ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102
ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840
ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]
ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295
evict+0x38e/0x8f0 fs/inode.c:810
iput_final fs/inode.c:1914 [inline]
iput fs/inode.c:1966 [inline]
iput+0x55b/0x8b0 fs/inode.c:1926
ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374
ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373
...
[CAUSE]
ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the
slot-local system inode cache. The dinode validator does not check
this active slot, so an out-of-range value produces an invalid cache
entry pointer that is dereferenced as an inode pointer.
[FIX]
Reject an active i_dio_orphaned_slot outside the slot range during
dinode validation, before DIO orphan recovery can consume it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06ee5c75b57564435933fc0ffa72dc18a2fda0e7 Version: 06ee5c75b57564435933fc0ffa72dc18a2fda0e7 Version: 06ee5c75b57564435933fc0ffa72dc18a2fda0e7 Version: 06ee5c75b57564435933fc0ffa72dc18a2fda0e7 Version: 06ee5c75b57564435933fc0ffa72dc18a2fda0e7 Version: 06ee5c75b57564435933fc0ffa72dc18a2fda0e7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5fcd0aa818e08ede9a1d705ffadb0a19b565ebc",
"status": "affected",
"version": "06ee5c75b57564435933fc0ffa72dc18a2fda0e7",
"versionType": "git"
},
{
"lessThan": "eacdd27ca829747d4372fbae8617151072a4d1e5",
"status": "affected",
"version": "06ee5c75b57564435933fc0ffa72dc18a2fda0e7",
"versionType": "git"
},
{
"lessThan": "8f7a2c5cf23d437acab7f3e739bfcad0f443c554",
"status": "affected",
"version": "06ee5c75b57564435933fc0ffa72dc18a2fda0e7",
"versionType": "git"
},
{
"lessThan": "e35fa6eb4d2a39f8049f62361a4b44930882b5f8",
"status": "affected",
"version": "06ee5c75b57564435933fc0ffa72dc18a2fda0e7",
"versionType": "git"
},
{
"lessThan": "418e0ae42fa769d354b15e62c01a00413024755b",
"status": "affected",
"version": "06ee5c75b57564435933fc0ffa72dc18a2fda0e7",
"versionType": "git"
},
{
"lessThan": "bb88131c9831075b8dc08cdd375743e5d44c7ca2",
"status": "affected",
"version": "06ee5c75b57564435933fc0ffa72dc18a2fda0e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate DIO orphan slot during inode read\n\n[BUG]\nA corrupted append-DIO dinode (high byte at offset 0xa1\ncorrupted from 0 to 1) can carry an i_dio_orphaned_slot\noutside the mounted filesystem slot range and trigger a\nuse-after-free error:\n\nBUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\nRead of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85\nCall Trace:\n ...\n ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\n ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840\n ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]\n ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295\n evict+0x38e/0x8f0 fs/inode.c:810\n iput_final fs/inode.c:1914 [inline]\n iput fs/inode.c:1966 [inline]\n iput+0x55b/0x8b0 fs/inode.c:1926\n ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374\n ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373\n ...\n\n[CAUSE]\nocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the\nslot-local system inode cache. The dinode validator does not check\nthis active slot, so an out-of-range value produces an invalid cache\nentry pointer that is dereferenced as an inode pointer.\n\n[FIX]\nReject an active i_dio_orphaned_slot outside the slot range during\ndinode validation, before DIO orphan recovery can consume it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad i_dio_orphaned_slot is an on-disk ocfs2_dinode field (offset 0xa0) consumed by ocfs2_del_inode_from_orphan() after ocfs2_validate_inode_block() along ocfs2_fill_super\u2192ocfs2_complete_mount_recovery\u2192ocfs2_recover_orphans (or ocfs2_add_inode_to_orphan on append DIO). No network protocol carries this slot.\nAC:L - A dinode with OCFS2_DIO_ORPHANED_FL and i_dio_orphaned_slot \u003e= osb-\u003emax_slots (the reported 0xa1 0\u21921 flip yields slot 256) makes get_local_system_inode() index slot*NUM_LOCAL_SYSTEM_INODES past the kzalloc(max_slots*NUM_LOCAL_SYSTEM_INODES) cache and igrab the out-of-range pointer with no race.\nPR:N - ocfs2_fs_type lacks FS_USERNS_MOUNT, so mount_capable() requires init-namespace CAP_SYS_ADMIN. The higher-severity case is a crafted loop/LUN image whose recovery runs when an administrator mounts it, so the attacker needs no account or capability on the victim.\nUI:R - The attacker-supplied ocfs2 image must be mounted via ocfs2_fill_super so ocfs2_complete_mount_recovery() can walk DIO orphan dirents and call ocfs2_del_inode_from_orphan() on the forged i_dio_orphaned_slot. That mount is the required victim action.\nS:U - igrab() of the out-of-range local_system_inodes[] pointer and later ocfs2_inode_lock() stay inside the kernel that mounted the volume; this is not a KVM/Xen guest-to-host escape or IOMMU/DMA bypass.\nC:H - get_local_system_inode() reads an 8-byte inode pointer past the slot-local cache, then igrab() and ocfs2_inode_lock() treat it as a live inode. KASAN reported slab-use-after-free in ocfs2_get_system_file_inode(); a UAF inode object yields an arbitrary kernel read.\nI:H - After igrab() on the OOB/UAF pointer, ocfs2_del_inode_from_orphan() takes inode_lock and ocfs2_inode_lock on that object and journals orphan-dir mutations through it, which is a type-confused write/control-flow primitive on a freed or adjacent heap object.\nA:H - igrab() on a garbage or I_FREEING pointer hits BUG_ON(!inode) in ocfs2_get_system_file_inode() or the KASAN UAF oops shown on the ocfs2_recover_orphans mount-recovery path, which is a kernel crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:44.238Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5fcd0aa818e08ede9a1d705ffadb0a19b565ebc"
},
{
"url": "https://git.kernel.org/stable/c/eacdd27ca829747d4372fbae8617151072a4d1e5"
},
{
"url": "https://git.kernel.org/stable/c/8f7a2c5cf23d437acab7f3e739bfcad0f443c554"
},
{
"url": "https://git.kernel.org/stable/c/e35fa6eb4d2a39f8049f62361a4b44930882b5f8"
},
{
"url": "https://git.kernel.org/stable/c/418e0ae42fa769d354b15e62c01a00413024755b"
},
{
"url": "https://git.kernel.org/stable/c/bb88131c9831075b8dc08cdd375743e5d44c7ca2"
}
],
"title": "ocfs2: validate DIO orphan slot during inode read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90204",
"datePublished": "2026-09-17T16:07:20.845Z",
"dateReserved": "2026-09-11T19:38:34.792Z",
"dateUpdated": "2026-10-30T12:34:44.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93104 (GCVE-0-2026-93104)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rvt: Return NULL after port allocation failure
rvt_alloc_device() deallocates the IB device when its port array cannot
be allocated but then returns the pointer to the released allocation.
Callers treat any non-NULL value as valid and dereference it, resulting
in a use-after-free.
Return NULL immediately after deallocation so callers can propagate the
allocation failure.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ff6acd69518e0a84bd9c9b7f1bd4313f7076db97 Version: ff6acd69518e0a84bd9c9b7f1bd4313f7076db97 Version: ff6acd69518e0a84bd9c9b7f1bd4313f7076db97 Version: ff6acd69518e0a84bd9c9b7f1bd4313f7076db97 Version: ff6acd69518e0a84bd9c9b7f1bd4313f7076db97 Version: ff6acd69518e0a84bd9c9b7f1bd4313f7076db97 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rdmavt/vt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "32d2cdb0f3cac430b04124c3b7248851fe2037f8",
"status": "affected",
"version": "ff6acd69518e0a84bd9c9b7f1bd4313f7076db97",
"versionType": "git"
},
{
"lessThan": "b7129930d1ec46c03a0de07fdce6c29f75795006",
"status": "affected",
"version": "ff6acd69518e0a84bd9c9b7f1bd4313f7076db97",
"versionType": "git"
},
{
"lessThan": "5a1a7a5e2fe1a15824fa9ae5edd8f008259471d1",
"status": "affected",
"version": "ff6acd69518e0a84bd9c9b7f1bd4313f7076db97",
"versionType": "git"
},
{
"lessThan": "80968b42d13080bf7bc1f3ee17fef126ce2ad98f",
"status": "affected",
"version": "ff6acd69518e0a84bd9c9b7f1bd4313f7076db97",
"versionType": "git"
},
{
"lessThan": "b1e1b25723af44328524c7b54433e4bf0ab9930c",
"status": "affected",
"version": "ff6acd69518e0a84bd9c9b7f1bd4313f7076db97",
"versionType": "git"
},
{
"lessThan": "2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f",
"status": "affected",
"version": "ff6acd69518e0a84bd9c9b7f1bd4313f7076db97",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rdmavt/vt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rvt: Return NULL after port allocation failure\n\nrvt_alloc_device() deallocates the IB device when its port array cannot\nbe allocated but then returns the pointer to the released allocation.\nCallers treat any non-NULL value as valid and dereference it, resulting\nin a use-after-free.\n\nReturn NULL immediately after deallocation so callers can propagate the\nallocation failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:59.264Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/32d2cdb0f3cac430b04124c3b7248851fe2037f8"
},
{
"url": "https://git.kernel.org/stable/c/b7129930d1ec46c03a0de07fdce6c29f75795006"
},
{
"url": "https://git.kernel.org/stable/c/5a1a7a5e2fe1a15824fa9ae5edd8f008259471d1"
},
{
"url": "https://git.kernel.org/stable/c/80968b42d13080bf7bc1f3ee17fef126ce2ad98f"
},
{
"url": "https://git.kernel.org/stable/c/b1e1b25723af44328524c7b54433e4bf0ab9930c"
},
{
"url": "https://git.kernel.org/stable/c/2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f"
}
],
"title": "RDMA/rvt: Return NULL after port allocation failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93104",
"datePublished": "2026-09-17T16:11:15.760Z",
"dateReserved": "2026-09-17T16:02:15.085Z",
"dateUpdated": "2026-10-30T12:35:59.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99191 (GCVE-0-2026-99191)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
calipso_skbuff_setattr() adjusts payload_len by the length of the
option it inserts or resizes:
payload = ntohs(ip6_hdr->payload_len);
ip6_hdr->payload_len = htons(payload + len_delta);
GRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores
payload_len == 0 for them; ipv6_payload_len() then falls back to
skb->len. For such a packet forwarded to a destination mapped to
CALIPSO, the code above writes len_delta (or 65536 + len_delta when
shrinking) into payload_len, and ipv6_payload_len() no longer falls
back to skb->len. nf_tables, conntrack and sch_cake rely on it.
The same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,
and a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its
real length back.
Set payload_len from the skb length with ipv6_set_payload_len(), which
stores 0 above IPV6_MAXPLEN and the real length otherwise, as
ipv6_gro_complete() does. The network header was just reset to
skb->data, so skb->len - sizeof(*ip6_hdr) is the payload length.
Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal
mdp-generated policy (network_peer_controls=1), "netlabelctl calipso
add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO
DOI 16. calipso_skbuff_setattr() was called through
netlbl_skbuff_setattr() from a test-only debugfs hook (not part of
this patch) adding a level-only label; payload_len after the call:
case before fix after fix real length
1000, unlabeled 1016 1016 1016
70000 GSO, payload_len 0 16 0 70016
65530 GSO, grows past MAXPLEN 10 0 65546
65540 GSO with a 24 byte hop
header, shrinks below MAXPLEN 65528 65532 65532
1000 with a 24 byte hop header 992 992 992
(0 means ipv6_payload_len() returns the real length.) On the forward
path, with a client injecting unlabeled UDP through a router to a
server, the router adds the CALIPSO option and the server delivers all
datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/calipso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e29d0a00c619ac794b05d64f4438204478137365",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
},
{
"lessThan": "929dc8e2c9165bb651dca26b2c68067a3880406b",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
},
{
"lessThan": "1c9fcfca51e3c5cd46dd72a4da74d56eff183513",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
},
{
"lessThan": "8ee0e03663826a76507048d58466b29321a57656",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
},
{
"lessThan": "8070ed578b6b9134e045627fb745c887a806d46e",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/calipso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload = ntohs(ip6_hdr-\u003epayload_len);\n\tip6_hdr-\u003epayload_len = htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len == 0 for them; ipv6_payload_len() then falls back to\nskb-\u003elen. For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer falls\nback to skb-\u003elen. nf_tables, conntrack and sch_cake rely on it.\n\nThe same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,\nand a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its\nreal length back.\n\nSet payload_len from the skb length with ipv6_set_payload_len(), which\nstores 0 above IPV6_MAXPLEN and the real length otherwise, as\nipv6_gro_complete() does. The network header was just reset to\nskb-\u003edata, so skb-\u003elen - sizeof(*ip6_hdr) is the payload length.\n\nTested on one kernel (arm64, QEMU) with SELinux permissive, a minimal\nmdp-generated policy (network_peer_controls=1), \"netlabelctl calipso\nadd pass doi:16\" and a NetLabel mapping of fd00:2::/64 to CALIPSO\nDOI 16. calipso_skbuff_setattr() was called through\nnetlbl_skbuff_setattr() from a test-only debugfs hook (not part of\nthis patch) adding a level-only label; payload_len after the call:\n\n case before fix after fix real length\n 1000, unlabeled 1016 1016 1016\n 70000 GSO, payload_len 0 16 0 70016\n 65530 GSO, grows past MAXPLEN 10 0 65546\n 65540 GSO with a 24 byte hop\n header, shrinks below MAXPLEN 65528 65532 65532\n 1000 with a 24 byte hop header 992 992 992\n\n(0 means ipv6_payload_len() returns the real length.) On the forward\npath, with a client injecting unlabeled UDP through a router to a\nserver, the router adds the CALIPSO option and the server delivers all\ndatagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:48.993Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e29d0a00c619ac794b05d64f4438204478137365"
},
{
"url": "https://git.kernel.org/stable/c/929dc8e2c9165bb651dca26b2c68067a3880406b"
},
{
"url": "https://git.kernel.org/stable/c/1c9fcfca51e3c5cd46dd72a4da74d56eff183513"
},
{
"url": "https://git.kernel.org/stable/c/8ee0e03663826a76507048d58466b29321a57656"
},
{
"url": "https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"
}
],
"title": "calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99191",
"datePublished": "2026-10-28T10:35:47.854Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-30T12:42:48.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90347 (GCVE-0-2026-90347)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync
with tracer updates") attempted to resolve a long-standing issue with
syscall entry tracing, where a tracer is able to manipulate the first
syscall argument without being subjected to seccomp or audit checking.
Unfortunately, that fix was incomplete [1], as it failed to update
'orig_x0' between a tracer updating x0 during a seccomp ptrace exit
(SECCOMP_RET_TRACE) and the seccomp filter being re-evaluated.
Rather than add hooks to the core seccomp code, instead move the
synchronisation code into the ptrace GPR and syscall setting code so
that 'orig_x0' is kept up to date with x0 whenever we're stopped on the
syscall entry path.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 Version: a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 Version: a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 Version: a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 Version: a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 Version: a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kernel/ptrace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9e7743b1067ea38c4ad2665d40c3c4a920ad9a9",
"status": "affected",
"version": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615",
"versionType": "git"
},
{
"lessThan": "332c9c1a148d0425326989c1187face8f6b2a60c",
"status": "affected",
"version": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615",
"versionType": "git"
},
{
"lessThan": "ce17c651a90e242ad48df0df89b1e4cebcda5e14",
"status": "affected",
"version": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615",
"versionType": "git"
},
{
"lessThan": "e9e2854fcff5733ffc607e8ecc87e0e591ab41fd",
"status": "affected",
"version": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615",
"versionType": "git"
},
{
"lessThan": "f433869f23841a50455c4087d85540d5b4d37cde",
"status": "affected",
"version": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615",
"versionType": "git"
},
{
"lessThan": "88b839ce497ccb1ff92f7ae742c78dd2937ba572",
"status": "affected",
"version": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kernel/ptrace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: ptrace: Keep \u0027orig_x0\u0027 in-sync with x0 on syscall entry\n\nCommit e057b9477232 (\"arm64: syscall: Ensure saved x0 is kept in-sync\nwith tracer updates\") attempted to resolve a long-standing issue with\nsyscall entry tracing, where a tracer is able to manipulate the first\nsyscall argument without being subjected to seccomp or audit checking.\n\nUnfortunately, that fix was incomplete [1], as it failed to update\n\u0027orig_x0\u0027 between a tracer updating x0 during a seccomp ptrace exit\n(SECCOMP_RET_TRACE) and the seccomp filter being re-evaluated.\n\nRather than add hooks to the core seccomp code, instead move the\nsynchronisation code into the ptrace GPR and syscall setting code so\nthat \u0027orig_x0\u0027 is kept up to date with x0 whenever we\u0027re stopped on the\nsyscall entry path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled value is x0 written by ptrace(PTRACE_SETREGSET, NT_PRSTATUS) into gpr_set() while the tracee is stopped in syscall_trace_enter() after ptrace_report_syscall_entry() or ptrace_event(PTRACE_EVENT_SECCOMP) from SECCOMP_RET_TRACE. That write is a local ptrace syscall, not a received protocol message.\nAC:L - The tracer owns the stop: waitpid() for the PTRACE_SYSCALL enter-stop or PTRACE_EVENT_SECCOMP trap, PTRACE_SETREGSET to replace regs[0], then PTRACE_CONT. el0_svc_common() then reaches secure_computing() with orig_x0 still equal to the pre-ptrace x0. No race or uninfluenced layout is required.\nPR:L - __ptrace_may_access() allows a same-uid tracer, and default yama ptrace_scope (YAMA_SCOPE_RELATIONAL) permits PTRACE_TRACEME or PTRACE_ATTACH to a descendant without CAP_SYS_PTRACE. An ordinary user can fork, trace the child, and issue PTRACE_SETREGSET; init-namespace root is not required.\nUI:N - The attacker issues PTRACE_TRACEME/PTRACE_SYSCALL, PTRACE_SETREGSET of NT_PRSTATUS, and the in-flight syscall on their own descendant. No separate victim action such as mounting a filesystem or opening a file is required.\nS:C - populate_seccomp_data() exposes orig_x0 as sd.args[0] to a parent-installed seccomp filter (container runtime, systemd RestrictNamespaces, Android minijail). gpr_set() updates regs[0] without orig_x0, so invoke_syscall() via SC_ARM64_REGS_TO_ARGS runs a denied first argument while the filter still allows the old orig_x0, escaping that sandbox.\nC:H - syscall_get_arguments() returns stale orig_x0 to seccomp while __arm64_sys_* wrappers take regs[0]. A tracer starts an allowed openat(dfd) or socket(domain) and replaces x0 with a blocked directory fd or AF_NETLINK/AF_PACKET, so the syscall discloses files or netlink state the filter was written to deny.\nI:H - arm64 clone() takes clone_flags in x0 (CONFIG_CLONE_BACKWARDS). After gpr_set() writes regs[0] without orig_x0, __seccomp_filter() (including the SECCOMP_RET_TRACE recheck) still sees the allowed flags while invoke_syscall() honors CLONE_NEWUSER/CLONE_NEWNS the policy forbade; substituting write/ioctl\u0027s fd in x0 likewise modifies data the filter blocked.\nA:N - The bug is orig_x0 remaining stale after gpr_set() so populate_seccomp_data() and audit_syscall_entry() inspect the wrong first argument. That is a seccomp/audit policy bypass, not memory corruption, and it does not oops, panic, deadlock, or hang the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:19.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9e7743b1067ea38c4ad2665d40c3c4a920ad9a9"
},
{
"url": "https://git.kernel.org/stable/c/332c9c1a148d0425326989c1187face8f6b2a60c"
},
{
"url": "https://git.kernel.org/stable/c/ce17c651a90e242ad48df0df89b1e4cebcda5e14"
},
{
"url": "https://git.kernel.org/stable/c/e9e2854fcff5733ffc607e8ecc87e0e591ab41fd"
},
{
"url": "https://git.kernel.org/stable/c/f433869f23841a50455c4087d85540d5b4d37cde"
},
{
"url": "https://git.kernel.org/stable/c/88b839ce497ccb1ff92f7ae742c78dd2937ba572"
}
],
"title": "arm64: ptrace: Keep \u0027orig_x0\u0027 in-sync with x0 on syscall entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90347",
"datePublished": "2026-09-17T16:08:56.232Z",
"dateReserved": "2026-09-11T19:38:34.805Z",
"dateUpdated": "2026-10-30T12:35:19.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90264 (GCVE-0-2026-90264)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: always wait for ordered extents to avoid OE races
[BUG]
Syzbot reported a bug that there can be conflicting OEs for the same
range:
BTRFS critical (device loop4): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 16384 num_bytes 430080 flags 0x1089, new oe file_offset 16384 num_bytes 430080 flags 0x80 (errno=-17 Object alrea[ 179.162726][ T6897] BTRFS critical (device loop4): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 16384 num_bytes 430080 flags 0x1089, new oe file_offset 16384 num_bytes 430080 flags 0x80 (errno=-17 Object already exists)
------------[ cut here ]------------
kernel BUG at fs/btrfs/ordered-data.c:264!
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:btrfs_alloc_ordered_extent+0x943/0xad0
Call Trace:
<TASK>
cow_file_range+0x744/0x12a0
fallback_to_cow+0x5ea/0xa00
run_delalloc_nocow+0x110c/0x17a0
btrfs_run_delalloc_range+0xbe4/0x1c20
writepage_delalloc+0x104d/0x1ba0
btrfs_writepages+0x1667/0x28b0
do_writepages+0x338/0x560
filemap_fdatawrite_range+0x1f2/0x300
btrfs_fdatawrite_range+0x54/0xf0
btrfs_direct_write+0x6a0/0xc30
btrfs_do_write_iter+0x329/0x790
do_iter_readv_writev+0x624/0x8d0
vfs_writev+0x34c/0x990
__se_sys_pwritev2+0x17a/0x2a0
do_syscall_64+0x174/0x580
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
---[ end trace 0000000000000000 ]---
[CAUSE]
Since commit ff66fe666233 ("btrfs: fix incorrect buffered IO fallback
for append direct writes"), if the direct IO finished short, we will
revert the isize back to the original one, so that append writes can be
respected during the buffered fallback.
Normally we rely on lock_and_cleanup_extent_if_need() function during
buffered writeback to wait for any existing ordered extents.
But that ordered extent waiting only happens if the start_pos is inside
the isize.
Since we have reverted the isize during failed direct IO, we will not
wait for any ordered extents.
This means we can have a race where the direct IO OE is still in the
tree, finished but not yet removed, then we're inserting the OE for the
buffered write, causing the above crash.
[FIX]
Make the OE wait to be unconditional, to handle the reverted isize
situation.
And since lock_and_cleanup_extent_if_need() now either lock the
extents or return -EAGAIN, also remove the branches that handles
no-extent-locked cases, and rename it to remove the "_if_need" suffix.
The following micro benchmark shows the runtime difference for
btrfs_buffered_write(), doing `xfs_io -f -c "pwrite 0 1m"` workload,
all values are the average runtime in nano seconds.
function runtime | before | after
-----------------------------------+-------------+---------------
lock_and_cleanup_extent_if_need() | 58.2 | 183.0
btrfs_buffered_write() | 2115.6 | 2973.3
The overall runtime of btrfs_buffered_write() is still pretty
tiny (still less than 3 micro seconds), I'd say the extra cost is still
acceptable.
An alternative to fix this problem is to wait ordered extents during
iomap_end() where the isize revert is done.
But that solution will break nowait requirement, as if a nowait direct
IO finished short, we have to wait for the OEs unconditionally or the
next append buffered IO can still hit the same problem.
So here we have to move the wait cost to buffered write, but at least
the code is slightly more streamline.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 10b1abc1d0c8ae25c2b9ac465515717c68ffff05 Version: 097b159d43407b4ea0e5d14ae58a3bbfa5865a24 Version: ccd5c23122b01de646c80485e2fadac82d1aab62 Version: c3a3d3986719026c85950bfa6f41a251fc46e16f Version: ff66fe6662330226b3f486014c375538d91c44aa Version: ff66fe6662330226b3f486014c375538d91c44aa Version: 4b5875cbb85dbf4d11385eb0a7a589c086d76d42 Version: b8df7f486a4617d3096b8fa27148cfa54b1d6a8d Version: 6.1.178 ≤ Version: 6.6.145 ≤ Version: 6.12.97 ≤ Version: 6.18.40 ≤ Version: 5.15.212 ≤ Version: 7.1.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fa9f6e1958bb05b8a660d9cf2b6f51dee0077290",
"status": "affected",
"version": "10b1abc1d0c8ae25c2b9ac465515717c68ffff05",
"versionType": "git"
},
{
"lessThan": "043b6fd9706e4335851f317352d2717ad40e6d83",
"status": "affected",
"version": "097b159d43407b4ea0e5d14ae58a3bbfa5865a24",
"versionType": "git"
},
{
"lessThan": "de8f5cb3cb611f96909797b4b017831f5141cbbe",
"status": "affected",
"version": "ccd5c23122b01de646c80485e2fadac82d1aab62",
"versionType": "git"
},
{
"lessThan": "58ce50b1802a446d3b26df1b9c58be1ab8913d0e",
"status": "affected",
"version": "c3a3d3986719026c85950bfa6f41a251fc46e16f",
"versionType": "git"
},
{
"lessThan": "aaac9b352f7f53f5d2f7e58e612d67d2a2bf7094",
"status": "affected",
"version": "ff66fe6662330226b3f486014c375538d91c44aa",
"versionType": "git"
},
{
"lessThan": "ec78575dde998c21be7e0cb2503b5620f34b6255",
"status": "affected",
"version": "ff66fe6662330226b3f486014c375538d91c44aa",
"versionType": "git"
},
{
"status": "affected",
"version": "4b5875cbb85dbf4d11385eb0a7a589c086d76d42",
"versionType": "git"
},
{
"status": "affected",
"version": "b8df7f486a4617d3096b8fa27148cfa54b1d6a8d",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThan": "6.18.52",
"status": "affected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.178",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.18.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.212",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: always wait for ordered extents to avoid OE races\n\n[BUG]\nSyzbot reported a bug that there can be conflicting OEs for the same\nrange:\n\n BTRFS critical (device loop4): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 16384 num_bytes 430080 flags 0x1089, new oe file_offset 16384 num_bytes 430080 flags 0x80 (errno=-17 Object alrea[ 179.162726][ T6897] BTRFS critical (device loop4): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 16384 num_bytes 430080 flags 0x1089, new oe file_offset 16384 num_bytes 430080 flags 0x80 (errno=-17 Object already exists)\n ------------[ cut here ]------------\n kernel BUG at fs/btrfs/ordered-data.c:264!\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\n RIP: 0010:btrfs_alloc_ordered_extent+0x943/0xad0\n Call Trace:\n \u003cTASK\u003e\n cow_file_range+0x744/0x12a0\n fallback_to_cow+0x5ea/0xa00\n run_delalloc_nocow+0x110c/0x17a0\n btrfs_run_delalloc_range+0xbe4/0x1c20\n writepage_delalloc+0x104d/0x1ba0\n btrfs_writepages+0x1667/0x28b0\n do_writepages+0x338/0x560\n filemap_fdatawrite_range+0x1f2/0x300\n btrfs_fdatawrite_range+0x54/0xf0\n btrfs_direct_write+0x6a0/0xc30\n btrfs_do_write_iter+0x329/0x790\n do_iter_readv_writev+0x624/0x8d0\n vfs_writev+0x34c/0x990\n __se_sys_pwritev2+0x17a/0x2a0\n do_syscall_64+0x174/0x580\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nSince commit ff66fe666233 (\"btrfs: fix incorrect buffered IO fallback\nfor append direct writes\"), if the direct IO finished short, we will\nrevert the isize back to the original one, so that append writes can be\nrespected during the buffered fallback.\n\nNormally we rely on lock_and_cleanup_extent_if_need() function during\nbuffered writeback to wait for any existing ordered extents.\n\nBut that ordered extent waiting only happens if the start_pos is inside\nthe isize.\nSince we have reverted the isize during failed direct IO, we will not\nwait for any ordered extents.\n\nThis means we can have a race where the direct IO OE is still in the\ntree, finished but not yet removed, then we\u0027re inserting the OE for the\nbuffered write, causing the above crash.\n\n[FIX]\nMake the OE wait to be unconditional, to handle the reverted isize\nsituation.\n\nAnd since lock_and_cleanup_extent_if_need() now either lock the\nextents or return -EAGAIN, also remove the branches that handles\nno-extent-locked cases, and rename it to remove the \"_if_need\" suffix.\n\nThe following micro benchmark shows the runtime difference for\nbtrfs_buffered_write(), doing `xfs_io -f -c \"pwrite 0 1m\"` workload,\nall values are the average runtime in nano seconds.\n\n function runtime | before | after\n -----------------------------------+-------------+---------------\n lock_and_cleanup_extent_if_need() | 58.2 | 183.0\n btrfs_buffered_write() | 2115.6 | 2973.3\n\nThe overall runtime of btrfs_buffered_write() is still pretty\ntiny (still less than 3 micro seconds), I\u0027d say the extra cost is still\nacceptable.\n\nAn alternative to fix this problem is to wait ordered extents during\niomap_end() where the isize revert is done.\n\nBut that solution will break nowait requirement, as if a nowait direct\nIO finished short, we have to wait for the OEs unconditionally or the\nnext append buffered IO can still hit the same problem.\n\nSo here we have to move the wait cost to buffered write, but at least\nthe code is slightly more streamline."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:59.305Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fa9f6e1958bb05b8a660d9cf2b6f51dee0077290"
},
{
"url": "https://git.kernel.org/stable/c/043b6fd9706e4335851f317352d2717ad40e6d83"
},
{
"url": "https://git.kernel.org/stable/c/de8f5cb3cb611f96909797b4b017831f5141cbbe"
},
{
"url": "https://git.kernel.org/stable/c/58ce50b1802a446d3b26df1b9c58be1ab8913d0e"
},
{
"url": "https://git.kernel.org/stable/c/aaac9b352f7f53f5d2f7e58e612d67d2a2bf7094"
},
{
"url": "https://git.kernel.org/stable/c/ec78575dde998c21be7e0cb2503b5620f34b6255"
}
],
"title": "btrfs: always wait for ordered extents to avoid OE races",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90264",
"datePublished": "2026-09-17T16:08:00.740Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-30T12:34:59.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93129 (GCVE-0-2026-93129)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-base: Fix handling of ultra performance key
The commit message of commit 5fbd827eb9c2 ("platform/x86: dell-wmi: Recognise or support new switches")
states that the ultra performance key contains additional data
after the type and code fields. The event data passed to
dell_wmi_process_key() is already parsed, so "buffer" already
starts after those two fields.
Use the correct index for accessing the first data field to avoid
a potential buffer overread.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5fbd827eb9c224c33a5f263ee543a75fe957faa3 Version: 5fbd827eb9c224c33a5f263ee543a75fe957faa3 Version: 5fbd827eb9c224c33a5f263ee543a75fe957faa3 Version: 5fbd827eb9c224c33a5f263ee543a75fe957faa3 Version: 5fbd827eb9c224c33a5f263ee543a75fe957faa3 Version: 5fbd827eb9c224c33a5f263ee543a75fe957faa3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef16f467393ca1a15ec8431fba5e67dd6071074e",
"status": "affected",
"version": "5fbd827eb9c224c33a5f263ee543a75fe957faa3",
"versionType": "git"
},
{
"lessThan": "30674a7bbf20311a0c4edd5edb9526ef1eecc692",
"status": "affected",
"version": "5fbd827eb9c224c33a5f263ee543a75fe957faa3",
"versionType": "git"
},
{
"lessThan": "ace1a687ea9ea70d17e3089ca173acfa1ec24412",
"status": "affected",
"version": "5fbd827eb9c224c33a5f263ee543a75fe957faa3",
"versionType": "git"
},
{
"lessThan": "16a82add1918d3aae1e0b68c0a983b6fc64f5062",
"status": "affected",
"version": "5fbd827eb9c224c33a5f263ee543a75fe957faa3",
"versionType": "git"
},
{
"lessThan": "392c19faec6bf4cb72fb02322e2a61e198dd8f72",
"status": "affected",
"version": "5fbd827eb9c224c33a5f263ee543a75fe957faa3",
"versionType": "git"
},
{
"lessThan": "adfd6846bea13667ff28f8aaf00c32fbd69825ab",
"status": "affected",
"version": "5fbd827eb9c224c33a5f263ee543a75fe957faa3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-base: Fix handling of ultra performance key\n\nThe commit message of commit 5fbd827eb9c2 (\"platform/x86: dell-wmi: Recognise or support new switches\")\nstates that the ultra performance key contains additional data\nafter the type and code fields. The event data passed to\ndell_wmi_process_key() is already parsed, so \"buffer\" already\nstarts after those two fields.\n\nUse the correct index for accessing the first data field to avoid\na potential buffer overread."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:06.719Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef16f467393ca1a15ec8431fba5e67dd6071074e"
},
{
"url": "https://git.kernel.org/stable/c/30674a7bbf20311a0c4edd5edb9526ef1eecc692"
},
{
"url": "https://git.kernel.org/stable/c/ace1a687ea9ea70d17e3089ca173acfa1ec24412"
},
{
"url": "https://git.kernel.org/stable/c/16a82add1918d3aae1e0b68c0a983b6fc64f5062"
},
{
"url": "https://git.kernel.org/stable/c/392c19faec6bf4cb72fb02322e2a61e198dd8f72"
},
{
"url": "https://git.kernel.org/stable/c/adfd6846bea13667ff28f8aaf00c32fbd69825ab"
}
],
"title": "platform/x86: dell-wmi-base: Fix handling of ultra performance key",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93129",
"datePublished": "2026-09-17T16:11:32.609Z",
"dateReserved": "2026-09-17T16:02:15.087Z",
"dateUpdated": "2026-10-30T12:36:06.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80634 (GCVE-0-2026-80634)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the
decrement still happens and wraps it to 255. The break only leaves
the inner switch -- a later path entry can set info->indev back to
a real device, and we end up returning with num_encaps == 255.
nft_dev_forward_path() then walks info.encap[] (size 2) up to
num_encaps, which means an OOB stack read and a bogus count copied
into the route descriptor.
Should only happen on a malformed bridge path stack, hence the WARN,
but worth handling sanely. Move the decrement out of the WARN.
[ While at this, remove the WARN_ON_ONCE since this can only happen
with a buggy bridge path stack --pablo ].
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e990cef6516daa4e1e236433579e333f74fd38cb Version: e990cef6516daa4e1e236433579e333f74fd38cb Version: e990cef6516daa4e1e236433579e333f74fd38cb Version: e990cef6516daa4e1e236433579e333f74fd38cb Version: e990cef6516daa4e1e236433579e333f74fd38cb Version: e990cef6516daa4e1e236433579e333f74fd38cb |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:19:08.898847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:31.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_path.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9a4e3a9017ba3da2de187b72ed6545641a0d0a84",
"status": "affected",
"version": "e990cef6516daa4e1e236433579e333f74fd38cb",
"versionType": "git"
},
{
"lessThan": "1b52aeb40c9f04bf50eeb4ea09142139d163e239",
"status": "affected",
"version": "e990cef6516daa4e1e236433579e333f74fd38cb",
"versionType": "git"
},
{
"lessThan": "ee8440bb000fff4ef8acbfc99652851e9ca0a35b",
"status": "affected",
"version": "e990cef6516daa4e1e236433579e333f74fd38cb",
"versionType": "git"
},
{
"lessThan": "547ea9f567498e4accc89e7816264f15a1a0629f",
"status": "affected",
"version": "e990cef6516daa4e1e236433579e333f74fd38cb",
"versionType": "git"
},
{
"lessThan": "2f55fa28011c97d6495d5787808db10a8c2d690d",
"status": "affected",
"version": "e990cef6516daa4e1e236433579e333f74fd38cb",
"versionType": "git"
},
{
"lessThan": "e052f920773b73be49eb4d8702a9f85de7464363",
"status": "affected",
"version": "e990cef6516daa4e1e236433579e333f74fd38cb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_path.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag\n\nThe DEV_PATH_BR_VLAN_UNTAG case post-decrements info-\u003enum_encaps\ninside WARN_ON_ONCE(). num_encaps is u8, so if it\u0027s already 0 the\ndecrement still happens and wraps it to 255. The break only leaves\nthe inner switch -- a later path entry can set info-\u003eindev back to\na real device, and we end up returning with num_encaps == 255.\n\nnft_dev_forward_path() then walks info.encap[] (size 2) up to\nnum_encaps, which means an OOB stack read and a bogus count copied\ninto the route descriptor.\n\nShould only happen on a malformed bridge path stack, hence the WARN,\nbut worth handling sanely. Move the decrement out of the WARN.\n\n[ While at this, remove the WARN_ON_ONCE since this can only happen\n with a buggy bridge path stack --pablo ]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit in nft_flow_offload_eval on NF_INET_FORWARD when remotely sourced TCP/UDP packets matching a conntrack flow trigger nft_flow_route() and nft_dev_forward_path() during softirq packet processing on nftables flowtable routers/gateways, not via netlink configuration APIs.\nAC:L - Once an nftables flowtable with bridge VLAN filtering is deployed, an attacker can establish confirmed TCP/UDP flows and steer traffic through the affected bridge/VLAN topology to reach nft_dev_path_info() without races or other conditions outside the attacker\u0027s control.\nPR:N - Flowtable and bridge VLAN setup are administrator deployment prerequisites; a remote sender needs no local account, authentication, or CAP_NET_ADMIN on the victim to trigger flow offload path resolution while forwarding traffic through the configured bridge.\nUI:N - Exploitation requires only sending network packets processed automatically on the forwarding path; no victim must open files, mount filesystems, or take any interactive action beyond normal traffic through the router.\nS:U - Out-of-bounds stack reads and writes in nft_dev_forward_path() corrupt kernel stack memory and route descriptors on the affected host only; this is standard kernel compromise within one security authority, not a VM escape or cross-boundary sandbox break.\nC:H - When num_encaps underflows to 255, nft_dev_forward_path() loops up to 255 times over info.encap[2], performing out-of-bounds stack reads of adjacent kernel stack memory that can disclose pointers and other sensitive data.\nI:H - The same loop writes attacker-influenced encap values past route-\u003etuple[].in.encap[2] on the stack, corrupting adjacent route fields and stack data in ways that can be leveraged for arbitrary kernel writes and control-flow hijack.\nA:H - Massive out-of-bounds stack corruption during flow offload setup in softirq context can cause immediate kernel oops/panic and reliable denial of service on forwarding routers processing malicious traffic through vulnerable bridge VLAN paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:48.907Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9a4e3a9017ba3da2de187b72ed6545641a0d0a84"
},
{
"url": "https://git.kernel.org/stable/c/1b52aeb40c9f04bf50eeb4ea09142139d163e239"
},
{
"url": "https://git.kernel.org/stable/c/ee8440bb000fff4ef8acbfc99652851e9ca0a35b"
},
{
"url": "https://git.kernel.org/stable/c/547ea9f567498e4accc89e7816264f15a1a0629f"
},
{
"url": "https://git.kernel.org/stable/c/2f55fa28011c97d6495d5787808db10a8c2d690d"
},
{
"url": "https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363"
}
],
"title": "netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80634",
"datePublished": "2026-08-28T06:48:49.022Z",
"dateReserved": "2026-08-26T14:34:25.777Z",
"dateUpdated": "2026-10-30T12:30:48.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39775 (GCVE-0-2025-39775)
Vulnerability from cvelistv5
Published
2025-09-11 16:56
Modified
2026-11-05 21:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/mremap: fix WARN with uffd that has remap events disabled
Registering userfaultd on a VMA that spans at least one PMD and then
mremap()'ing that VMA can trigger a WARN when recovering from a failed
page table move due to a page table allocation error.
The code ends up doing the right thing (recurse, avoiding moving actual
page tables), but triggering that WARN is unpleasant:
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852
Modules linked in:
CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline]
RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline]
RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852
Code: ...
RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645
RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007
RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000
FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0
Call Trace:
<TASK>
copy_vma_and_data+0x468/0x790 mm/mremap.c:1215
move_vma+0x548/0x1780 mm/mremap.c:1282
mremap_to+0x1b7/0x450 mm/mremap.c:1406
do_mremap+0xfad/0x1f80 mm/mremap.c:1921
__do_sys_mremap+0x119/0x170 mm/mremap.c:1977
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00d0b8ebe9
Code: ...
RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9
RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000
RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005
</TASK>
The underlying issue is that we recurse during the original page table
move, but not during the recovery move.
Fix it by checking for both VMAs and performing the check before the
pmd_none() sanity check.
Add a new helper where we perform+document that check for the PMD and PUD
level.
Thanks to Harry for bisecting.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 310ac886d68de661c3a334198d8604b722d7fdf8 Version: 0cef0bb836e3cfe00f08f9606c72abd72fe78ca3 Version: 0cef0bb836e3cfe00f08f9606c72abd72fe78ca3 Version: 96fed9f20481d07eba8a7fe93bc77abef178198c Version: 8e2f6ba256dd1e590addc48e6e9577bf39c482f2 Version: 6.12.11 ≤ Version: 6.1.191 ≤ Version: 6.6.160 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:11:21.039246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:12:57.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/mremap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1c15b4cd3a97aea013bdb18d9a55ca0384fbb8d4",
"status": "affected",
"version": "310ac886d68de661c3a334198d8604b722d7fdf8",
"versionType": "git"
},
{
"lessThan": "d70ca21f7bff162a5afae1ddd6f4107adf05ae23",
"status": "affected",
"version": "0cef0bb836e3cfe00f08f9606c72abd72fe78ca3",
"versionType": "git"
},
{
"lessThan": "772e5b4a5e8360743645b9a466842d16092c4f94",
"status": "affected",
"version": "0cef0bb836e3cfe00f08f9606c72abd72fe78ca3",
"versionType": "git"
},
{
"status": "affected",
"version": "96fed9f20481d07eba8a7fe93bc77abef178198c",
"versionType": "git"
},
{
"status": "affected",
"version": "8e2f6ba256dd1e590addc48e6e9577bf39c482f2",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.11",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.160",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/mremap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.4",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.191",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.160",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mremap: fix WARN with uffd that has remap events disabled\n\nRegistering userfaultd on a VMA that spans at least one PMD and then\nmremap()\u0027ing that VMA can trigger a WARN when recovering from a failed\npage table move due to a page table allocation error.\n\nThe code ends up doing the right thing (recurse, avoiding moving actual\npage tables), but triggering that WARN is unpleasant:\n\nWARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline]\nWARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline]\nWARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852\nModules linked in:\nCPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:move_normal_pmd mm/mremap.c:357 [inline]\nRIP: 0010:move_pgt_entry mm/mremap.c:595 [inline]\nRIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852\nCode: ...\nRSP: 0018:ffffc900037a76d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645\nRDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007\nRBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000\nR10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000\nR13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000\nFS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0\nCall Trace:\n \u003cTASK\u003e\n copy_vma_and_data+0x468/0x790 mm/mremap.c:1215\n move_vma+0x548/0x1780 mm/mremap.c:1282\n mremap_to+0x1b7/0x450 mm/mremap.c:1406\n do_mremap+0xfad/0x1f80 mm/mremap.c:1921\n __do_sys_mremap+0x119/0x170 mm/mremap.c:1977\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f00d0b8ebe9\nCode: ...\nRSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019\nRAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9\nRDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000\nRBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000\nR10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002\nR13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005\n \u003c/TASK\u003e\n\nThe underlying issue is that we recurse during the original page table\nmove, but not during the recovery move.\n\nFix it by checking for both VMAs and performing the check before the\npmd_none() sanity check.\n\nAdd a new helper where we perform+document that check for the PMD and PUD\nlevel.\n\nThanks to Harry for bisecting."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:27.812Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c15b4cd3a97aea013bdb18d9a55ca0384fbb8d4"
},
{
"url": "https://git.kernel.org/stable/c/d70ca21f7bff162a5afae1ddd6f4107adf05ae23"
},
{
"url": "https://git.kernel.org/stable/c/772e5b4a5e8360743645b9a466842d16092c4f94"
}
],
"title": "mm/mremap: fix WARN with uffd that has remap events disabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39775",
"datePublished": "2025-09-11T16:56:28.230Z",
"dateReserved": "2025-04-16T07:20:57.129Z",
"dateUpdated": "2026-11-05T21:12:57.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90321 (GCVE-0-2026-90321)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate inline xattrs during inode block validation
Patch series "ocfs2: validate xattr entry bounds", v7.
This series validates OCFS2 xattr entry name/value bounds when xattr
metadata is read and validated, before getxattr() or listxattr() can walk
out-of-range entry arrays or offsets from corrupted metadata.
This patch (of 2):
ocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk
metadata from it, but inline xattr metadata is still checked only in
operation-specific consumers. The existing ibody lookup helper validates
inline header placement and entry count, but inode block validation does
not reject entry name/value bounds.
Add a flat xattr entry validator and call it from inode block validation
for inline xattrs. Keep the operation paths on their existing
header/count lookup checks; the full entry bounds check now runs when the
inode block is validated at read time.
Reject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or
listxattr() can walk past the inline storage.
Validation reproduced this kernel report:
BUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170
Read of size 2 at addr ffff8881242a2000 by task python3/529
Call Trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
kasan_report+0xe0/0x110
ocfs2_xattr_find_entry+0x5a/0x170
ocfs2_xattr_get_nolock+0x20a/0x820
ocfs2_xattr_get+0x10c/0x1e0
__vfs_getxattr+0xe2/0x130
vfs_getxattr+0x185/0x1b0
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c",
"fs/ocfs2/xattr.c",
"fs/ocfs2/xattr.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7dec19f6bafe4e1503007141c9f5eb7eb10e5578",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
},
{
"lessThan": "8138d06e7a1d9a0b0481dc015c67b34e8bb60a58",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
},
{
"lessThan": "3fd45b24879fa4885b66a582a6e47eda67f11310",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
},
{
"lessThan": "8914a3330b72378136c2c02d6328a826f6abdad7",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c",
"fs/ocfs2/xattr.c",
"fs/ocfs2/xattr.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline xattrs during inode block validation\n\nPatch series \"ocfs2: validate xattr entry bounds\", v7.\n\nThis series validates OCFS2 xattr entry name/value bounds when xattr\nmetadata is read and validated, before getxattr() or listxattr() can walk\nout-of-range entry arrays or offsets from corrupted metadata.\n\n\nThis patch (of 2):\n\nocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk\nmetadata from it, but inline xattr metadata is still checked only in\noperation-specific consumers. The existing ibody lookup helper validates\ninline header placement and entry count, but inode block validation does\nnot reject entry name/value bounds.\n\nAdd a flat xattr entry validator and call it from inode block validation\nfor inline xattrs. Keep the operation paths on their existing\nheader/count lookup checks; the full entry bounds check now runs when the\ninode block is validated at read time.\n\nReject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or\nlistxattr() can walk past the inline storage.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170\nRead of size 2 at addr ffff8881242a2000 by task python3/529\nCall Trace:\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n kasan_report+0xe0/0x110\n ocfs2_xattr_find_entry+0x5a/0x170\n ocfs2_xattr_get_nolock+0x20a/0x820\n ocfs2_xattr_get+0x10c/0x1e0\n __vfs_getxattr+0xe2/0x130\n vfs_getxattr+0x185/0x1b0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malformed bytes are dinode inline-xattr xe_name_offset, xe_name_len and xe_value_size, read from the inode block by ocfs2_read_inode_block() into ocfs2_validate_inode_block() and later walked by ocfs2_xattr_ibody_get()/ocfs2_xattr_ibody_list(); no o2net, NFS, or SMB message carries those offsets.\nAC:L - A crafted dinode with OCFS2_INLINE_XATTR_FL and attacker-chosen xe_name_offset/xe_value_size is sufficient; after mount, getxattr(2) reaches vfs_getxattr()\u2192ocfs2_xattr_get()\u2192ocfs2_xattr_find_entry() and hits the reported KASAN UAF with no race or other condition outside the attacker\u2019s control.\nPR:N - ocfs2_fs_type.fs_flags has no FS_USERNS_MOUNT, so the attacker cannot self-mount; ocfs2_xa_set() writes well-formed inline entries, so planting a bad xe_name_offset needs a crafted image. After the victim\u2019s ocfs2_fill_super(), listxattr(2) calls ocfs2_listxattr() with no MAY_READ/DAC check.\nUI:R - The inline xattr payload is inert until a victim mounts the crafted OCFS2 image through ocfs2_fill_super(); getxattr(2) or listxattr(2) on that volume is the follow-on action that reaches ocfs2_xattr_find_entry() or ocfs2_xattr_list_entries().\nS:U - The OOB/UAF is in the dinode buffer_head parsed by ocfs2_validate_inode_block() on the same host that mounted the volume and does not cross a VM, IOMMU, or guest-to-host boundary.\nC:H - ocfs2_xattr_list_entries() memcpy\u2019s xe_name_len bytes from header+xe_name_offset into the listxattr buffer, and ocfs2_xattr_ibody_get() memcpy\u2019s xe_value_size bytes from that same unvalidated offset into the getxattr buffer; the repro is a KASAN UAF read of size 2 in ocfs2_xattr_find_entry().\nI:H - The same unvalidated xe_name_offset/xe_value_size are a kernel UAF/OOB walk of the inline region; ocfs2_xa_block_wipe_namevalue() memmove\u2019s from header+min(xe_name_offset) with namevalue_size_xe() taken from on-disk xe_value_size when setxattr reuses that entry, a heap write primitive.\nA:H - The KASAN report is a use-after-free in ocfs2_xattr_find_entry() from getxattr; namevalue_size_xe() BUG_ON()s when a local inline entry has xe_value_size \u003e OCFS2_XATTR_INLINE_SIZE, and walking an out-of-range name/value offset can oops the node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:56.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7dec19f6bafe4e1503007141c9f5eb7eb10e5578"
},
{
"url": "https://git.kernel.org/stable/c/8138d06e7a1d9a0b0481dc015c67b34e8bb60a58"
},
{
"url": "https://git.kernel.org/stable/c/3fd45b24879fa4885b66a582a6e47eda67f11310"
},
{
"url": "https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"
}
],
"title": "ocfs2: validate inline xattrs during inode block validation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90321",
"datePublished": "2026-09-17T16:08:38.138Z",
"dateReserved": "2026-09-11T19:38:34.802Z",
"dateUpdated": "2026-10-21T12:50:56.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43414 (GCVE-0-2026-43414)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Completely fix fcport double free
In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free().
When an error happens, this function is called by qla2x00_sp_release(),
when kref_put() releases the first and the last reference.
qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().
Doing it one more time after kref_put() is a bad idea.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b9d72442adfbc9ddb0f76dd1b03977b3a578b16 Version: ef23850940d9a52c39936d27254824ccf5e9b6bd Version: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 Version: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 Version: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 Version: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 Version: 7861213201838480dc222634c56fb6db113d010d Version: 6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63 Version: cd10dee1f07a782f5aa05703c55299ca86a85ee4 Version: b03e626bd6d3f0684f56ee1890d70fc9ca991c04 Version: 282877633b25d67021a34169c5b5519b1d4ef65e Version: f85af9f1aa5e2f53694a6cbe72010f754b5ff862 Version: 9b43d2884b54d415caab48878b526dfe2ae9921b Version: 846fb9f112f618ec6ae181d8dae7961652574774 Version: 6.1.84 ≤ Version: 6.6.24 ≤ Version: 5.15.154 ≤ Version: 6.7.12 ≤ Version: 6.8.3 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43414",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:17:19.251803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:36.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_iocb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb9c7eca6f8f2e4a1cd8ba6711e7efe9044c0327",
"status": "affected",
"version": "3b9d72442adfbc9ddb0f76dd1b03977b3a578b16",
"versionType": "git"
},
{
"lessThan": "baabbd29191514391ca81594e43261bd17c6795a",
"status": "affected",
"version": "ef23850940d9a52c39936d27254824ccf5e9b6bd",
"versionType": "git"
},
{
"lessThan": "7172f41786dc08144da4627483e405de57bf8d2c",
"status": "affected",
"version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
"versionType": "git"
},
{
"lessThan": "4097a2afe8acc6038b71aab825430f1403decf20",
"status": "affected",
"version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
"versionType": "git"
},
{
"lessThan": "d48ea85463f5b34f7b92ea0a13eddf1ab993da7b",
"status": "affected",
"version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
"versionType": "git"
},
{
"lessThan": "c0b7da13a04bd70ef6070bfb9ea85f582294560a",
"status": "affected",
"version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
"versionType": "git"
},
{
"status": "affected",
"version": "7861213201838480dc222634c56fb6db113d010d",
"versionType": "git"
},
{
"status": "affected",
"version": "6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63",
"versionType": "git"
},
{
"status": "affected",
"version": "cd10dee1f07a782f5aa05703c55299ca86a85ee4",
"versionType": "git"
},
{
"status": "affected",
"version": "b03e626bd6d3f0684f56ee1890d70fc9ca991c04",
"versionType": "git"
},
{
"status": "affected",
"version": "282877633b25d67021a34169c5b5519b1d4ef65e",
"versionType": "git"
},
{
"status": "affected",
"version": "f85af9f1aa5e2f53694a6cbe72010f754b5ff862",
"versionType": "git"
},
{
"status": "affected",
"version": "9b43d2884b54d415caab48878b526dfe2ae9921b",
"versionType": "git"
},
{
"status": "affected",
"version": "846fb9f112f618ec6ae181d8dae7961652574774",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.84",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.24",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.154",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.12",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_iocb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Completely fix fcport double free\n\nIn qla24xx_els_dcmd_iocb() sp-\u003efree is set to qla2x00_els_dcmd_sp_free().\nWhen an error happens, this function is called by qla2x00_sp_release(),\nwhen kref_put() releases the first and the last reference.\n\nqla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().\nDoing it one more time after kref_put() is a bad idea."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable ELS direct-command path is reachable from a remote Fibre Channel initiator through qla2xxx target-mode ELS/session-deletion handling, not only through the root-only sysfs issue_logo knob. Using the highest reasonable SAN deployment, attacker-controlled FC frames from another host on the storage fabric make this network-reachable.\nAC:L - The bug is a deterministic double free once the ELS direct-command error path is hit after kref_put(), and the attacker can plausibly drive repeated logins/logouts/session teardown plus resource pressure to make qla2x00_start_sp() fail. No uncontrollable race is required for the memory corruption once that path is reached.\nPR:N - The FC target path processes remote ELS events before any Linux credential or capability check on the victim, so the attacker does not need a local account or kernel privilege. Fabric access/zoning is environmental network access, not privileges on the vulnerable system.\nUI:N - No victim user action is required; remote FC protocol activity can drive the target-mode session deletion and LOGO path. The sysfs path requires an admin write, but it is not the highest-severity reachable path.\nS:U - The corruption occurs inside the same kernel/driver security authority and does not cross a VM, IOMMU, or other separate security boundary. A kernel compromise or crash remains unchanged scope.\nC:H - This is kernel heap double-free/use-after-free style memory corruption of an fc_port object. Under the required overestimation rule, such corruption can be leveraged for information disclosure through heap reuse/read primitives.\nI:H - A double free of a kernel heap object can corrupt allocator state or enable controlled reuse of freed memory, making arbitrary write or control-flow compromise defensible. Therefore integrity impact is High.\nA:H - Related qla2xxx fcport double-free reports show immediate SLUB/kernel BUG crashes, and this fix removes another remaining double-free error path. A remotely triggerable kernel crash is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:31.583Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb9c7eca6f8f2e4a1cd8ba6711e7efe9044c0327"
},
{
"url": "https://git.kernel.org/stable/c/baabbd29191514391ca81594e43261bd17c6795a"
},
{
"url": "https://git.kernel.org/stable/c/7172f41786dc08144da4627483e405de57bf8d2c"
},
{
"url": "https://git.kernel.org/stable/c/4097a2afe8acc6038b71aab825430f1403decf20"
},
{
"url": "https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b"
},
{
"url": "https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a"
}
],
"title": "scsi: qla2xxx: Completely fix fcport double free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43414",
"datePublished": "2026-05-08T14:21:51.604Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-10-30T12:25:31.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99171 (GCVE-0-2026-99171)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: free the sbi after a grace period
If the "nocase" mount option ntfs3 uses custom hash and dentry compare
functions. Both access ntfs3 superblock private information in rcu
pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any
rcu delay. A lookup that's still inside the filesystem when the last
reference to the mount is dropped causes a UAF. With a pathwalk held up
in ntfs_d_hash() while the last reference to the mount goes away:
BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940
Read of size 8 at addr ff1100010453c850 by task walker/99
Call Trace:
<TASK>
ntfs_nls_to_utf16+0x752/0x940
ntfs_d_hash+0x22b/0x500
link_path_walk+0x11ad/0x1d30
path_lookupat+0x63/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
[...]
Allocated by task 95:
__kmalloc_cache_noprof+0x249/0x560
ntfs_init_fs_context+0x2db/0x5a0
alloc_fs_context+0x52e/0xc70
[...]
Freed by task 98:
kfree+0x1db/0x5b0
deactivate_locked_super+0x9c/0xf0
cleanup_mnt+0x9f/0x130
task_work_run+0x131/0x250
The bug is currently masked by the grace period in namespace_unlock()
for umount(2). Keep the necessary information until the filesystem
private info is freed and free it with an rcu delay.
ntfs3_free_sbi() now runs from an rcu callback and drops the upcase
table via ntfs_put_shared(). So switch s_shared_lock over to
spin_lock_bh(). Otherwise the callback can deadlock against a task
holding the lock on the same cpu.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/ntfs_fs.h",
"fs/ntfs3/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c39150784a801dbbfaf4fbfa284cb610552a5039",
"status": "affected",
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
"versionType": "git"
},
{
"lessThan": "36e6753daf9bb64563dcb5a3bb22f7699d973fa2",
"status": "affected",
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
"versionType": "git"
},
{
"lessThan": "c8b1a4840467930e01f1a9374d991d7a8a2896c1",
"status": "affected",
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
"versionType": "git"
},
{
"lessThan": "7abecef26a9be8f9de70659a3092250461a52072",
"status": "affected",
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
"versionType": "git"
},
{
"lessThan": "c01b091b06412d3b1b53d8c2925f6de586c8a2fc",
"status": "affected",
"version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/ntfs_fs.h",
"fs/ntfs3/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: free the sbi after a grace period\n\nIf the \"nocase\" mount option ntfs3 uses custom hash and dentry compare\nfunctions. Both access ntfs3 superblock private information in rcu\npathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any\nrcu delay. A lookup that\u0027s still inside the filesystem when the last\nreference to the mount is dropped causes a UAF. With a pathwalk held up\nin ntfs_d_hash() while the last reference to the mount goes away:\n\n BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940\n Read of size 8 at addr ff1100010453c850 by task walker/99\n Call Trace:\n \u003cTASK\u003e\n ntfs_nls_to_utf16+0x752/0x940\n ntfs_d_hash+0x22b/0x500\n link_path_walk+0x11ad/0x1d30\n path_lookupat+0x63/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n [...]\n Allocated by task 95:\n __kmalloc_cache_noprof+0x249/0x560\n ntfs_init_fs_context+0x2db/0x5a0\n alloc_fs_context+0x52e/0xc70\n [...]\n Freed by task 98:\n kfree+0x1db/0x5b0\n deactivate_locked_super+0x9c/0xf0\n cleanup_mnt+0x9f/0x130\n task_work_run+0x131/0x250\n\nThe bug is currently masked by the grace period in namespace_unlock()\nfor umount(2). Keep the necessary information until the filesystem\nprivate info is freed and free it with an rcu delay.\n\nntfs3_free_sbi() now runs from an rcu callback and drops the upcase\ntable via ntfs_put_shared(). So switch s_shared_lock over to\nspin_lock_bh(). Otherwise the callback can deadlock against a task\nholding the lock on the same cpu."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:35.809Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c39150784a801dbbfaf4fbfa284cb610552a5039"
},
{
"url": "https://git.kernel.org/stable/c/36e6753daf9bb64563dcb5a3bb22f7699d973fa2"
},
{
"url": "https://git.kernel.org/stable/c/c8b1a4840467930e01f1a9374d991d7a8a2896c1"
},
{
"url": "https://git.kernel.org/stable/c/7abecef26a9be8f9de70659a3092250461a52072"
},
{
"url": "https://git.kernel.org/stable/c/c01b091b06412d3b1b53d8c2925f6de586c8a2fc"
}
],
"title": "ntfs3: free the sbi after a grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99171",
"datePublished": "2026-10-28T10:35:26.598Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:35.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99126 (GCVE-0-2026-99126)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/ctcm: Prevent XID null dereference
The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40
to signal XID validation error. If peer XID is NULL or r/w channel
pairing mismatch happens, grp->saved_xid2 is never initialized. An
attempt to set the flag in such case leads to NULL dereference.
Fix this by using the always available priv->xid->xid2_flag2 instead of
grp->saved_xid2->xid2_flag2 for validation errors.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 Version: 293d984f0e3604c04dcdbf00117ddc1e5d4b1909 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/ctcm_mpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9d9e2dadc9fbdfe01aeb6581978c3b59092919e",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "a7c3e1795e4fe5e6680cab7cd7eee0503b00a248",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "c11e435d334e4c311eaaf721e179a5ca6852c221",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "977dac6cc5531a8e058df05b6af94406b940cb9e",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "1525fb6e2f9f9a2c8c8723ee0959b1130a6b8213",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "34fa3607b7604b3052b19cec8b0ad644818cdd2a",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeab",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
},
{
"lessThan": "b264d8422779d69febce914efc47a92a85cc382c",
"status": "affected",
"version": "293d984f0e3604c04dcdbf00117ddc1e5d4b1909",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/ctcm_mpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ctcm: Prevent XID null dereference\n\nThe mpc_validate_xid() function sets grp-\u003esaved_xid2-\u003exid2_flag2 to 0x40\nto signal XID validation error. If peer XID is NULL or r/w channel\npairing mismatch happens, grp-\u003esaved_xid2 is never initialized. An\nattempt to set the flag in such case leads to NULL dereference.\n\nFix this by using the always available priv-\u003exid-\u003exid2_flag2 instead of\ngrp-\u003esaved_xid2-\u003exid2_flag2 for validation errors."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:59.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9d9e2dadc9fbdfe01aeb6581978c3b59092919e"
},
{
"url": "https://git.kernel.org/stable/c/a7c3e1795e4fe5e6680cab7cd7eee0503b00a248"
},
{
"url": "https://git.kernel.org/stable/c/c11e435d334e4c311eaaf721e179a5ca6852c221"
},
{
"url": "https://git.kernel.org/stable/c/977dac6cc5531a8e058df05b6af94406b940cb9e"
},
{
"url": "https://git.kernel.org/stable/c/1525fb6e2f9f9a2c8c8723ee0959b1130a6b8213"
},
{
"url": "https://git.kernel.org/stable/c/34fa3607b7604b3052b19cec8b0ad644818cdd2a"
},
{
"url": "https://git.kernel.org/stable/c/8a2f7a4ad1d81612fa65bfa4d392ba1bb2f5eeab"
},
{
"url": "https://git.kernel.org/stable/c/b264d8422779d69febce914efc47a92a85cc382c"
}
],
"title": "s390/ctcm: Prevent XID null dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99126",
"datePublished": "2026-10-28T10:34:40.661Z",
"dateReserved": "2026-09-25T10:25:14.393Z",
"dateUpdated": "2026-10-30T12:41:59.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74344 (GCVE-0-2026-74344)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Clear rb node linkage when freeing bpf_rb_root
bpf_rb_root_free() detaches the root by copying the current rb_root_cached
and then replacing the live root with RB_ROOT_CACHED. It then walks the
copied root and drops each object contained in the tree.
This leaves the rb node state intact while dropping the object. If the
object is refcounted and survives the drop, its bpf_rb_node_kern still
contains an owner pointer to the freed root and stale rb tree linkage. If
a later bpf_rb_root allocation reuses the same address, bpf_rbtree_remove()
can incorrectly pass the owner check and call rb_erase_cached() on a node
whose rb pointers belong to the old tree.
Mirror the list draining behavior by marking nodes as busy while the root
is being detached, then clear the rb node and release the owner before
dropping the containing object. This makes surviving nodes unowned and
safe to reject from remove or accept for a later add.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9c395c1b99bd23f74bc628fa000480c49593d17f Version: 9c395c1b99bd23f74bc628fa000480c49593d17f Version: 9c395c1b99bd23f74bc628fa000480c49593d17f Version: 9c395c1b99bd23f74bc628fa000480c49593d17f Version: 9c395c1b99bd23f74bc628fa000480c49593d17f Version: 1d0675957d35ac5e514073481beda62e4e1e2ec5 Version: 6.2.15 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74344",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:54:01.322766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:34.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/helpers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "628a469d2a73e3844e5ee80aa002e232b0fd6493",
"status": "affected",
"version": "9c395c1b99bd23f74bc628fa000480c49593d17f",
"versionType": "git"
},
{
"lessThan": "ff3ab3fb956027ab40aca1fb3298cf20dc290273",
"status": "affected",
"version": "9c395c1b99bd23f74bc628fa000480c49593d17f",
"versionType": "git"
},
{
"lessThan": "2eb39de4962f842d653e96818ae372665cd481fd",
"status": "affected",
"version": "9c395c1b99bd23f74bc628fa000480c49593d17f",
"versionType": "git"
},
{
"lessThan": "574612793bed416f6c05fe7c9b50e9eb0441997e",
"status": "affected",
"version": "9c395c1b99bd23f74bc628fa000480c49593d17f",
"versionType": "git"
},
{
"lessThan": "4a7910ee060d8ce55612f5b3cc267f3a265a3cec",
"status": "affected",
"version": "9c395c1b99bd23f74bc628fa000480c49593d17f",
"versionType": "git"
},
{
"status": "affected",
"version": "1d0675957d35ac5e514073481beda62e4e1e2ec5",
"versionType": "git"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/helpers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Clear rb node linkage when freeing bpf_rb_root\n\nbpf_rb_root_free() detaches the root by copying the current rb_root_cached\nand then replacing the live root with RB_ROOT_CACHED. It then walks the\ncopied root and drops each object contained in the tree.\n\nThis leaves the rb node state intact while dropping the object. If the\nobject is refcounted and survives the drop, its bpf_rb_node_kern still\ncontains an owner pointer to the freed root and stale rb tree linkage. If\na later bpf_rb_root allocation reuses the same address, bpf_rbtree_remove()\ncan incorrectly pass the owner check and call rb_erase_cached() on a node\nwhose rb pointers belong to the old tree.\n\nMirror the list draining behavior by marking nodes as busy while the root\nis being detached, then clear the rb node and release the owner before\ndropping the containing object. This makes surviving nodes unowned and\nsafe to reject from remove or accept for a later add."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through BPF kfuncs (bpf_rbtree_remove) and bpf_rb_root_free during BPF map/object teardown, all gated by the bpf(2) syscall and local BPF program loading; there is no network, adjacent-radio, or physical-device entry path.\nAC:L - An attacker fully controls refcount retention (bpf_refcount_acquire), when bpf_rb_root_free runs (map close/delete or bpf_obj_drop), and subsequent bpf_rb_root reallocation to reuse the freed address; no victim timing or uncontrollable heap layout is required beyond normal BPF allocator reuse.\nPR:L - Exploitation requires loading BPF programs/maps using bpf_rb_root and refcounted graph nodes, which the kernel enforces with CAP_BPF at map BTF setup; on typical hosts this is reachable by an unprivileged user via user namespaces (CAP_BPF inside the namespace), not init-namespace root only.\nUI:N - No action by another user or administrator is required; the attacker loads their own BPF program, populates the rbtree, triggers teardown, and calls bpf_rbtree_remove on stale nodes.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security boundary; it is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Stale bpf_rb_node linkage lets bpf_rbtree_remove pass the owner check and invoke rb_erase_cached on bogus rb_left/rb_right/parent pointers, corrupting adjacent kernel memory in ways that can be turned into arbitrary kernel memory disclosure.\nI:H - rb_erase_cached on nodes whose rb pointers still reference a detached tree rewrites arbitrary kernel rbtree/list metadata and enables heap grooming for control-flow hijack and local root, not merely a bounded or transient modification.\nA:H - Calling rb_erase_cached with inconsistent rb pointers commonly causes kernel BUG/oops/panic or wedged allocator state, giving reliable system crash or hang even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:23.651Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/628a469d2a73e3844e5ee80aa002e232b0fd6493"
},
{
"url": "https://git.kernel.org/stable/c/ff3ab3fb956027ab40aca1fb3298cf20dc290273"
},
{
"url": "https://git.kernel.org/stable/c/2eb39de4962f842d653e96818ae372665cd481fd"
},
{
"url": "https://git.kernel.org/stable/c/574612793bed416f6c05fe7c9b50e9eb0441997e"
},
{
"url": "https://git.kernel.org/stable/c/4a7910ee060d8ce55612f5b3cc267f3a265a3cec"
}
],
"title": "bpf: Clear rb node linkage when freeing bpf_rb_root",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74344",
"datePublished": "2026-08-15T05:58:33.231Z",
"dateReserved": "2026-08-15T05:44:03.886Z",
"dateUpdated": "2026-10-21T12:45:23.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90155 (GCVE-0-2026-90155)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: detach blocked lock requests before freeing
A file_lock retained by ksmbd for byte-range lock bookkeeping can still
be part of the VFS blocked-request graph. In particular, the VFS can
chain a new waiter below an already blocked request through
flc_blocked_requests. The ksmbd_file reference count does not cover that
graph.
Both __ksmbd_close_fd() and the cross-request unlock path free these
retained file_lock objects directly. If a dependent waiter is still
attached, locks_release_private() hits
BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime
mismatch can leave a freed ksmbd_lock reachable through its request-local
llist.
Detach the file_lock from the blocked-request graph before freeing it in
the close, cross-request unlock, and rollback paths. locks_delete_block()
also wakes requests chained below the object. Remove llist when a
completed lock is published so a globally visible ksmbd_lock no longer
points into the submitting worker's stack.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d63528eb0d43c4796c42aad56889dec12cf4e122 Version: d63528eb0d43c4796c42aad56889dec12cf4e122 Version: d63528eb0d43c4796c42aad56889dec12cf4e122 Version: d63528eb0d43c4796c42aad56889dec12cf4e122 Version: d63528eb0d43c4796c42aad56889dec12cf4e122 Version: d63528eb0d43c4796c42aad56889dec12cf4e122 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e8b69c06bd6583ec11abef4fae50c2c8d5f3679",
"status": "affected",
"version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
"versionType": "git"
},
{
"lessThan": "d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04",
"status": "affected",
"version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
"versionType": "git"
},
{
"lessThan": "d31db79cfaa9fce6649772ad279779473ba8aef9",
"status": "affected",
"version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
"versionType": "git"
},
{
"lessThan": "f77d2accafca529e0ea3f979eb6e6cf1dac05c90",
"status": "affected",
"version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
"versionType": "git"
},
{
"lessThan": "514a0b2bc949963497e66cacd433f65dc768a71d",
"status": "affected",
"version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
"versionType": "git"
},
{
"lessThan": "215e8816b1ac25176d911abb8704390413ccee4b",
"status": "affected",
"version": "d63528eb0d43c4796c42aad56889dec12cf4e122",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: detach blocked lock requests before freeing\n\nA file_lock retained by ksmbd for byte-range lock bookkeeping can still\nbe part of the VFS blocked-request graph. In particular, the VFS can\nchain a new waiter below an already blocked request through\nflc_blocked_requests. The ksmbd_file reference count does not cover that\ngraph.\n\nBoth __ksmbd_close_fd() and the cross-request unlock path free these\nretained file_lock objects directly. If a dependent waiter is still\nattached, locks_release_private() hits\nBUG_ON(!list_empty(\u0026flc-\u003eflc_blocked_requests)). The same lifetime\nmismatch can leave a freed ksmbd_lock reachable through its request-local\nllist.\n\nDetach the file_lock from the blocked-request graph before freeing it in\nthe close, cross-request unlock, and rollback paths. locks_delete_block()\nalso wakes requests chained below the object. Remove llist when a\ncompleted lock is published so a globally visible ksmbd_lock no longer\npoints into the submitting worker\u0027s stack."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:28.100Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e8b69c06bd6583ec11abef4fae50c2c8d5f3679"
},
{
"url": "https://git.kernel.org/stable/c/d20d3f6ad8b0b6f4e1bb32cdf7eca251962e8f04"
},
{
"url": "https://git.kernel.org/stable/c/d31db79cfaa9fce6649772ad279779473ba8aef9"
},
{
"url": "https://git.kernel.org/stable/c/f77d2accafca529e0ea3f979eb6e6cf1dac05c90"
},
{
"url": "https://git.kernel.org/stable/c/514a0b2bc949963497e66cacd433f65dc768a71d"
},
{
"url": "https://git.kernel.org/stable/c/215e8816b1ac25176d911abb8704390413ccee4b"
}
],
"title": "ksmbd: detach blocked lock requests before freeing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90155",
"datePublished": "2026-09-17T16:06:47.716Z",
"dateReserved": "2026-09-11T19:38:34.790Z",
"dateUpdated": "2026-10-30T12:34:28.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90300 (GCVE-0-2026-90300)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Clear buf on error in __bpf_get_task_stack
Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that
use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM
argument and we should initialize the buf on every return path.
Adding missing buf memset for __bpf_get_task_stack fail paths. This
provides deterministic buffer contents, which is useful when the buffer
is used directly as a map key.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df Version: 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df Version: 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df Version: 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df Version: 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df Version: 06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df Version: d921baabd96445ef9c9c9410ca06164359c8a1a5 Version: 9c020a533eaae1c2d41a7e3835c4c818a9b4b656 Version: ff6bdc205fd0a83bd365405d4e31fb5905826996 Version: 5.10.30 ≤ Version: 5.11.14 ≤ Version: 5.10.96 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c4c57a277a87ed235183d03b671d346f5101f62",
"status": "affected",
"version": "06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df",
"versionType": "git"
},
{
"lessThan": "4acc761b4e3feca1eb648d21fc4d665b23c5372d",
"status": "affected",
"version": "06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df",
"versionType": "git"
},
{
"lessThan": "6f5a7bcc049709af12e403111d5e73e80910dafc",
"status": "affected",
"version": "06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df",
"versionType": "git"
},
{
"lessThan": "1f0f61573ba4cb899105b5cef65be3ca02205f93",
"status": "affected",
"version": "06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df",
"versionType": "git"
},
{
"lessThan": "f523359c4789bb0396d2d642464a6e2fd4f2299d",
"status": "affected",
"version": "06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df",
"versionType": "git"
},
{
"lessThan": "f5d242825ca417bb6afe35fde6e8880f97ca43fb",
"status": "affected",
"version": "06ab134ce8ecfa5a69e850f88f81c8a4c3fa91df",
"versionType": "git"
},
{
"status": "affected",
"version": "d921baabd96445ef9c9c9410ca06164359c8a1a5",
"versionType": "git"
},
{
"status": "affected",
"version": "9c020a533eaae1c2d41a7e3835c4c818a9b4b656",
"versionType": "git"
},
{
"status": "affected",
"version": "ff6bdc205fd0a83bd365405d4e31fb5905826996",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.30",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.14",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.96",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.96",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Clear buf on error in __bpf_get_task_stack\n\nBoth bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that\nuse __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM\nargument and we should initialize the buf on every return path.\n\nAdding missing buf memset for __bpf_get_task_stack fail paths. This\nprovides deterministic buffer contents, which is useful when the buffer\nis used directly as a map key."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:04.681Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c4c57a277a87ed235183d03b671d346f5101f62"
},
{
"url": "https://git.kernel.org/stable/c/4acc761b4e3feca1eb648d21fc4d665b23c5372d"
},
{
"url": "https://git.kernel.org/stable/c/6f5a7bcc049709af12e403111d5e73e80910dafc"
},
{
"url": "https://git.kernel.org/stable/c/1f0f61573ba4cb899105b5cef65be3ca02205f93"
},
{
"url": "https://git.kernel.org/stable/c/f523359c4789bb0396d2d642464a6e2fd4f2299d"
},
{
"url": "https://git.kernel.org/stable/c/f5d242825ca417bb6afe35fde6e8880f97ca43fb"
}
],
"title": "bpf: Clear buf on error in __bpf_get_task_stack",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90300",
"datePublished": "2026-09-17T16:08:24.515Z",
"dateReserved": "2026-09-11T19:38:34.799Z",
"dateUpdated": "2026-10-30T12:35:04.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90365 (GCVE-0-2026-90365)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: cancel reset and rc work on device unregister
Both drivers cancelled dump_work on unregister but left reset_work and
rc_work to be flushed only by destroy_workqueue() in mt76_free_device(),
which runs after the hw is unregistered and the hardware stopped. A
reset_work that fires in that window calls ieee80211_restart_hw() and
re-arms mac_work on an unregistered hw, and rc_work touches station state
being torn down. Cancel both up front, alongside dump_work.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e57b7901469fc0b021930b83a8094baaf3d81b09 Version: e57b7901469fc0b021930b83a8094baaf3d81b09 Version: e57b7901469fc0b021930b83a8094baaf3d81b09 Version: e57b7901469fc0b021930b83a8094baaf3d81b09 Version: e57b7901469fc0b021930b83a8094baaf3d81b09 Version: e57b7901469fc0b021930b83a8094baaf3d81b09 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/init.c",
"drivers/net/wireless/mediatek/mt76/mt7996/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13f230b8e3335ed761986fcd6b04049ff06471eb",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "5dd845c6388c6c9a4085ecdf59c7fe7bf3398e2e",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "7b3b1b3c7d434b5c5bc8d7de0b9c335242eeefba",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "aca0cd273b486a078f936b3fb409e619673521b1",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "c4dc85481d38951ca7f8bc104e711936306cc664",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "e995d3dccc9d980af13a60ad37409ed1561f9eeb",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/init.c",
"drivers/net/wireless/mediatek/mt76/mt7996/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: cancel reset and rc work on device unregister\n\nBoth drivers cancelled dump_work on unregister but left reset_work and\nrc_work to be flushed only by destroy_workqueue() in mt76_free_device(),\nwhich runs after the hw is unregistered and the hardware stopped. A\nreset_work that fires in that window calls ieee80211_restart_hw() and\nre-arms mac_work on an unregistered hw, and rc_work touches station state\nbeing torn down. Cancel both up front, alongside dump_work."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:21.725Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13f230b8e3335ed761986fcd6b04049ff06471eb"
},
{
"url": "https://git.kernel.org/stable/c/5dd845c6388c6c9a4085ecdf59c7fe7bf3398e2e"
},
{
"url": "https://git.kernel.org/stable/c/7b3b1b3c7d434b5c5bc8d7de0b9c335242eeefba"
},
{
"url": "https://git.kernel.org/stable/c/aca0cd273b486a078f936b3fb409e619673521b1"
},
{
"url": "https://git.kernel.org/stable/c/c4dc85481d38951ca7f8bc104e711936306cc664"
},
{
"url": "https://git.kernel.org/stable/c/e995d3dccc9d980af13a60ad37409ed1561f9eeb"
}
],
"title": "wifi: mt76: cancel reset and rc work on device unregister",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90365",
"datePublished": "2026-09-17T16:09:08.127Z",
"dateReserved": "2026-09-11T19:38:34.807Z",
"dateUpdated": "2026-10-30T12:35:21.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99130 (GCVE-0-2026-99130)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/cancel: don't spin on local work the task can't run
io_uring_cancel_generic() refuses to sleep while any ring on the exiting
task's tctx has local work pending. It assumes the task is that ring's
submitter and that the next io_uring_try_cancel_requests() pass will run
the work. This does not hold for a ring that was still
IORING_SETUP_R_DISABLED when the task got its tctx node from
io_uring_create() or io_ringfd_register(). The submitter is set later by
IORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the
submitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To
the exiting task the work stays pending forever, the loop never reaches
schedule(), and the task trips the WARN_ON_ONCE() once and then spins in
do_exit().
An unprivileged user can set this up at will by creating a disabled
ring, having a child enable it and stop, posting to the ring with
IORING_OP_MSG_RING and exiting with a request in flight that only the
child can complete. The exiting thread burns a CPU until the child runs
or dies, and with panic_on_warn set the WARN panics the kernel.
Fix by skipping the sleep only when io_allowed_defer_tw_run() allows the
task to run the work. This is reasonable since work it cannot run cannot
complete any of its requests either, so nothing is lost by sleeping.
Drop the WARN_ON_ONCE() since handing a disabled ring to another thread
is a supported scenario, not a bug state.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/cancel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "64e196a6d7173667a2a0fe2f191bc64eecd07778",
"status": "affected",
"version": "360cd42c4e95ff06d8d7b0a54e42236c7e7c187f",
"versionType": "git"
},
{
"lessThan": "8a241d7ca23be2695a1fbe587ee12eae061c31af",
"status": "affected",
"version": "360cd42c4e95ff06d8d7b0a54e42236c7e7c187f",
"versionType": "git"
},
{
"lessThan": "94d13387b96e50a4288f7bbdfe401189246a11a1",
"status": "affected",
"version": "360cd42c4e95ff06d8d7b0a54e42236c7e7c187f",
"versionType": "git"
},
{
"lessThan": "3005459e0ddfcef0f555b6e81f672f2c49a1c0aa",
"status": "affected",
"version": "360cd42c4e95ff06d8d7b0a54e42236c7e7c187f",
"versionType": "git"
},
{
"lessThan": "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7",
"status": "affected",
"version": "360cd42c4e95ff06d8d7b0a54e42236c7e7c187f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/cancel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n\nio_uring_cancel_generic() refuses to sleep while any ring on the exiting\ntask\u0027s tctx has local work pending. It assumes the task is that ring\u0027s\nsubmitter and that the next io_uring_try_cancel_requests() pass will run\nthe work. This does not hold for a ring that was still\nIORING_SETUP_R_DISABLED when the task got its tctx node from\nio_uring_create() or io_ringfd_register(). The submitter is set later by\nIORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the\nsubmitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To\nthe exiting task the work stays pending forever, the loop never reaches\nschedule(), and the task trips the WARN_ON_ONCE() once and then spins in\ndo_exit().\n\nAn unprivileged user can set this up at will by creating a disabled\nring, having a child enable it and stop, posting to the ring with\nIORING_OP_MSG_RING and exiting with a request in flight that only the\nchild can complete. The exiting thread burns a CPU until the child runs\nor dies, and with panic_on_warn set the WARN panics the kernel.\n\nFix by skipping the sleep only when io_allowed_defer_tw_run() allows the\ntask to run the work. This is reasonable since work it cannot run cannot\ncomplete any of its requests either, so nothing is lost by sleeping.\nDrop the WARN_ON_ONCE() since handing a disabled ring to another thread\nis a supported scenario, not a bug state."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:03.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/64e196a6d7173667a2a0fe2f191bc64eecd07778"
},
{
"url": "https://git.kernel.org/stable/c/8a241d7ca23be2695a1fbe587ee12eae061c31af"
},
{
"url": "https://git.kernel.org/stable/c/94d13387b96e50a4288f7bbdfe401189246a11a1"
},
{
"url": "https://git.kernel.org/stable/c/3005459e0ddfcef0f555b6e81f672f2c49a1c0aa"
},
{
"url": "https://git.kernel.org/stable/c/fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7"
}
],
"title": "io_uring/cancel: don\u0027t spin on local work the task can\u0027t run",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99130",
"datePublished": "2026-10-28T10:34:43.514Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:03.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90326 (GCVE-0-2026-90326)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix race between policy activation and blkg destruction
When switching an IO scheduler on a block device, blkcg_activate_policy()
allocates blkg_policy_data (pd) for all blkgs attached to the queue.
However, blkcg_activate_policy() may race with concurrent blkcg deletion,
leading to use-after-free and memory leak issues.
The use-after-free occurs in the following race:
T1 (blkcg_activate_policy):
- Successfully allocates pd for blkg1 (loop0->queue, blkcgA)
- Fails to allocate pd for blkg2 (loop0->queue, blkcgB)
- Enters the enomem rollback path to release blkg1 resources
T2 (blkcg deletion):
- blkcgA is deleted concurrently
- blkg1 is freed via blkg_free_workfn()
- blkg1->pd is freed
T1 (continued):
- Rollback path accesses blkg1->pd->online after pd is freed
- Triggers use-after-free
In addition, blkg_free_workfn() frees pd before removing the blkg from
q->blkg_list. This allows blkcg_activate_policy() to allocate a new pd
for a blkg that is being destroyed, leaving the newly allocated pd
unreachable when the blkg is finally freed.
Fix these races by extending blkcg_mutex coverage to serialize
blkcg_activate_policy() rollback and blkg destruction, ensuring pd
lifecycle is synchronized with blkg list visibility.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 81c1188905f88b77743d1fdeeedfc8cb7b67787d Version: bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a Version: f1c006f1c6850c14040f8337753a63119bba39b9 Version: f1c006f1c6850c14040f8337753a63119bba39b9 Version: f1c006f1c6850c14040f8337753a63119bba39b9 Version: f1c006f1c6850c14040f8337753a63119bba39b9 Version: f1c006f1c6850c14040f8337753a63119bba39b9 Version: 6.1.16 ≤ Version: 6.2.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5dae1cd0d8368b4338430ff93403df67f0b8bcc",
"status": "affected",
"version": "81c1188905f88b77743d1fdeeedfc8cb7b67787d",
"versionType": "git"
},
{
"lessThan": "083b58373463a6e5ee60ecb135269348f68ad7df",
"status": "affected",
"version": "bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a",
"versionType": "git"
},
{
"lessThan": "17c18a0df70c2b89ff7fcd74622f1540e98d00fd",
"status": "affected",
"version": "f1c006f1c6850c14040f8337753a63119bba39b9",
"versionType": "git"
},
{
"lessThan": "91062e3a9ed251726df4e20ff9a1113f1c8ded59",
"status": "affected",
"version": "f1c006f1c6850c14040f8337753a63119bba39b9",
"versionType": "git"
},
{
"lessThan": "ac34e655dffa74349d885a43d098115336f53842",
"status": "affected",
"version": "f1c006f1c6850c14040f8337753a63119bba39b9",
"versionType": "git"
},
{
"lessThan": "2cf9f50a38c1839e549a08e22aa35e8d69e2c8fd",
"status": "affected",
"version": "f1c006f1c6850c14040f8337753a63119bba39b9",
"versionType": "git"
},
{
"lessThan": "5313d4d41739b0cb63000747c97bb1217ac45f3e",
"status": "affected",
"version": "f1c006f1c6850c14040f8337753a63119bba39b9",
"versionType": "git"
},
{
"lessThan": "6.1.17",
"status": "affected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThan": "6.2.4",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.17",
"versionStartIncluding": "6.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.4",
"versionStartIncluding": "6.2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix race between policy activation and blkg destruction\n\nWhen switching an IO scheduler on a block device, blkcg_activate_policy()\nallocates blkg_policy_data (pd) for all blkgs attached to the queue.\nHowever, blkcg_activate_policy() may race with concurrent blkcg deletion,\nleading to use-after-free and memory leak issues.\n\nThe use-after-free occurs in the following race:\n\nT1 (blkcg_activate_policy):\n - Successfully allocates pd for blkg1 (loop0-\u003equeue, blkcgA)\n - Fails to allocate pd for blkg2 (loop0-\u003equeue, blkcgB)\n - Enters the enomem rollback path to release blkg1 resources\n\nT2 (blkcg deletion):\n - blkcgA is deleted concurrently\n - blkg1 is freed via blkg_free_workfn()\n - blkg1-\u003epd is freed\n\nT1 (continued):\n - Rollback path accesses blkg1-\u003epd-\u003eonline after pd is freed\n - Triggers use-after-free\n\nIn addition, blkg_free_workfn() frees pd before removing the blkg from\nq-\u003eblkg_list. This allows blkcg_activate_policy() to allocate a new pd\nfor a blkg that is being destroyed, leaving the newly allocated pd\nunreachable when the blkg is finally freed.\n\nFix these races by extending blkcg_mutex coverage to serialize\nblkcg_activate_policy() rollback and blkg destruction, ensuring pd\nlifecycle is synchronized with blkg list visibility."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The triggering operations are local cgroupfs writes: tg_set_limit() (io.max) or iolatency_set_limit() (io.latency) call blk_throtl_init()/blk_iolatency_init() then blkcg_activate_policy(), while cgroup_rmdir() runs blkcg_css_offline() into blkg_free_workfn(); elv_iosched_store() is an alternate local sysfs path. No remote protocol carries the race inputs.\nAC:L - The attacker drives both sides: one thread writes io.max/io.latency so blkcg_activate_policy() attaches pd without q-\u003eblkcg_mutex, while another rmdirs sibling blkcgs so blkg_free_workfn() calls pd_free_fn() on the same blkg-\u003epd[] before list_del. That interleaving does not depend on GFP_KERNEL failure; the documented enomem rollback UAF on pd-\u003eonline is an extra window the attacker can retry.\nPR:L - tg_set_limit() and iolatency_set_limit() have no capable() check; io.max/io.latency are CFTYPE_NOT_ON_ROOT S_IWUSR files, and blkg_conf_open_bdev() uses blkdev_get_no_open() with no device permission check. A delegated cgroup-v2 subtree owner (typical systemd user slice or rootless container) can write those files and rmdir child cgroups; scheduler sysfs is a stricter alternate path.\nUI:N - The attacker writes io.max/io.latency in cgroups they own and rmdirs those cgroups themselves; no other user must mount a device, open a file, or otherwise participate.\nS:U - The UAF corrupts kernel blkg_policy_data (throtl_grp/iolatency_grp) in the host io controller; impact stays in the kernel\u0027s authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - blkg_free_workfn() frees blkg-\u003epd[] while the object remains on q-\u003eblkg_list, so blkcg_activate_policy()\u0027s enomem path reads pd-\u003eonline and pd_offline_fn() (throtl_pd_offline()/tg_flush_bios()) walks the freed throtl_grp; spraying the slab reclaims that object for an arbitrary kernel read.\nI:H - The same freed pd is written (pd-\u003eonline = false) and passed to pol-\u003epd_free_fn() again (throtl_pd_free() does timer_delete_sync() and call_rcu()), a double-free of throtl_grp/iolatency_grp that yields a kernel write/control-flow primitive.\nA:H - Use-after-free and double-free of blkg_policy_data in blkcg_activate_policy() versus blkg_free_workfn() oops/panic the kernel even when not turned into a full memory primitive."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:00.266Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5dae1cd0d8368b4338430ff93403df67f0b8bcc"
},
{
"url": "https://git.kernel.org/stable/c/083b58373463a6e5ee60ecb135269348f68ad7df"
},
{
"url": "https://git.kernel.org/stable/c/17c18a0df70c2b89ff7fcd74622f1540e98d00fd"
},
{
"url": "https://git.kernel.org/stable/c/91062e3a9ed251726df4e20ff9a1113f1c8ded59"
},
{
"url": "https://git.kernel.org/stable/c/ac34e655dffa74349d885a43d098115336f53842"
},
{
"url": "https://git.kernel.org/stable/c/2cf9f50a38c1839e549a08e22aa35e8d69e2c8fd"
},
{
"url": "https://git.kernel.org/stable/c/5313d4d41739b0cb63000747c97bb1217ac45f3e"
}
],
"title": "blk-cgroup: fix race between policy activation and blkg destruction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90326",
"datePublished": "2026-09-17T16:08:41.374Z",
"dateReserved": "2026-09-11T19:38:34.802Z",
"dateUpdated": "2026-10-21T12:51:00.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93202 (GCVE-0-2026-93202)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix recursive locking during device registration
i3c_master_register_new_i3c_devs() registers newly discovered devices
while holding i3c_bus_normaluse_lock(), a down_read(). device_register()
can immediately probe the device, and probe callbacks typically invoke
I3C helpers that take i3c_bus_normaluse_lock() again, leading to a
recursive acquisition of the same rwsem. rwsems do not support recursive
read locking and can deadlock when a writer is waiting. See the
"Recursive read locks" section of Documentation/locking/lockdep-design.rst.
For example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:
# echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind
# echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind
WARNING: possible recursive locking detected
kworker/5:1/94 is trying to acquire lock:
ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370
but task is already holding lock:
ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0
Fix this by separating device creation from device registration.
Populate desc->dev under the maintenance lock, collect the devices that
still need registration into a local list, then release the lock before
calling device_register(). Finally retake the lock and clean up any
devices that failed to register.
Use the maintenance lock rather than the normal-use lock while adding
device objects. A write-side maintenance lock prevents readers from
observing a partially initialized desc->dev during initial device
population, or desc->dev disappearing if registration fails.
The local list requires a list node, so add a list node member to struct
i3c_device.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 Version: 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master.c",
"include/linux/i3c/master.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "015fcf330c29803bbf92b719b4889ba74ecbbc71",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "6640f778aa3d430e67171f8d17fe4a35bb44b578",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "0200dc55e68cc0177b6e60919de415cc96fdd4e1",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "456f832e5fc26fbfd3b8200fd4553eee520cc377",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master.c",
"include/linux/i3c/master.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix recursive locking during device registration\n\ni3c_master_register_new_i3c_devs() registers newly discovered devices\nwhile holding i3c_bus_normaluse_lock(), a down_read(). device_register()\ncan immediately probe the device, and probe callbacks typically invoke\nI3C helpers that take i3c_bus_normaluse_lock() again, leading to a\nrecursive acquisition of the same rwsem. rwsems do not support recursive\nread locking and can deadlock when a writer is waiting. See the\n\"Recursive read locks\" section of Documentation/locking/lockdep-design.rst.\n\nFor example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:\n # echo intel-lpss-i3c.0 \u003e /sys/bus/platform/drivers/mipi-i3c-hci/unbind\n # echo intel-lpss-i3c.0 \u003e /sys/bus/platform/drivers/mipi-i3c-hci/bind\n WARNING: possible recursive locking detected\n kworker/5:1/94 is trying to acquire lock:\n ffff88811c810d78 (\u0026i3cbus-\u003elock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370\n but task is already holding lock:\n ffff88811c810d78 (\u0026i3cbus-\u003elock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0\n\nFix this by separating device creation from device registration.\nPopulate desc-\u003edev under the maintenance lock, collect the devices that\nstill need registration into a local list, then release the lock before\ncalling device_register(). Finally retake the lock and clean up any\ndevices that failed to register.\n\nUse the maintenance lock rather than the normal-use lock while adding\ndevice objects. A write-side maintenance lock prevents readers from\nobserving a partially initialized desc-\u003edev during initial device\npopulation, or desc-\u003edev disappearing if registration fails.\n\nThe local list requires a list node, so add a list node member to struct\ni3c_device."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:23.762Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/015fcf330c29803bbf92b719b4889ba74ecbbc71"
},
{
"url": "https://git.kernel.org/stable/c/6640f778aa3d430e67171f8d17fe4a35bb44b578"
},
{
"url": "https://git.kernel.org/stable/c/0200dc55e68cc0177b6e60919de415cc96fdd4e1"
},
{
"url": "https://git.kernel.org/stable/c/b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b"
},
{
"url": "https://git.kernel.org/stable/c/9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c"
},
{
"url": "https://git.kernel.org/stable/c/456f832e5fc26fbfd3b8200fd4553eee520cc377"
}
],
"title": "i3c: master: Fix recursive locking during device registration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93202",
"datePublished": "2026-09-17T16:12:23.071Z",
"dateReserved": "2026-09-17T16:02:15.092Z",
"dateUpdated": "2026-10-30T12:36:23.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80631 (GCVE-0-2026-80631)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: lzo: reject compressed segment that overflows the compressed input
lzo_decompress_bio() validates each on-disk segment length seg_len only
against the workspace cbuf size, not against the compressed input size
(compressed_len, the total folio bytes of the bio). A crafted extent can
carry a segment whose seg_len passes the cbuf check but runs past the end
of the bio, so copy_compressed_segment() walks off the last folio:
get_current_folio() then returns the NULL folio from bio_next_folio(), and
with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults.
BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383)
Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29
Workqueue: btrfs-endio simple_end_io_work
kasan_report (mm/kasan/report.c:590)
lzo_decompress_bio (fs/btrfs/lzo.c:383)
end_bbio_compressed_read (fs/btrfs/compression.c:1065)
btrfs_bio_end_io (fs/btrfs/bio.c:135)
btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285)
simple_end_io_work
process_one_work
worker_thread
Reject any segment whose payload would extend beyond compressed_len before
copying it, treating it as corruption like the other on-disk validation
failures in this function.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a6e66e6f8c1b685e11b778bef614480a9c1a5278 Version: a6e66e6f8c1b685e11b778bef614480a9c1a5278 Version: a6e66e6f8c1b685e11b778bef614480a9c1a5278 Version: a6e66e6f8c1b685e11b778bef614480a9c1a5278 Version: a6e66e6f8c1b685e11b778bef614480a9c1a5278 Version: a6e66e6f8c1b685e11b778bef614480a9c1a5278 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4325fb00e0c7269cb67f97d7148507787a57fd7",
"status": "affected",
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"versionType": "git"
},
{
"lessThan": "d9b17f9ce67d00e48fab62dcae197612a58f625f",
"status": "affected",
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"versionType": "git"
},
{
"lessThan": "1c48c8c807e49ac4f72819a89035fb8d2d094015",
"status": "affected",
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"versionType": "git"
},
{
"lessThan": "be7fb59512ffc2da5d98214a00117dfe9eccab78",
"status": "affected",
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"versionType": "git"
},
{
"lessThan": "1641d058adfbd50cf95d54581ed5d142ee82c07f",
"status": "affected",
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"versionType": "git"
},
{
"lessThan": "b0d27d43791b7a3057c3c4aedf9b4aa033d37c46",
"status": "affected",
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lzo: reject compressed segment that overflows the compressed input\n\nlzo_decompress_bio() validates each on-disk segment length seg_len only\nagainst the workspace cbuf size, not against the compressed input size\n(compressed_len, the total folio bytes of the bio). A crafted extent can\ncarry a segment whose seg_len passes the cbuf check but runs past the end\nof the bio, so copy_compressed_segment() walks off the last folio:\nget_current_folio() then returns the NULL folio from bio_next_folio(), and\nwith CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults.\n\n BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383)\n Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29\n Workqueue: btrfs-endio simple_end_io_work\n kasan_report (mm/kasan/report.c:590)\n lzo_decompress_bio (fs/btrfs/lzo.c:383)\n end_bbio_compressed_read (fs/btrfs/compression.c:1065)\n btrfs_bio_end_io (fs/btrfs/bio.c:135)\n btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285)\n simple_end_io_work\n process_one_work\n worker_thread\n\nReject any segment whose payload would extend beyond compressed_len before\ncopying it, treating it as corruption like the other on-disk validation\nfailures in this function."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On btrfs-backed NAS/cloud storage exported via nfsd or ksmbd, a remote client\u0027s read I/O is served by the server kernel through btrfs_do_readpage\u2192btrfs_submit_compressed_read\u2192lzo_decompress_bio, reaching the vulnerable LZO segment parser without local syscall access on the server.\nAC:L - A crafted on-disk LZO segment header with seg_len that passes the cbuf-size check but exceeds remaining compressed_len deterministically drives copy_compressed_segment past the last bio folio; no race, special memory layout, or rare kernel config is required.\nPR:N - Triggering needs only read access to btrfs content on an already-mounted/exported volume (e.g., NFS/ksmbd read); planting malformed LZO segment metadata is done via offline btrfs image crafting and does not require init-namespace root or a local account on the victim.\nUI:N - Exploitation is the attacker\u0027s own read against a btrfs volume that already contains the crafted LZO-compressed extent (backup restore, shared storage, or export); no separate victim mount, click, or plug-in action is needed beyond that read.\nS:U - Impact is a kernel NULL-pointer dereference and oops in the btrfs-endio workqueue on the host parsing attacker-supplied compressed data; this is standard host-kernel failure within one security authority, not VM escape or IOMMU bypass.\nC:N - The demonstrated failure is a null-ptr-deref read at address 0 in folio_size(NULL) when walking past the bio; unlike slab OOB reads in related btrfs LZO bugs, no adjacent kernel memory is disclosed before the fault.\nI:N - The bug faults during folio iteration before completing an out-of-bounds copy or decompression; there is no demonstrated or plausible kernel heap/stack write, control-flow hijack, or other integrity corruption beyond attacker-controlled on-disk bytes already in the bio.\nA:H - The NULL dereference in lzo_decompress_bio runs in btrfs-endio kworker context and produces a KASAN-reported kernel oops/panic; any process read (local or remote via NFS/ksmbd) of the crafted extent can repeatedly crash the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:47.841Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4325fb00e0c7269cb67f97d7148507787a57fd7"
},
{
"url": "https://git.kernel.org/stable/c/d9b17f9ce67d00e48fab62dcae197612a58f625f"
},
{
"url": "https://git.kernel.org/stable/c/1c48c8c807e49ac4f72819a89035fb8d2d094015"
},
{
"url": "https://git.kernel.org/stable/c/be7fb59512ffc2da5d98214a00117dfe9eccab78"
},
{
"url": "https://git.kernel.org/stable/c/1641d058adfbd50cf95d54581ed5d142ee82c07f"
},
{
"url": "https://git.kernel.org/stable/c/b0d27d43791b7a3057c3c4aedf9b4aa033d37c46"
}
],
"title": "btrfs: lzo: reject compressed segment that overflows the compressed input",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80631",
"datePublished": "2026-08-28T06:48:47.166Z",
"dateReserved": "2026-08-26T14:34:25.776Z",
"dateUpdated": "2026-10-30T12:30:47.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68081 (GCVE-0-2026-68081)
Vulnerability from cvelistv5
Published
2026-08-08 09:17
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid
guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path
doesn't use nested_vmx_vmexit() as that API is intended to be used if and
only if L2 is active, and the open coded equivalent neglects to put the
vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages
(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.
Note, the !from_vmenter scenario doesn't suffer the same problem, as
vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is
active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry
getting vmcs12 pages.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 Version: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 Version: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 Version: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 Version: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 Version: 96c66e87deeeb3cc78a3b82a1de8e365eec206c1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c174eb76484786721ae9a104344b952acf0e2717",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "a7bf4f5b19965e4466040ad6b24919c1ed326a84",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "f42669f931a6f45e5918cf5e99989b9a6c65e655",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "7996013b85687034d2e820cef94d6404192e3a3d",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "2c87a087c20632d68920272173b5d7c47f9bcf70",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
},
{
"lessThan": "2f2312c422fd2695da772cecb30c69994b795964",
"status": "affected",
"version": "96c66e87deeeb3cc78a3b82a1de8e365eec206c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state\n\nPut all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid\nguest while emulating VMLAUNCH or VMRESUME. The invalid guest state path\ndoesn\u0027t use nested_vmx_vmexit() as that API is intended to be used if and\nonly if L2 is active, and the open coded equivalent neglects to put the\nvmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages\n(and/or mappings) if L1 retries VMLAUNCH/VMRESUME.\n\nNote, the !from_vmenter scenario doesn\u0027t suffer the same problem, as\nvmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is\nactive, i.e. if a \"full\" VM-Exit is guaranteed before KVM will retry\ngetting vmcs12 pages."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:01.095Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c174eb76484786721ae9a104344b952acf0e2717"
},
{
"url": "https://git.kernel.org/stable/c/a7bf4f5b19965e4466040ad6b24919c1ed326a84"
},
{
"url": "https://git.kernel.org/stable/c/f42669f931a6f45e5918cf5e99989b9a6c65e655"
},
{
"url": "https://git.kernel.org/stable/c/7996013b85687034d2e820cef94d6404192e3a3d"
},
{
"url": "https://git.kernel.org/stable/c/2c87a087c20632d68920272173b5d7c47f9bcf70"
},
{
"url": "https://git.kernel.org/stable/c/2f2312c422fd2695da772cecb30c69994b795964"
}
],
"title": "KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68081",
"datePublished": "2026-08-08T09:17:44.795Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-10-30T12:28:01.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99181 (GCVE-0-2026-99181)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
autofs: ignore notification errors from a replaced pipe
autofs_notify_daemon() takes a reference to the current notification
pipe under wq_mutex, then drops the mutex before writing the request. The
write can block while the daemon enters catatonic mode and installs a
replacement pipe.
If the old pipe's reader is then closed, the delayed write returns -EPIPE
and the generic error path enters catatonic mode again. That transition
acts on the current superblock state, closes the replacement pipe, and
releases the new daemon generation's wait queues.
Only enter catatonic mode when the pipe which failed is still the current
pipe. Factor the already-locked transition so the identity check and state
change are atomic with respect to another replacement.
This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest.
An unprivileged UID 65534 lookup filled the old packet pipe before a
normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe
received HUP and both a pending victim lookup and a later lookup failed
with ENOENT in two out of two fresh-mount runs.
With this change, the new pipe remained active, received an intact
304-byte request, and both victim lookups completed in two out of two
runs. Normal lookup and restart-without-a-blocked-writer controls passed.
No KASAN, oops, refcount, or lock diagnostic was observed. A source
reproducer and complete local logs are available privately on request.
The demonstrated impact is limited to denial of a shared autofs service
during a legitimate daemon restart. No memory corruption, information leak,
privilege escalation, or code execution primitive was observed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e Version: 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/autofs/waitq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95ba5de229c1875e836f10646c4e6c454d560060",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "d3477ebdce74dc3bae404048258e70d7046c208a",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "6d2b8ad36e09e07993addd4ce92b578d3b13c8f8",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "35c2c4f3cf1403b058237c44000199a6c9a59273",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "8c8386ffc582155451f074f25759f665e626a850",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "1a177064f501ed4b67873a43aae5d5bdb18b3704",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "fb296391f685d82dbb93621a970fb234cea45280",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
},
{
"lessThan": "65676cd4203c0e41a94caf54080a7f0a95434bda",
"status": "affected",
"version": "8d7b48e0bc5fa01a818eac713d4cb0763090cd0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/autofs/waitq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: ignore notification errors from a replaced pipe\n\nautofs_notify_daemon() takes a reference to the current notification\npipe under wq_mutex, then drops the mutex before writing the request. The\nwrite can block while the daemon enters catatonic mode and installs a\nreplacement pipe.\n\nIf the old pipe\u0027s reader is then closed, the delayed write returns -EPIPE\nand the generic error path enters catatonic mode again. That transition\nacts on the current superblock state, closes the replacement pipe, and\nreleases the new daemon generation\u0027s wait queues.\n\nOnly enter catatonic mode when the pipe which failed is still the current\npipe. Factor the already-locked transition so the identity check and state\nchange are atomic with respect to another replacement.\n\nThis was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest.\nAn unprivileged UID 65534 lookup filled the old packet pipe before a\nnormal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe\nreceived HUP and both a pending victim lookup and a later lookup failed\nwith ENOENT in two out of two fresh-mount runs.\n\nWith this change, the new pipe remained active, received an intact\n304-byte request, and both victim lookups completed in two out of two\nruns. Normal lookup and restart-without-a-blocked-writer controls passed.\nNo KASAN, oops, refcount, or lock diagnostic was observed. A source\nreproducer and complete local logs are available privately on request.\n\nThe demonstrated impact is limited to denial of a shared autofs service\nduring a legitimate daemon restart. No memory corruption, information leak,\nprivilege escalation, or code execution primitive was observed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:44.732Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95ba5de229c1875e836f10646c4e6c454d560060"
},
{
"url": "https://git.kernel.org/stable/c/d3477ebdce74dc3bae404048258e70d7046c208a"
},
{
"url": "https://git.kernel.org/stable/c/6d2b8ad36e09e07993addd4ce92b578d3b13c8f8"
},
{
"url": "https://git.kernel.org/stable/c/35c2c4f3cf1403b058237c44000199a6c9a59273"
},
{
"url": "https://git.kernel.org/stable/c/8c8386ffc582155451f074f25759f665e626a850"
},
{
"url": "https://git.kernel.org/stable/c/1a177064f501ed4b67873a43aae5d5bdb18b3704"
},
{
"url": "https://git.kernel.org/stable/c/fb296391f685d82dbb93621a970fb234cea45280"
},
{
"url": "https://git.kernel.org/stable/c/65676cd4203c0e41a94caf54080a7f0a95434bda"
}
],
"title": "autofs: ignore notification errors from a replaced pipe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99181",
"datePublished": "2026-10-28T10:35:34.443Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:44.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90087 (GCVE-0-2026-90087)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: do not leak an hci_conn when a second LE connect is rejected
create_le_conn_complete() decides whether the failed connection is
still pending by comparing it against hci_lookup_le_connect(), which
returns the first LE connection in BT_CONNECT. That is the same
connection only while at most one is pending.
Two can be pending. Connections created on the passive scan path sit
in BT_CONNECT with HCI_CONN_SCANNING set and are invisible to
hci_lookup_le_connect() until hci_le_create_conn_sync() clears the
flag when their command is issued, so the -EBUSY guard in
hci_connect_le() does not prevent a second connection from being
queued while the first is still on the scan path. Whenever two
connections are in BT_CONNECT at once, the lookup may return one
connection while create_le_conn_complete() is reporting the failure
of the other; the early exit then drops the error and hci_conn_failed()
never runs on the connection that failed.
The controller also rejects a second HCI_OP_LE_CREATE_CONN issued
while another connection creation is still outstanding, per Core Spec
Vol 4, Part E. The spec calls for Command Disallowed there; the
bcm43438 observed here answers with an LMP/LL error code instead,
which bt_to_errno() maps to the -EPROTO (-71) in the log below.
The leaked connection stays in BT_CONNECT forever, and because
hci_connect_le() refuses to dial while hci_lookup_le_connect() finds
anything, every subsequent attempt to reach any peer fails with
-EBUSY and no command reaches the controller at all.
Seen on a bcm43438 with two BLE peers polled on the same interval
(state 5 is BT_CONNECT; both handles are UNSET ones, allocated from
the ida above HCI_CONN_HANDLE_MAX):
Bluetooth: hci1: Opcode 0x2013 failed: -71
# hcitool con
< LE 14:9C:EF:03:68:81 handle 3840 state 5 lm CENTRAL
< LE C4:D3:6A:8C:B5:38 handle 3841 state 5 lm CENTRAL
A btmon capture across the next ten minutes of connect attempts
contains no HCI_OP_LE_CREATE_CONN at all; outgoing LE connections
do not recover until the adapter is reset. With this change the same
scenario fails the rejected connection cleanly and further connects
to both peers go through.
Ask about the connection itself instead of about the device.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c9f73a2178c12fb24d2807634209559d6a836e08 Version: c9f73a2178c12fb24d2807634209559d6a836e08 Version: c9f73a2178c12fb24d2807634209559d6a836e08 Version: c9f73a2178c12fb24d2807634209559d6a836e08 Version: c9f73a2178c12fb24d2807634209559d6a836e08 Version: c9f73a2178c12fb24d2807634209559d6a836e08 Version: ee23bb0e4315476413e4e1ed9c486d6f9472294d Version: da499d598cb84b45a2aa930dc9213dc9a746a81d Version: 5.17.14 ≤ Version: 5.18.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42fe0278d05d75c405abad62dafaeec713cec2e2",
"status": "affected",
"version": "c9f73a2178c12fb24d2807634209559d6a836e08",
"versionType": "git"
},
{
"lessThan": "a78d16530c1538a215a827c7c3a4b408d6759bc0",
"status": "affected",
"version": "c9f73a2178c12fb24d2807634209559d6a836e08",
"versionType": "git"
},
{
"lessThan": "78970b39529844b31df2949015f66752e17210fe",
"status": "affected",
"version": "c9f73a2178c12fb24d2807634209559d6a836e08",
"versionType": "git"
},
{
"lessThan": "8a8585e421d06f878b33ef79f82cace0d485e3d8",
"status": "affected",
"version": "c9f73a2178c12fb24d2807634209559d6a836e08",
"versionType": "git"
},
{
"lessThan": "2eafcf310f4e0ad4f387881db01116bbe3cc0b39",
"status": "affected",
"version": "c9f73a2178c12fb24d2807634209559d6a836e08",
"versionType": "git"
},
{
"lessThan": "7e1e4047200fd7519f9bdfe8a001437715e618b4",
"status": "affected",
"version": "c9f73a2178c12fb24d2807634209559d6a836e08",
"versionType": "git"
},
{
"status": "affected",
"version": "ee23bb0e4315476413e4e1ed9c486d6f9472294d",
"versionType": "git"
},
{
"status": "affected",
"version": "da499d598cb84b45a2aa930dc9213dc9a746a81d",
"versionType": "git"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.14",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: do not leak an hci_conn when a second LE connect is rejected\n\ncreate_le_conn_complete() decides whether the failed connection is\nstill pending by comparing it against hci_lookup_le_connect(), which\nreturns the first LE connection in BT_CONNECT. That is the same\nconnection only while at most one is pending.\n\nTwo can be pending. Connections created on the passive scan path sit\nin BT_CONNECT with HCI_CONN_SCANNING set and are invisible to\nhci_lookup_le_connect() until hci_le_create_conn_sync() clears the\nflag when their command is issued, so the -EBUSY guard in\nhci_connect_le() does not prevent a second connection from being\nqueued while the first is still on the scan path. Whenever two\nconnections are in BT_CONNECT at once, the lookup may return one\nconnection while create_le_conn_complete() is reporting the failure\nof the other; the early exit then drops the error and hci_conn_failed()\nnever runs on the connection that failed.\n\nThe controller also rejects a second HCI_OP_LE_CREATE_CONN issued\nwhile another connection creation is still outstanding, per Core Spec\nVol 4, Part E. The spec calls for Command Disallowed there; the\nbcm43438 observed here answers with an LMP/LL error code instead,\nwhich bt_to_errno() maps to the -EPROTO (-71) in the log below.\n\nThe leaked connection stays in BT_CONNECT forever, and because\nhci_connect_le() refuses to dial while hci_lookup_le_connect() finds\nanything, every subsequent attempt to reach any peer fails with\n-EBUSY and no command reaches the controller at all.\n\nSeen on a bcm43438 with two BLE peers polled on the same interval\n(state 5 is BT_CONNECT; both handles are UNSET ones, allocated from\nthe ida above HCI_CONN_HANDLE_MAX):\n\n Bluetooth: hci1: Opcode 0x2013 failed: -71\n\n # hcitool con\n \u003c LE 14:9C:EF:03:68:81 handle 3840 state 5 lm CENTRAL\n \u003c LE C4:D3:6A:8C:B5:38 handle 3841 state 5 lm CENTRAL\n\nA btmon capture across the next ten minutes of connect attempts\ncontains no HCI_OP_LE_CREATE_CONN at all; outgoing LE connections\ndo not recover until the adapter is reset. With this change the same\nscenario fails the rejected connection cleanly and further connects\nto both peers go through.\n\nAsk about the connection itself instead of about the device."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:04.553Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42fe0278d05d75c405abad62dafaeec713cec2e2"
},
{
"url": "https://git.kernel.org/stable/c/a78d16530c1538a215a827c7c3a4b408d6759bc0"
},
{
"url": "https://git.kernel.org/stable/c/78970b39529844b31df2949015f66752e17210fe"
},
{
"url": "https://git.kernel.org/stable/c/8a8585e421d06f878b33ef79f82cace0d485e3d8"
},
{
"url": "https://git.kernel.org/stable/c/2eafcf310f4e0ad4f387881db01116bbe3cc0b39"
},
{
"url": "https://git.kernel.org/stable/c/7e1e4047200fd7519f9bdfe8a001437715e618b4"
}
],
"title": "Bluetooth: do not leak an hci_conn when a second LE connect is rejected",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90087",
"datePublished": "2026-09-17T16:06:02.872Z",
"dateReserved": "2026-09-11T19:38:34.785Z",
"dateUpdated": "2026-10-30T12:34:04.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63998 (GCVE-0-2026-63998)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ethtool: module: call ethnl_ops_complete() on module flash errors
When validate() fails we are skipping over ethnl_ops_complete()
even tho we already called ethnl_ops_begin().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ethtool/module.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "170d82a57f4be1ce83de823a93bafd218a0d5fb1",
"status": "affected",
"version": "32b4c8b53ee7799e34a2b1634d32d3ce1e36c44e",
"versionType": "git"
},
{
"lessThan": "d9defbf8b62bde89e206d74c2a2b445b9ed66108",
"status": "affected",
"version": "32b4c8b53ee7799e34a2b1634d32d3ce1e36c44e",
"versionType": "git"
},
{
"lessThan": "e96ef1a40dda5b637b1911cd950b11e9848de939",
"status": "affected",
"version": "32b4c8b53ee7799e34a2b1634d32d3ce1e36c44e",
"versionType": "git"
},
{
"lessThan": "84371fb58423f997939aacdcbc02d128d76a54e5",
"status": "affected",
"version": "32b4c8b53ee7799e34a2b1634d32d3ce1e36c44e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ethtool/module.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: module: call ethnl_ops_complete() on module flash errors\n\nWhen validate() fails we are skipping over ethnl_ops_complete()\neven tho we already called ethnl_ops_begin()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:51.445Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/170d82a57f4be1ce83de823a93bafd218a0d5fb1"
},
{
"url": "https://git.kernel.org/stable/c/d9defbf8b62bde89e206d74c2a2b445b9ed66108"
},
{
"url": "https://git.kernel.org/stable/c/e96ef1a40dda5b637b1911cd950b11e9848de939"
},
{
"url": "https://git.kernel.org/stable/c/84371fb58423f997939aacdcbc02d128d76a54e5"
}
],
"title": "ethtool: module: call ethnl_ops_complete() on module flash errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63998",
"datePublished": "2026-07-19T14:56:16.664Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-21T12:42:51.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64076 (GCVE-0-2026-64076)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: eb_tables: close module init race
sashiko reports for unrelated patch:
Does the core ebtables initialization in ebtables.c suffer from a similar race?
Once nf_register_sockopt() completes, the sockopts are exposed globally.
sockopt has to be registered last, just like in ip/ip6/arptables.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5b53951cfc85329d29df9d07b1e905f4563546a5 Version: 5b53951cfc85329d29df9d07b1e905f4563546a5 Version: 5b53951cfc85329d29df9d07b1e905f4563546a5 Version: 5b53951cfc85329d29df9d07b1e905f4563546a5 Version: 5b53951cfc85329d29df9d07b1e905f4563546a5 Version: 5b53951cfc85329d29df9d07b1e905f4563546a5 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64076",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:08.204808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:11.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0e7dec9dfc02987598e6a42bdfcab51dcc43e10",
"status": "affected",
"version": "5b53951cfc85329d29df9d07b1e905f4563546a5",
"versionType": "git"
},
{
"lessThan": "5fc488f46086d17e8e545d8104ddd95b175de218",
"status": "affected",
"version": "5b53951cfc85329d29df9d07b1e905f4563546a5",
"versionType": "git"
},
{
"lessThan": "6bb35bdaabb22fd2d86b601904e928dbaa537941",
"status": "affected",
"version": "5b53951cfc85329d29df9d07b1e905f4563546a5",
"versionType": "git"
},
{
"lessThan": "c647e2a21bbbaceda6cdb8a44a56f44d231dc4b4",
"status": "affected",
"version": "5b53951cfc85329d29df9d07b1e905f4563546a5",
"versionType": "git"
},
{
"lessThan": "02d999dc69b3918dba2414932b5d95f1f75c76cb",
"status": "affected",
"version": "5b53951cfc85329d29df9d07b1e905f4563546a5",
"versionType": "git"
},
{
"lessThan": "27414ff1b287ea9a2a11675149ec28e05539f3cc",
"status": "affected",
"version": "5b53951cfc85329d29df9d07b1e905f4563546a5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: eb_tables: close module init race\n\nsashiko reports for unrelated patch:\n Does the core ebtables initialization in ebtables.c suffer from a similar race?\n Once nf_register_sockopt() completes, the sockopts are exposed globally.\n\nsockopt has to be registered last, just like in ip/ip6/arptables."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local setsockopt/getsockopt syscall on a PF_INET socket; the vulnerable ebtables handlers are reached via ip_setsockopt \u2192 nf_setsockopt, not via remote bridge frame or network packet processing.\nAC:L - The attacker can hammer concurrent setsockopt/getsockopt calls in a tight loop while waiting for or triggering ebtables module load, controlling the sockopt side of the init race window between nf_register_sockopt() and register_pernet_subsys().\nPR:L - All ebtables sockopt entry points (do_ebt_set_ctl/do_ebt_get_ctl) gate on ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is obtainable by an unprivileged user via user namespaces (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through concurrent syscalls during module initialization.\nS:U - Impact is confined to kernel memory and integrity within the same security authority; this is not a VM escape, sandbox breakout, or cross-tenant boundary crossing.\nC:H - Before pernet registration, net_generic(net, 0) returns the net_generic.len field misinterpreted as a pointer, and list_for_each_entry on the resulting bogus ebt_pernet-\u003etables can read unintended kernel memory before faulting.\nI:H - The same uninitialized net_generic lookup drives list traversal and subsequent ebtables table management paths (do_replace/do_update_counters) that perform kernel heap list operations and rule data writes against corrupted state.\nA:H - Hitting the race window causes invalid pointer dereference during list iteration, producing a kernel oops/panic and denying system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:33.060Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0e7dec9dfc02987598e6a42bdfcab51dcc43e10"
},
{
"url": "https://git.kernel.org/stable/c/5fc488f46086d17e8e545d8104ddd95b175de218"
},
{
"url": "https://git.kernel.org/stable/c/6bb35bdaabb22fd2d86b601904e928dbaa537941"
},
{
"url": "https://git.kernel.org/stable/c/c647e2a21bbbaceda6cdb8a44a56f44d231dc4b4"
},
{
"url": "https://git.kernel.org/stable/c/02d999dc69b3918dba2414932b5d95f1f75c76cb"
},
{
"url": "https://git.kernel.org/stable/c/27414ff1b287ea9a2a11675149ec28e05539f3cc"
}
],
"title": "netfilter: bridge: eb_tables: close module init race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64076",
"datePublished": "2026-07-19T15:39:50.346Z",
"dateReserved": "2026-07-19T07:54:57.031Z",
"dateUpdated": "2026-10-30T12:27:33.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80693 (GCVE-0-2026-80693)
Vulnerability from cvelistv5
Published
2026-08-28 06:52
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: bound interrupt-vector register fill to the allocated array
idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from
the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding
its inner loop only by the per-chunk num_vectors. The array is sized
separately: idpf_intr_reg_init() allocates
kzalloc_objs(struct idpf_vec_regs, total_vecs) from
caps.num_allocated_vectors and only checks the returned count after the
fill. The sum of per-chunk num_vectors is never reconciled against
total_vecs, so a reply with a small num_allocated_vectors but chunks
summing higher writes past the end of reg_vals[].
Impact: a control plane (a PF or hypervisor device model) that returns a
VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds
num_allocated_vectors writes struct idpf_vec_regs entries past the end of
the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).
Bound the fill loop to the array capacity passed in by the callers,
mirroring the sibling idpf_vport_get_q_reg(). The existing
num_regs < num_vecs check then rejects an undersized reply without the
out-of-bounds write happening first.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80693",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:11.642760Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:33.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_dev.c",
"drivers/net/ethernet/intel/idpf/idpf_vf_dev.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6447b6a9678e701ca4d32789f311067cf528c2d",
"status": "affected",
"version": "d4d5587182664b0c4ab6d3556ce881cb975507c2",
"versionType": "git"
},
{
"lessThan": "e299b7d1334ebec4d43a7bb697d10c12df1aaed3",
"status": "affected",
"version": "d4d5587182664b0c4ab6d3556ce881cb975507c2",
"versionType": "git"
},
{
"lessThan": "41bb8748124d0d8ee5d8e1eace9dfbc874bc9564",
"status": "affected",
"version": "d4d5587182664b0c4ab6d3556ce881cb975507c2",
"versionType": "git"
},
{
"lessThan": "9f7007ee9858c99aa43101bc8352c672fee85644",
"status": "affected",
"version": "d4d5587182664b0c4ab6d3556ce881cb975507c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_dev.c",
"drivers/net/ethernet/intel/idpf/idpf_vf_dev.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: bound interrupt-vector register fill to the allocated array\n\nidpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from\nthe VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter-\u003ereq_vec_chunks, bounding\nits inner loop only by the per-chunk num_vectors. The array is sized\nseparately: idpf_intr_reg_init() allocates\nkzalloc_objs(struct idpf_vec_regs, total_vecs) from\ncaps.num_allocated_vectors and only checks the returned count after the\nfill. The sum of per-chunk num_vectors is never reconciled against\ntotal_vecs, so a reply with a small num_allocated_vectors but chunks\nsumming higher writes past the end of reg_vals[].\n\nImpact: a control plane (a PF or hypervisor device model) that returns a\nVIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds\nnum_allocated_vectors writes struct idpf_vec_regs entries past the end of\nthe reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).\n\nBound the fill loop to the array capacity passed in by the callers,\nmirroring the sibling idpf_vport_get_q_reg(). The existing\nnum_regs \u003c num_vecs check then rejects an undersized reply without the\nout-of-bounds write happening first."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only when the idpf driver processes a VIRTCHNL2_OP_ALLOC_VECTORS reply over the PCIe virtchnl/mailbox control queue during idpf_vc_core_init()/idpf_vport_intr_init(); there is no network packet, syscall, or netlink path into idpf_get_reg_intr_vecs().\nAC:L - A malicious control plane fully controls GET_CAPS num_allocated_vectors and per-chunk num_vectors in the ALLOC_VECTORS reply, so the slab out-of-bounds write is deterministic on driver init or hardware-reset re-init without races or attacker-uncontrollable memory layout.\nPR:N - Exploitation requires no credentials on the victim OS; a malicious PF, hypervisor device model, or NIC firmware can inject the crafted virtchnl reply during probe/reset before any local user action, including in cloud VMs where tenants never administer the control plane.\nUI:N - No victim interaction is required beyond normal driver bring-up; cloud and server images auto-probe the Intel idpf PF/VF and open netdevs at boot, so the attacker need not wait for a user to mount, click, or manually configure the interface.\nS:C - The attack crosses the SR-IOV/virtio control-plane boundary: a hypervisor or device firmware outside the guest/host kernel trust domain corrupts kernel heap memory inside the idpf driver security authority, matching other virtchnl isolation-breaker CVEs.\nC:H - The flaw is a kmalloc slab out-of-bounds write of attacker-influenced struct idpf_vec_regs entries (dyn_ctl_reg, itrn_reg, itrn_index_spacing); such heap corruption can disclose adjacent slab objects and be groomed into an arbitrary kernel read primitive.\nI:H - Each overfilled entry writes 12 bytes of control-plane-supplied register metadata past reg_vals[], giving a repeatable heap overflow primitive that can corrupt adjacent allocations and be leveraged for control-flow hijack or privilege escalation in the victim kernel.\nA:H - Writing far beyond the reg_vals[] allocation corrupts slab metadata or adjacent kernel objects and can immediately oops/panic the host or guest kernel; hardware-reset recovery re-enters idpf_vc_core_init(), allowing repeated crash or re-exploitation attempts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:53.892Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6447b6a9678e701ca4d32789f311067cf528c2d"
},
{
"url": "https://git.kernel.org/stable/c/e299b7d1334ebec4d43a7bb697d10c12df1aaed3"
},
{
"url": "https://git.kernel.org/stable/c/41bb8748124d0d8ee5d8e1eace9dfbc874bc9564"
},
{
"url": "https://git.kernel.org/stable/c/9f7007ee9858c99aa43101bc8352c672fee85644"
}
],
"title": "idpf: bound interrupt-vector register fill to the allocated array",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80693",
"datePublished": "2026-08-28T06:52:56.131Z",
"dateReserved": "2026-08-26T14:34:25.785Z",
"dateUpdated": "2026-10-21T12:46:53.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89709 (GCVE-0-2026-89709)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
nlmsvc_ops is published by nfsd_lockd_init() and cleared by
nfsd_lockd_shutdown() with plain stores, while lockd dereferences
it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer
targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's
.text, so a stale load after rmmod nfsd results in either a NULL
deref or a module-text use-after-free.
Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear
via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module
*owner field to nlmsvc_binding and pin the module across indirect
calls with try_module_get/module_put. When the binding is torn down,
fall back to fput() to avoid leaking struct file references.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89709",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:26:23.054440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:36:59.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/lockd/svc.c",
"fs/lockd/svc4proc.c",
"fs/lockd/svcproc.c",
"fs/lockd/svcsubs.c",
"fs/nfsd/lockd.c",
"include/linux/lockd/bind.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc2f0d79b21be69b891cbd1899daf2a1fdf9df87",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "43943532c105ea8fe26039a1347cfda4ac0fcadc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6e7495972039f212e336e552b58cac9dd54611c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "836ce2b99bcce6d68c58edd04efbc5cd1fd581af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3c461a1820088fb5889d73a6522369bde45527a9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "641e5e20852359b8c31149be4598884e30652f60",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/lockd/svc.c",
"fs/lockd/svc4proc.c",
"fs/lockd/svcproc.c",
"fs/lockd/svcsubs.c",
"fs/nfsd/lockd.c",
"include/linux/lockd/bind.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd, nfsd: RCU-protect nlmsvc_ops dispatch\n\nnlmsvc_ops is published by nfsd_lockd_init() and cleared by\nnfsd_lockd_shutdown() with plain stores, while lockd dereferences\nit unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer\ntargets nfsd\u0027s .rodata and the fopen/fclose callbacks live in nfsd\u0027s\n.text, so a stale load after rmmod nfsd results in either a NULL\nderef or a module-text use-after-free.\n\nDeclare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear\nvia RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module\n*owner field to nlmsvc_binding and pin the module across indirect\ncalls with try_module_get/module_put. When the binding is torn down,\nfall back to fput() to avoid leaking struct file references."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - lockd is the in-kernel NLM RPC server on TCP/UDP (rpcbind-registered) used with nfsd. nlm_do_fopen() and nlm_delete_file() run from NLM LOCK/TEST/UNLOCK/FREE_ALL in svc_recv, so a remote NFS/NLM peer reaches the unguarded nlmsvc_ops-\u003efopen/fclose dispatch.\nAC:H - The UAF requires exit_nfsd()/rmmod nfsd to NULL nlmsvc_ops with a plain store and free nfsd .text while lockd still dispatches. A remote attacker can flood NLM requests but cannot unload nfsd; that victim-side module teardown is beyond attacker control.\nPR:N - lockd_authenticate() accepts RPC_AUTH_NULL and RPC_AUTH_UNIX before procedure dispatch. nlm_fopen() uses NFSD_MAY_BYPASS_GSS|NFSD_MAY_NLM, and typical exports use AUTH_SYS, so no host account or capability is required.\nUI:N - Exploitation is driven by attacker-sent NLM RPCs to an already-running lockd; no victim user must mount a filesystem or open a file. nfsd unload is an environmental timing condition, not User Interaction.\nS:U - The module-text UAF and NULL deref corrupt host kernel lockd/nfsd state within the same OS security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - After rmmod, a stale nlmsvc_ops load calls fopen/fclose from freed nfsd .rodata/.text. Reclaim of those module pages lets the attacker control the indirect-call target, yielding an arbitrary kernel read per UAF guidance.\nI:H - Indirect call through a dangling nlmsvc_binding in freed nfsd module memory is a RIP-hijack primitive; spraying recycled module pages enables arbitrary kernel write and control-flow hijack, so integrity impact is high.\nA:H - A stale nlmsvc_ops load after rmmod nfsd is either a NULL deref or a call into unmapped module text; both oops/panic the kernel, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:47.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc2f0d79b21be69b891cbd1899daf2a1fdf9df87"
},
{
"url": "https://git.kernel.org/stable/c/43943532c105ea8fe26039a1347cfda4ac0fcadc"
},
{
"url": "https://git.kernel.org/stable/c/6e7495972039f212e336e552b58cac9dd54611c3"
},
{
"url": "https://git.kernel.org/stable/c/836ce2b99bcce6d68c58edd04efbc5cd1fd581af"
},
{
"url": "https://git.kernel.org/stable/c/3c461a1820088fb5889d73a6522369bde45527a9"
},
{
"url": "https://git.kernel.org/stable/c/641e5e20852359b8c31149be4598884e30652f60"
}
],
"title": "lockd, nfsd: RCU-protect nlmsvc_ops dispatch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89709",
"datePublished": "2026-09-11T19:46:24.803Z",
"dateReserved": "2026-09-11T19:38:34.751Z",
"dateUpdated": "2026-10-30T12:32:47.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98985 (GCVE-0-2026-98985)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
namespace: check the mounts before reading their parents in pivot_root()
path_pivot_root() reads the parents of new_root and of the caller's root
and checks whether they are shared before it checks that either mount is
in the caller's mount namespace. Only namespace_sem is held. That's fine
for a mount that is in the caller's mount namespace.
But new_root can be a file descriptor to a mount that has been unmounted
and that only the file descriptor keeps alive. If that mount stayed
attached to its parent when it was unmounted nothing pins the parent for
it. The final mntput() of the parent unhooks the children under
mount_lock alone and frees the parent afterwards:
pivot_root() close(fd), last ref on the parent
------------ ---------------------------------
ex_parent = new_mnt->mnt_parent
mntput_no_expire_slowpath()
__umount_mnt(new_mnt)
cleanup_mnt()
call_rcu()
IS_MNT_SHARED(ex_parent)
BUG: KASAN: slab-use-after-free in path_pivot_root+0xf1a/0x1840
Read of size 4 at addr ffff8881047382f8 by task pivot_widen/157
path_pivot_root+0xf1a/0x1840
__x64_sys_pivot_root+0x165/0x190
The same goes for the caller's root via chroot(). Both outcomes of the
check end in EINVAL so nothing but the read itself goes wrong. It's the
same thing commit bb4609405752 ("statmount: read the parent of an
unmounted mount under mount_lock") fixed for statmount().
Check that both mounts are in the caller's namespace before their
parents are read. Every path returns EINVAL either way.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: 84b78514033ff22c443473214ab6d0508394cf7a Version: 4.0.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43fd2e2ec66e6db26b6ea3e9e7a4c1018455e1b0",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "5b5f8d0895cfa9f781ce107225d578897203444f",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "3184a2fda996af8fcd6def36020ec023c6279015",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "a56d4f8f8f4c5d9ac339d5c03a9d90eecd3697fc",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "3c2441e21c3df867e4131e0ff784ecdb3a7a55f8",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "e3aba6900483f64e6c9eb328150dd633b7d36c1c",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "3dad2330c89343ba083cf7868779083fd5fbe0fe",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "6b7c001eb5857fa09041f47673666060a2e5fc1c",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"status": "affected",
"version": "84b78514033ff22c443473214ab6d0508394cf7a",
"versionType": "git"
},
{
"lessThan": "4.1",
"status": "affected",
"version": "4.0.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: check the mounts before reading their parents in pivot_root()\n\npath_pivot_root() reads the parents of new_root and of the caller\u0027s root\nand checks whether they are shared before it checks that either mount is\nin the caller\u0027s mount namespace. Only namespace_sem is held. That\u0027s fine\nfor a mount that is in the caller\u0027s mount namespace.\n\nBut new_root can be a file descriptor to a mount that has been unmounted\nand that only the file descriptor keeps alive. If that mount stayed\nattached to its parent when it was unmounted nothing pins the parent for\nit. The final mntput() of the parent unhooks the children under\nmount_lock alone and frees the parent afterwards:\n\n pivot_root() close(fd), last ref on the parent\n ------------ ---------------------------------\n ex_parent = new_mnt-\u003emnt_parent\n mntput_no_expire_slowpath()\n __umount_mnt(new_mnt)\n cleanup_mnt()\n call_rcu()\n IS_MNT_SHARED(ex_parent)\n\n BUG: KASAN: slab-use-after-free in path_pivot_root+0xf1a/0x1840\n Read of size 4 at addr ffff8881047382f8 by task pivot_widen/157\n path_pivot_root+0xf1a/0x1840\n __x64_sys_pivot_root+0x165/0x190\n\nThe same goes for the caller\u0027s root via chroot(). Both outcomes of the\ncheck end in EINVAL so nothing but the read itself goes wrong. It\u0027s the\nsame thing commit bb4609405752 (\"statmount: read the parent of an\nunmounted mount under mount_lock\") fixed for statmount().\n\nCheck that both mounts are in the caller\u0027s namespace before their\nparents are read. Every path returns EINVAL either way."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:43.386Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43fd2e2ec66e6db26b6ea3e9e7a4c1018455e1b0"
},
{
"url": "https://git.kernel.org/stable/c/5b5f8d0895cfa9f781ce107225d578897203444f"
},
{
"url": "https://git.kernel.org/stable/c/3184a2fda996af8fcd6def36020ec023c6279015"
},
{
"url": "https://git.kernel.org/stable/c/a56d4f8f8f4c5d9ac339d5c03a9d90eecd3697fc"
},
{
"url": "https://git.kernel.org/stable/c/3c2441e21c3df867e4131e0ff784ecdb3a7a55f8"
},
{
"url": "https://git.kernel.org/stable/c/e3aba6900483f64e6c9eb328150dd633b7d36c1c"
},
{
"url": "https://git.kernel.org/stable/c/3dad2330c89343ba083cf7868779083fd5fbe0fe"
},
{
"url": "https://git.kernel.org/stable/c/6b7c001eb5857fa09041f47673666060a2e5fc1c"
}
],
"title": "namespace: check the mounts before reading their parents in pivot_root()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98985",
"datePublished": "2026-10-23T12:20:03.622Z",
"dateReserved": "2026-09-25T10:25:14.384Z",
"dateUpdated": "2026-10-30T12:40:43.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74690 (GCVE-0-2026-74690)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
A ism interrupt handler can be active in parallel with ism_dev_exit(),
accessing freed data structures.
No new interrupts will be generated after unregister_ieq(). Drain ongoing
interrupt handlers by free_irq(), before freeing ism data structures.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 684b89bc39ce4f204b1a2b180f39f2eb36a6b695 Version: 684b89bc39ce4f204b1a2b180f39f2eb36a6b695 Version: 684b89bc39ce4f204b1a2b180f39f2eb36a6b695 Version: 684b89bc39ce4f204b1a2b180f39f2eb36a6b695 Version: 684b89bc39ce4f204b1a2b180f39f2eb36a6b695 Version: 684b89bc39ce4f204b1a2b180f39f2eb36a6b695 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/ism_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c9a59603b2b016424fe2f9a1cb58c8c2f7198f4",
"status": "affected",
"version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
"versionType": "git"
},
{
"lessThan": "950dac9e8c4e3cf68fa8c01f77d3ac3b7369c6a9",
"status": "affected",
"version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
"versionType": "git"
},
{
"lessThan": "58803870ba0841e53b630a1290c6838b091dd128",
"status": "affected",
"version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
"versionType": "git"
},
{
"lessThan": "fc3021284050ecb3bba8a7851340cedcb5037928",
"status": "affected",
"version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
"versionType": "git"
},
{
"lessThan": "774394d27930ec4cf4cb3eed8ab6a4d20cb2430a",
"status": "affected",
"version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
"versionType": "git"
},
{
"lessThan": "b1896543ce59c4258625a35cf41e23a9a1f80ea2",
"status": "affected",
"version": "684b89bc39ce4f204b1a2b180f39f2eb36a6b695",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/ism_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ism: Fix UAF of sba and ieq during ism_dev_exit()\n\nA ism interrupt handler can be active in parallel with ism_dev_exit(),\naccessing freed data structures.\n\nNo new interrupts will be generated after unregister_ieq(). Drain ongoing\ninterrupt handlers by free_irq(), before freeing ism data structures."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is opened in ism_dev_exit() during local PCI/driver teardown (ism_remove on module unload, sysfs unbind, or hot-unplug); remote SMC-D peers can raise ISM IRQs but cannot alone reach the freeing path that creates the dangling sba/ieq pointers.\nAC:L - This is a classic UAF race where the attacker controls the IRQ side by sustaining SMC-D move_data/signal_event traffic (or timing rmmod/unbind) while teardown frees sba/ieq before free_irq(); no uncontrollable memory layout or rare config is required on IBM Z ISM deployments.\nPR:N - Privileged teardown opens the window, but the concurrent UAF dereference is performed by ISM IRQ handlers servicing SMC-D traffic from unprivileged local socket users or remote LPAR peers that need no credentials or capabilities on the victim LPAR, only SMC connectivity.\nUI:N - No victim interaction is required beyond normal automated ISM interrupt processing during driver removal; an attacker only needs to keep SMC-D sessions active (or flood them) while the ISM device is torn down during maintenance, module unload, or hot-unplug.\nS:U - Impact is kernel heap/DMA-coherent memory corruption and privilege escalation within the host/LPAR kernel; it does not cross a VM, hypervisor, IOMMU, or other security-authority boundary.\nC:H - ism_handle_irq() and ism_handle_event() read freed PAGE_SIZE sba and ieq DMA buffers (dmb_bits, dmbe_mask, event entries) after dma_free_coherent(), enabling sprayable slab reuse and arbitrary kernel memory disclosure per UAF guidance.\nI:H - The IRQ handler writes to freed sba fields (summary/event bits, dmbe_mask clears) and then calls dibs client handle_irq/handle_event with attacker-influenced SMC state, providing heap grooming and control-flow hijack primitives from the UAF.\nA:H - Concurrent access to freed sba/ieq in hardirq reliably causes kernel oops/panic during ISM teardown on active SMC-D workloads, and UAF guidance treats any ISM interrupt-time use-after-free as high availability impact even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:18.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c9a59603b2b016424fe2f9a1cb58c8c2f7198f4"
},
{
"url": "https://git.kernel.org/stable/c/950dac9e8c4e3cf68fa8c01f77d3ac3b7369c6a9"
},
{
"url": "https://git.kernel.org/stable/c/58803870ba0841e53b630a1290c6838b091dd128"
},
{
"url": "https://git.kernel.org/stable/c/fc3021284050ecb3bba8a7851340cedcb5037928"
},
{
"url": "https://git.kernel.org/stable/c/774394d27930ec4cf4cb3eed8ab6a4d20cb2430a"
},
{
"url": "https://git.kernel.org/stable/c/b1896543ce59c4258625a35cf41e23a9a1f80ea2"
}
],
"title": "s390/ism: Fix UAF of sba and ieq during ism_dev_exit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74690",
"datePublished": "2026-08-22T15:32:54.650Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-10-30T12:30:18.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38636 (GCVE-0-2025-38636)
Vulnerability from cvelistv5
Published
2025-08-22 16:00
Modified
2026-11-05 21:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rv: Use strings in da monitors tracepoints
Using DA monitors tracepoints with KASAN enabled triggers the following
warning:
BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0
Read of size 32 at addr ffffffffaada8980 by task ...
Call Trace:
<TASK>
[...]
do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0
? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10
? trace_event_sncid+0x83/0x200
trace_event_sncid+0x163/0x200
[...]
The buggy address belongs to the variable:
automaton_snep+0x4e0/0x5e0
This is caused by the tracepoints reading 32 bytes __array instead of
__string from the automata definition. Such strings are literals and
reading 32 bytes ends up in out of bound memory accesses (e.g. the next
automaton's data in this case).
The error is harmless as, while printing the string, we stop at the null
terminator, but it should still be fixed.
Use the __string facilities while defining the tracepoints to avoid
reading out of bound memory.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:05:33.920243Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:12:49.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/rv/rv_trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb8de6f5ed5c43f7387615bbe601d2a4a31b7b35",
"status": "affected",
"version": "792575348ff70e05c6040d02fce38e949ef92c37",
"versionType": "git"
},
{
"lessThan": "dcae71222c8b9e5b5dd88a2d67347dedf10e68c6",
"status": "affected",
"version": "792575348ff70e05c6040d02fce38e949ef92c37",
"versionType": "git"
},
{
"lessThan": "665ca03e93cee01baadc7b5eaee21b9d892e0dab",
"status": "affected",
"version": "792575348ff70e05c6040d02fce38e949ef92c37",
"versionType": "git"
},
{
"lessThan": "0ebc70d973ce7a81826b5c4f55f743e07f5864d9",
"status": "affected",
"version": "792575348ff70e05c6040d02fce38e949ef92c37",
"versionType": "git"
},
{
"lessThan": "7f904ff6e58d398c4336f3c19c42b338324451f7",
"status": "affected",
"version": "792575348ff70e05c6040d02fce38e949ef92c37",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/rv/rv_trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrv: Use strings in da monitors tracepoints\n\nUsing DA monitors tracepoints with KASAN enabled triggers the following\nwarning:\n\n BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n Read of size 32 at addr ffffffffaada8980 by task ...\n Call Trace:\n \u003cTASK\u003e\n [...]\n do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10\n ? trace_event_sncid+0x83/0x200\n trace_event_sncid+0x163/0x200\n [...]\n The buggy address belongs to the variable:\n automaton_snep+0x4e0/0x5e0\n\nThis is caused by the tracepoints reading 32 bytes __array instead of\n__string from the automata definition. Such strings are literals and\nreading 32 bytes ends up in out of bound memory accesses (e.g. the next\nautomaton\u0027s data in this case).\nThe error is harmless as, while printing the string, we stop at the null\nterminator, but it should still be fixed.\n\nUse the __string facilities while defining the tracepoints to avoid\nreading out of bound memory."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:10.534Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb8de6f5ed5c43f7387615bbe601d2a4a31b7b35"
},
{
"url": "https://git.kernel.org/stable/c/dcae71222c8b9e5b5dd88a2d67347dedf10e68c6"
},
{
"url": "https://git.kernel.org/stable/c/665ca03e93cee01baadc7b5eaee21b9d892e0dab"
},
{
"url": "https://git.kernel.org/stable/c/0ebc70d973ce7a81826b5c4f55f743e07f5864d9"
},
{
"url": "https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7"
}
],
"title": "rv: Use strings in da monitors tracepoints",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38636",
"datePublished": "2025-08-22T16:00:43.910Z",
"dateReserved": "2025-04-16T04:51:24.030Z",
"dateUpdated": "2026-11-05T21:12:49.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45956 (GCVE-0-2026-45956)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.
This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.
To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 Version: cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/exynos/exynos_drm_drv.h",
"drivers/gpu/drm/exynos/exynos_drm_vidi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2987642c5213508c6c9e718324c0d5289a92c474",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "65d1213baffa363f2eb1117b1dc7acc573b890f8",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "875fa28690e93ed5296c31d3344556c6bb867234",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "21ca24ba51a2c28bcc4df9d7e5a40b0eb66ab76d",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "e1aed617eb80b49eac2f8c7bb7a0990f641dd59b",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "b5fc86d753dd4c281a943b92f0eef02d31af03d7",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "a540f767642f75240a6c35f6a65b69e44cfcea9d",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
},
{
"lessThan": "d3968a0d85b211e197f2f4f06268a7031079e0d0",
"status": "affected",
"version": "cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/exynos/exynos_drm_drv.h",
"drivers/gpu/drm/exynos/exynos_drm_vidi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: vidi: use priv-\u003evidi_dev for ctx lookup in vidi_connection_ioctl()\n\nvidi_connection_ioctl() retrieves the driver_data from drm_dev-\u003edev to\nobtain a struct vidi_context pointer. However, drm_dev-\u003edev is the\nexynos-drm master device, and the driver_data contained therein is not\nthe vidi component device, but a completely different device.\n\nThis can lead to various bugs, ranging from null pointer dereferences and\ngarbage value accesses to, in unlucky cases, out-of-bounds errors,\nuse-after-free errors, and more.\n\nTo resolve this issue, we need to store/delete the vidi device pointer in\nexynos_drm_private-\u003evidi_dev during bind/unbind, and then read this\nexynos_drm_private-\u003evidi_dev within ioctl() to obtain the correct\nstruct vidi_context pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through the Exynos DRM primary device node via DRM_IOCTL_EXYNOS_VIDI_CONNECTION (local ioctl path through drm_ioctl), not over the network.\nAC:L - Once the VIDI driver is enabled and the caller passes DRM_AUTH checks, every call uses the wrong context pointer deterministically; the attacker fully controls ioctl arguments and timing without external race luck.\nPR:L - Exploitation requires a local process that can open the primary DRM device and satisfy DRM_AUTH (authenticated DRM client or CAP_SYS_ADMIN, which includes user-namespace admin); it does not require init-namespace root, but unauthenticated users cannot reach the ioctl.\nUI:N - No victim interaction is required beyond the attacker (or their already-authenticated DRM client) issuing the malicious ioctl.\nS:U - Impact is kernel memory corruption and instability within the same kernel security domain; it is not a VM escape, IOMMU bypass, or cross-authority sandbox break.\nC:H - Type-confused reads/writes against a drm_device masquerading as vidi_context can dereference attacker-influenced garbage pointers and, on affected versions in the CVE window, companion paths also allowed unsafe EDID handling; per project guidance, UAF/wrong-free and uncontrolled reads warrant High confidentiality impact.\nI:H - The ioctl writes connection state and EDID pointers into misaligned drm_device fields and may call drm_edid_free() on attacker-influenced addresses, enabling arbitrary kernel memory corruption and potential control-flow hijack, not merely a benign crash.\nA:H - The fix and commit message document NULL dereferences, out-of-bounds access, and use-after-free outcomes that can oops or panic the kernel; any such crash maps to High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:06.321Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2987642c5213508c6c9e718324c0d5289a92c474"
},
{
"url": "https://git.kernel.org/stable/c/65d1213baffa363f2eb1117b1dc7acc573b890f8"
},
{
"url": "https://git.kernel.org/stable/c/875fa28690e93ed5296c31d3344556c6bb867234"
},
{
"url": "https://git.kernel.org/stable/c/21ca24ba51a2c28bcc4df9d7e5a40b0eb66ab76d"
},
{
"url": "https://git.kernel.org/stable/c/e1aed617eb80b49eac2f8c7bb7a0990f641dd59b"
},
{
"url": "https://git.kernel.org/stable/c/b5fc86d753dd4c281a943b92f0eef02d31af03d7"
},
{
"url": "https://git.kernel.org/stable/c/a540f767642f75240a6c35f6a65b69e44cfcea9d"
},
{
"url": "https://git.kernel.org/stable/c/d3968a0d85b211e197f2f4f06268a7031079e0d0"
}
],
"title": "drm/exynos: vidi: use priv-\u003evidi_dev for ctx lookup in vidi_connection_ioctl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45956",
"datePublished": "2026-05-27T12:18:11.972Z",
"dateReserved": "2026-05-13T15:03:33.088Z",
"dateUpdated": "2026-10-21T12:41:06.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46256 (GCVE-0-2026-46256)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
LOCALIO is an NFS loopback mount optimization that avoids using the
network for READ, WRITE and COMMIT if the NFS client and server are
determined to be on the same system. But because LOCALIO is still
fundamentally "just NFS loopback mount" it is susceptible to recursion
deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then
back into NFS via nfs_writepages.
Fix LOCALIO's potential for direct reclaim deadlock by ensuring that
all its page cache allocations are done from GFP_NOFS context.
Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs:
prevent stack overflows from page cache allocation").
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/localio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9118e1cab8a5571c6a95011f77ff28480aee9cb0",
"status": "affected",
"version": "70ba381e1a431245c137ed597ec6a05991c79bd9",
"versionType": "git"
},
{
"lessThan": "ae26a4cf2baf0a44c538dc093504d1994b02dade",
"status": "affected",
"version": "70ba381e1a431245c137ed597ec6a05991c79bd9",
"versionType": "git"
},
{
"lessThan": "6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9",
"status": "affected",
"version": "70ba381e1a431245c137ed597ec6a05991c79bd9",
"versionType": "git"
},
{
"lessThan": "67435d2d8a33a75f9647724952cb1b18279d2e95",
"status": "affected",
"version": "70ba381e1a431245c137ed597ec6a05991c79bd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/localio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages\n\nLOCALIO is an NFS loopback mount optimization that avoids using the\nnetwork for READ, WRITE and COMMIT if the NFS client and server are\ndetermined to be on the same system. But because LOCALIO is still\nfundamentally \"just NFS loopback mount\" it is susceptible to recursion\ndeadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then\nback into NFS via nfs_writepages.\n\nFix LOCALIO\u0027s potential for direct reclaim deadlock by ensuring that\nall its page cache allocations are done from GFP_NOFS context.\n\nThanks to Ben Coddington for pointing out commit ad22c7a043c2 (\"xfs:\nprevent stack overflows from page cache allocation\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:32.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9118e1cab8a5571c6a95011f77ff28480aee9cb0"
},
{
"url": "https://git.kernel.org/stable/c/ae26a4cf2baf0a44c538dc093504d1994b02dade"
},
{
"url": "https://git.kernel.org/stable/c/6a5de0c4fc0f217eea945d3d72c34ee30d72cbc9"
},
{
"url": "https://git.kernel.org/stable/c/67435d2d8a33a75f9647724952cb1b18279d2e95"
}
],
"title": "NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46256",
"datePublished": "2026-06-03T15:49:53.168Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-10-21T12:41:32.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68435 (GCVE-0-2026-68435)
Vulnerability from cvelistv5
Published
2026-08-12 00:07
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Fix address space mismatch in kexec command line lookup
When searching the loaded segments for the "kexec" command line marker,
the kexec_load(2) path (file_mode == 0) passes the user-space segment
buffer straight to strncmp() through a bogus (char __user *) cast. This
dereferences a user pointer in kernel context, which is wrong and is
flagged by sparse:
arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in
argument 2 (different address spaces) @@ expected char const * @@ got
char [noderef] __user *
Here copy the marker-sized prefix of each segment into a small on-stack
buffer with copy_from_user() before comparing, and skip segments that
fault. The subsequent copy_from_user() that stages the full command line
into the safe area is left unchanged.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 Version: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 Version: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 Version: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 Version: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 Version: 4a03b2ac06a5bcae29371866d9d11f5bfd4c9188 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/loongarch/kernel/machine_kexec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "742f2c0a64a7557495e831c3c112d92e308bd4ae",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "3b71f51fa3a247921408879eab2ddee82da8a980",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "eaa908d8d523b0ab75dab5ebd6662e70af5e5d7e",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "a94d6726ec8680a2b0c453fc782a543f68a1ea06",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
},
{
"lessThan": "485ed44db5694d8d2e5027f63ad608e705286f30",
"status": "affected",
"version": "4a03b2ac06a5bcae29371866d9d11f5bfd4c9188",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/loongarch/kernel/machine_kexec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix address space mismatch in kexec command line lookup\n\nWhen searching the loaded segments for the \"kexec\" command line marker,\nthe kexec_load(2) path (file_mode == 0) passes the user-space segment\nbuffer straight to strncmp() through a bogus (char __user *) cast. This\ndereferences a user pointer in kernel context, which is wrong and is\nflagged by sparse:\n\n arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in\n argument 2 (different address spaces) @@ expected char const * @@ got\n char [noderef] __user *\n\nHere copy the marker-sized prefix of each segment into a small on-stack\nbuffer with copy_from_user() before comparing, and skip segments that\nfault. The subsequent copy_from_user() that stages the full command line\ninto the safe area is left unchanged."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:36.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/742f2c0a64a7557495e831c3c112d92e308bd4ae"
},
{
"url": "https://git.kernel.org/stable/c/3b71f51fa3a247921408879eab2ddee82da8a980"
},
{
"url": "https://git.kernel.org/stable/c/eaa908d8d523b0ab75dab5ebd6662e70af5e5d7e"
},
{
"url": "https://git.kernel.org/stable/c/a94d6726ec8680a2b0c453fc782a543f68a1ea06"
},
{
"url": "https://git.kernel.org/stable/c/7a54e0cbaad4a5a09e7cc7a4f05d181048e98ca7"
},
{
"url": "https://git.kernel.org/stable/c/485ed44db5694d8d2e5027f63ad608e705286f30"
}
],
"title": "LoongArch: Fix address space mismatch in kexec command line lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68435",
"datePublished": "2026-08-12T00:07:23.359Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-10-30T12:28:36.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98032 (GCVE-0-2026-98032)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix subbuf resize races with trace_pipe_raw readers
Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
uninitialized memory to userspace due to stale size values.
Modify ring_buffer_alloc_read_page() to handle the resizing of an
existing buffer_data_read_page if necessary and add a new
ring_buffer_read_page_size(). This new function enables ring-buffer
buffer_data_read_page users to not call the racy
ring_buffer_subbuf_size_get(). This makes the spare_size member of
ftrace_buffer_info redundant.
Finally, handle buffer_data_read_page/reader_page order discrepancy in
ring_buffer_read_page(). On a mismatch simply copy manually the data to
the buffer_data_read_page.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/ring_buffer.h",
"kernel/trace/ring_buffer.c",
"kernel/trace/ring_buffer_benchmark.c",
"kernel/trace/trace.c",
"kernel/trace/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "574efd988d116bd56ac688ab2d64e06ba0da982a",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
},
{
"lessThan": "3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
},
{
"lessThan": "75b37b8369778b69ce9738d1c97685a1615cb252",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
},
{
"lessThan": "dae8dda341d2d9034a90d59e8a7d502e1263813f",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/ring_buffer.h",
"kernel/trace/ring_buffer.c",
"kernel/trace/ring_buffer_benchmark.c",
"kernel/trace/trace.c",
"kernel/trace/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix subbuf resize races with trace_pipe_raw readers\n\nConcurrent subbuffer resizes may crash trace_pipe_raw readers or leak\nuninitialized memory to userspace due to stale size values.\n\nModify ring_buffer_alloc_read_page() to handle the resizing of an\nexisting buffer_data_read_page if necessary and add a new\nring_buffer_read_page_size(). This new function enables ring-buffer\nbuffer_data_read_page users to not call the racy\nring_buffer_subbuf_size_get(). This makes the spare_size member of\nftrace_buffer_info redundant.\n\nFinally, handle buffer_data_read_page/reader_page order discrepancy in\nring_buffer_read_page(). On a mismatch simply copy manually the data to\nthe buffer_data_read_page."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:06.279Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/574efd988d116bd56ac688ab2d64e06ba0da982a"
},
{
"url": "https://git.kernel.org/stable/c/3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3"
},
{
"url": "https://git.kernel.org/stable/c/75b37b8369778b69ce9738d1c97685a1615cb252"
},
{
"url": "https://git.kernel.org/stable/c/dae8dda341d2d9034a90d59e8a7d502e1263813f"
}
],
"title": "tracing: Fix subbuf resize races with trace_pipe_raw readers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98032",
"datePublished": "2026-09-25T10:23:48.169Z",
"dateReserved": "2026-09-25T10:19:56.070Z",
"dateUpdated": "2026-10-21T12:54:06.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63857 (GCVE-0-2026-63857)
Vulnerability from cvelistv5
Published
2026-07-19 14:04
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
The transmit loop in airoha_dev_xmit() reads fragment address and length
during its final iteration, when the loop index equals
skb_shinfo(skb)->nr_frags, at which point the fragment data is
uninitialized. While these values are never consumed, the read itself is
unsafe and may trigger a page fault. Fix this by avoiding the fragment
read on the last iteration.
Additionally, move the skb pointer from the first to the last used packet
descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb
until the final descriptor is processed.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/airoha/airoha_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dba5f4959653e4c212beb746594952e8645d1115",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
},
{
"lessThan": "f670fa4b19ceddc6d215dda4997888ccba9bbc61",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
},
{
"lessThan": "d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
},
{
"lessThan": "bde34e84edc8b5571fbde7e941e175a4293ee1eb",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/airoha/airoha_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()\n\nThe transmit loop in airoha_dev_xmit() reads fragment address and length\nduring its final iteration, when the loop index equals\nskb_shinfo(skb)-\u003enr_frags, at which point the fragment data is\nuninitialized. While these values are never consumed, the read itself is\nunsafe and may trigger a page fault. Fix this by avoiding the fragment\nread on the last iteration.\nAdditionally, move the skb pointer from the first to the last used packet\ndescriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb\nuntil the final descriptor is processed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in netdev TX (`ndo_start_xmit`) on Airoha EN7581 WAN/LAN interfaces; a remote attacker can trigger transmission by sending packets that cause responses, NAT forwarding, or bridged/routed egress without local access.\nAC:L - Any outbound skb traversing this driver hits the defective loop deterministically; an attacker can reliably provoke multi-fragment transmits (scatter/gather is enabled) to also trigger the premature-skb-free UAF without depending on uncontrollable timing or layout.\nPR:N - Exploitation requires only the ability to send network traffic to or through the device\u0027s registered netdevs; no local account, capability, or authentication is needed on internet-facing router/CPE deployments.\nUI:N - No victim interaction is required beyond normal always-on network traffic handled by the kernel stack.\nS:U - Impact is confined to kernel memory and the host running the Airoha driver; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:H - The final loop iteration performs an out-of-bounds read of uninitialized `skb_frag_t` contents that may contain stale kernel heap data, and the companion skb lifetime bug creates a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Premature freeing of the skb while later TX descriptors still DMA mapped fragment memory is a heap use-after-free that can be exploited for arbitrary kernel writes or code execution, not merely a discarded read.\nA:H - Reading garbage fragment metadata can cause a kernel page fault/oops, and the skb use-after-free can crash or panic the system during subsequent DMA completion or skb reuse."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:41.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dba5f4959653e4c212beb746594952e8645d1115"
},
{
"url": "https://git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61"
},
{
"url": "https://git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3"
},
{
"url": "https://git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb"
}
],
"title": "net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63857",
"datePublished": "2026-07-19T14:04:46.339Z",
"dateReserved": "2026-07-19T07:54:57.016Z",
"dateUpdated": "2026-10-21T12:42:41.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72398 (GCVE-0-2026-72398)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: add INIT verification after cookie unpacking
In SCTP handshake, the INIT chunk is initially processed by the server
and embedded into the cookie carried in INIT-ACK. The client then
returns this cookie via COOKIE-ECHO, where the server unpacks it and
reconstructs the original INIT chunk.
When cookie authentication is enabled, the cookie contents are protected
against tampering, so reusing the unpacked INIT without re-verification
is safe.
However, when cookie authentication is disabled, the reconstructed INIT
can no longer be trusted. In this case, the INIT must be explicitly
validated after unpacking to avoid processing potentially tampered data.
Add sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO
processing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())
when cookie_auth_enable is disabled. On failure, the new association is
freed and the packet is discarded.
Also tighten cookie validation in sctp_unpack_cookie() by verifying the
embedded chunk type is SCTP_CID_INIT before treating it as an INIT
chunk.
Finally, update sctp_verify_init() to validate parameter bounds using
the actual embedded INIT length instead of chunk->chunk_end, since the
INIT stored in COOKIE-ECHO may not span the entire chunk buffer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:48:54.907256Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:21.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c",
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca967418a60b33158e859daf202f3858fd1c8afd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "81892d83cc897331510f35b30d17f8b0dc285966",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "683a012b984fef4bc155e278742fbe01561e102a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bca3100f550281c2f2418652338bced3b35af0e6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "062bcbf8d1f1051fdeb20b94920031b0e2cb95a2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "414c5447fe6a200613dd46d7fdc8454622076cb1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c",
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add INIT verification after cookie unpacking\n\nIn SCTP handshake, the INIT chunk is initially processed by the server\nand embedded into the cookie carried in INIT-ACK. The client then\nreturns this cookie via COOKIE-ECHO, where the server unpacks it and\nreconstructs the original INIT chunk.\n\nWhen cookie authentication is enabled, the cookie contents are protected\nagainst tampering, so reusing the unpacked INIT without re-verification\nis safe.\n\nHowever, when cookie authentication is disabled, the reconstructed INIT\ncan no longer be trusted. In this case, the INIT must be explicitly\nvalidated after unpacking to avoid processing potentially tampered data.\n\nAdd sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO\nprocessing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())\nwhen cookie_auth_enable is disabled. On failure, the new association is\nfreed and the packet is discarded.\n\nAlso tighten cookie validation in sctp_unpack_cookie() by verifying the\nembedded chunk type is SCTP_CID_INIT before treating it as an INIT\nchunk.\n\nFinally, update sctp_verify_init() to validate parameter bounds using\nthe actual embedded INIT length instead of chunk-\u003echunk_end, since the\nINIT stored in COOKIE-ECHO may not span the entire chunk buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO packets to a listening endpoint; packets enter through sctp_rcv()/IPv4/IPv6 SCTP handlers and are dispatched to COOKIE-ECHO state handlers without any local access requirement.\nAC:L - On deployments with SCTP cookie authentication disabled (supported via cookie_hmac_alg=none), an attacker can complete INIT/INIT-ACK, tamper with the embedded INIT in the returned cookie, and reliably trigger the vulnerable path with crafted COOKIE-ECHO traffic.\nPR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local privileges, credentials, or CAP_NET_ADMIN on the target.\nUI:N - No victim user action is required beyond operating an SCTP listener; exploitation is achieved solely by sending attacker-crafted SCTP handshake packets over the network.\nS:U - The vulnerability affects the Linux kernel SCTP stack on the target host and does not cross a separate security boundary such as guest-to-host VM escape, container sandbox escape, or IOMMU/DMA isolation bypass.\nC:H - Without sctp_verify_init() and with incorrect INIT parameter bound checks, attacker-controlled embedded INIT lengths/types can drive sctp_walk_params() and kmemdup() beyond valid cookie data, enabling out-of-bounds kernel memory reads.\nI:H - Tampered or type-confused embedded INIT data is parsed into association/peer state via sctp_process_init() without full validation, causing kernel memory-safety corruption that can modify association structures and plausibly be leveraged for stronger write primitives.\nA:H - Malformed embedded INIT processing during COOKIE-ECHO handling can trigger kernel faults, KASAN/oops conditions, allocation failures, or repeated crashes of SCTP input processing, causing high availability impact on internet-facing SCTP services."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:16.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca967418a60b33158e859daf202f3858fd1c8afd"
},
{
"url": "https://git.kernel.org/stable/c/81892d83cc897331510f35b30d17f8b0dc285966"
},
{
"url": "https://git.kernel.org/stable/c/683a012b984fef4bc155e278742fbe01561e102a"
},
{
"url": "https://git.kernel.org/stable/c/bca3100f550281c2f2418652338bced3b35af0e6"
},
{
"url": "https://git.kernel.org/stable/c/062bcbf8d1f1051fdeb20b94920031b0e2cb95a2"
},
{
"url": "https://git.kernel.org/stable/c/414c5447fe6a200613dd46d7fdc8454622076cb1"
}
],
"title": "sctp: add INIT verification after cookie unpacking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72398",
"datePublished": "2026-08-15T05:56:24.306Z",
"dateReserved": "2026-08-09T03:40:39.925Z",
"dateUpdated": "2026-10-30T12:29:16.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80655 (GCVE-0-2026-80655)
Vulnerability from cvelistv5
Published
2026-08-28 06:49
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: xilinx: Fix race condition in event registration
The zynqmp_power driver registers handlers for suspend and subsystem
restart events using register_event(). However, the work structures
(zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by
these handlers were allocated and initialized after the registration
call.
This created a race window where, if the firmware triggered an event
immediately after registration but before allocation, the callback
(suspend_event_callback or subsystem_restart_event_callback) would
dereference a NULL pointer in work_pending(), leading to a crash.
Fix this by allocating and initializing the work structures before
registering the events.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/xilinx/zynqmp_power.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "07ea9081b8fefb99e2f427e0f0602a5e576cb120",
"status": "affected",
"version": "fcf544ac64397776a18246eba5a8ca72a47c4405",
"versionType": "git"
},
{
"lessThan": "e124f7b170337563d78a7a6aa152c897d229bc39",
"status": "affected",
"version": "fcf544ac64397776a18246eba5a8ca72a47c4405",
"versionType": "git"
},
{
"lessThan": "d349aa118ff5e4cab88424ce1b16e08edd70f8bb",
"status": "affected",
"version": "fcf544ac64397776a18246eba5a8ca72a47c4405",
"versionType": "git"
},
{
"lessThan": "fb445935338405110baca8f541a2df3b4cb8d712",
"status": "affected",
"version": "fcf544ac64397776a18246eba5a8ca72a47c4405",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/xilinx/zynqmp_power.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: xilinx: Fix race condition in event registration\n\nThe zynqmp_power driver registers handlers for suspend and subsystem\nrestart events using register_event(). However, the work structures\n(zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by\nthese handlers were allocated and initialized after the registration\ncall.\n\nThis created a race window where, if the firmware triggered an event\nimmediately after registration but before allocation, the callback\n(suspend_event_callback or subsystem_restart_event_callback) would\ndereference a NULL pointer in work_pending(), leading to a crash.\n\nFix this by allocating and initializing the work structures before\nregistering the events."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:48.145Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/07ea9081b8fefb99e2f427e0f0602a5e576cb120"
},
{
"url": "https://git.kernel.org/stable/c/e124f7b170337563d78a7a6aa152c897d229bc39"
},
{
"url": "https://git.kernel.org/stable/c/d349aa118ff5e4cab88424ce1b16e08edd70f8bb"
},
{
"url": "https://git.kernel.org/stable/c/fb445935338405110baca8f541a2df3b4cb8d712"
}
],
"title": "soc: xilinx: Fix race condition in event registration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80655",
"datePublished": "2026-08-28T06:49:01.988Z",
"dateReserved": "2026-08-26T14:34:25.780Z",
"dateUpdated": "2026-10-21T12:46:48.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97480 (GCVE-0-2026-97480)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-30 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tty: serial: 8250: protect against NULL uart->port.dev in register
serial8250_register_8250_port() conditionally copies uart->port.dev
from up->port.dev only when up->port.dev is non-NULL:
if (up->port.dev) {
uart->port.dev = up->port.dev;
...
}
So if both the existing uart slot and up have a NULL ->dev,
uart->port.dev remains NULL. The very next ACPI companion check
then dereferences it unconditionally:
if (!has_acpi_companion(uart->port.dev)) {
has_acpi_companion() reads dev->fwnode without a NULL guard
(include/linux/acpi.h), so this NULL-derefs the kernel for the
remaining no-dev case rather than just skipping the
mctrl_gpio_init() initialisation as intended.
smatch flags the inconsistency:
drivers/tty/serial/8250/8250_core.c:767
serial8250_register_8250_port() error: 'uart->port.dev' could be
null (see line 719)
Guard the call with a NULL check so register continues to work
for callers that legitimately have no parent device (legacy
non-OF/non-ACPI registrations).
No functional change for callers that pass a non-NULL ->dev.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f728f7f38a6eca16923c72fc6826445810d2b41f",
"status": "affected",
"version": "4a96895f74c9633b51427fd080ab70fa62b65bc4",
"versionType": "git"
},
{
"lessThan": "68059b6e9f7292714286e2b0f5185ed2a43fccc5",
"status": "affected",
"version": "4a96895f74c9633b51427fd080ab70fa62b65bc4",
"versionType": "git"
},
{
"lessThan": "9c78f89cf2fbae18b14c78bf172ca15d832aff15",
"status": "affected",
"version": "4a96895f74c9633b51427fd080ab70fa62b65bc4",
"versionType": "git"
},
{
"lessThan": "5cbab666721d974bfe033a12045d808936deaefd",
"status": "affected",
"version": "4a96895f74c9633b51427fd080ab70fa62b65bc4",
"versionType": "git"
},
{
"lessThan": "941c9f84c9b6310f7aaa1c8c785dcc634ee33050",
"status": "affected",
"version": "4a96895f74c9633b51427fd080ab70fa62b65bc4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: protect against NULL uart-\u003eport.dev in register\n\nserial8250_register_8250_port() conditionally copies uart-\u003eport.dev\nfrom up-\u003eport.dev only when up-\u003eport.dev is non-NULL:\n\n\tif (up-\u003eport.dev) {\n\t\tuart-\u003eport.dev = up-\u003eport.dev;\n\t\t...\n\t}\n\nSo if both the existing uart slot and up have a NULL -\u003edev,\nuart-\u003eport.dev remains NULL. The very next ACPI companion check\nthen dereferences it unconditionally:\n\n\tif (!has_acpi_companion(uart-\u003eport.dev)) {\n\nhas_acpi_companion() reads dev-\u003efwnode without a NULL guard\n(include/linux/acpi.h), so this NULL-derefs the kernel for the\nremaining no-dev case rather than just skipping the\nmctrl_gpio_init() initialisation as intended.\n\nsmatch flags the inconsistency:\n\n drivers/tty/serial/8250/8250_core.c:767\n serial8250_register_8250_port() error: \u0027uart-\u003eport.dev\u0027 could be\n null (see line 719)\n\nGuard the call with a NULL check so register continues to work\nfor callers that legitimately have no parent device (legacy\nnon-OF/non-ACPI registrations).\n\nNo functional change for callers that pass a non-NULL -\u003edev."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:37:01.897Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f728f7f38a6eca16923c72fc6826445810d2b41f"
},
{
"url": "https://git.kernel.org/stable/c/68059b6e9f7292714286e2b0f5185ed2a43fccc5"
},
{
"url": "https://git.kernel.org/stable/c/9c78f89cf2fbae18b14c78bf172ca15d832aff15"
},
{
"url": "https://git.kernel.org/stable/c/5cbab666721d974bfe033a12045d808936deaefd"
},
{
"url": "https://git.kernel.org/stable/c/941c9f84c9b6310f7aaa1c8c785dcc634ee33050"
}
],
"title": "tty: serial: 8250: protect against NULL uart-\u003eport.dev in register",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97480",
"datePublished": "2026-09-24T16:04:22.893Z",
"dateReserved": "2026-09-24T16:01:01.149Z",
"dateUpdated": "2026-10-30T12:37:01.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98156 (GCVE-0-2026-98156)
Vulnerability from cvelistv5
Published
2026-09-25 10:36
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: use the DMA API for resource backing on Xen
On a Xen PV domain page addresses bear no relation to the real machine
addresses the host would have to use to reach it.
virtio_ring.c handles this correctly, vring_use_map_api() returns true
for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.
virtio-gpu makes the same decision independently, but its copy
looks only at the feature bit:
bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
QEMU does not set iommu_platform on virtio-vga by default, so
VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and
virtio_gpu_object_shmem_init() describes the framebuffer's backing pages
to the host with sg_phys(). Those are guest-physical addresses. In a PV
domain they resolve, on the host side, to pages belonging to some other
domain, so the host scans out unrelated memory.
Move the decision into virtio_gpu_use_dma_api() and give it the
xen_domain() check, like vring_use_map_api() has. This
additionally enables the dma_sync_sgtable_for_device() calls in
virtgpu_vq.c, which are required for correctness whenever swiotlb
is in play.
Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with
virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0
works fine and doesn't need this fix because it is identity-mapped,
only PV dom0s are affected.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.h",
"drivers/gpu/drm/virtio/virtgpu_object.c",
"drivers/gpu/drm/virtio/virtgpu_vq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "32e999ccf5f6453b3b4df8264ff1b03c6720292f",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
},
{
"lessThan": "3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
},
{
"lessThan": "93c557e947ef0040004b1ac6a1c1265d79a957e1",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
},
{
"lessThan": "455184dbe9652d01470d3c5cf5edd09a7a673a99",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
},
{
"lessThan": "6a736d2f9d0c6e6217fe7532bc4c50ceca71db78",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.h",
"drivers/gpu/drm/virtio/virtgpu_object.c",
"drivers/gpu/drm/virtio/virtgpu_vq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev-\u003evdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer\u0027s backing pages\nto the host with sg_phys(). Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn\u0027t need this fix because it is identity-mapped,\nonly PV dom0s are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker is a local process in the Xen PV dom0. It opens the virtio-gpu render node and calls VIRTGPU_RESOURCE_CREATE, which runs virtio_gpu_object_shmem_init(), and then VIRTGPU_TRANSFER_TO_HOST or TRANSFER_FROM_HOST. No remote peer supplies the bad sg_phys() addresses; the guest driver builds them itself.\nAC:H - The bug only exists on a Xen PV dom0 nested inside QEMU with virtio-vga and without iommu_platform, so VIRTIO_F_ACCESS_PLATFORM is not negotiated. This is a rare deployment the attacker cannot create. The attacker also cannot choose which foreign machine frames the pseudo-physical pfns resolve to.\nPR:L - VIRTGPU_RESOURCE_CREATE, TRANSFER_TO_HOST and TRANSFER_FROM_HOST are all marked DRM_RENDER_ALLOW. Any user with access to /dev/dri/renderD* (render group or a logind seat ACL) can reach them without root.\nUI:N - The attacker creates the resource and issues the transfer ioctls entirely on their own. No other user has to act.\nS:C - virtio_gpu_object_shmem_init() hands the host guest-pseudo-physical addresses, which the host resolves to machine frames owned by other Xen domains or by Xen itself. So a flaw in the dom0 driver affects memory outside that domain\u0027s security authority.\nC:H - virtio_gpu_cmd_transfer_to_host_2d/3d make the host copy unrelated machine pages (other domains\u0027 memory) into a host resource, which is then scanned out. With virgl, the attacker could plausibly copy that resource into memory they can read back.\nI:H - With virgl, VIRTGPU_TRANSFER_FROM_HOST makes the host write resource data to the wrong backing addresses. Those addresses are machine frames belonging to other domains or the hypervisor, so this is an uncontrolled cross-domain memory write.\nA:H - Host writes into foreign machine frames through the bad backing entries can corrupt Xen or other domains\u0027 memory, crashing them. The unsynced swiotlb path (missing dma_sync_sgtable_for_device) also corrupts display data."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:43.922Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/32e999ccf5f6453b3b4df8264ff1b03c6720292f"
},
{
"url": "https://git.kernel.org/stable/c/3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36"
},
{
"url": "https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1"
},
{
"url": "https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99"
},
{
"url": "https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"
}
],
"title": "drm/virtio: use the DMA API for resource backing on Xen",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98156",
"datePublished": "2026-09-25T10:36:26.409Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-10-21T12:54:43.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58074 (GCVE-0-2024-58074)
Vulnerability from cvelistv5
Published
2025-03-06 16:04
Modified
2026-11-05 20:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Grab intel_display from the encoder to avoid potential oopsies
Grab the intel_display from 'encoder' rather than 'state'
in the encoder hooks to avoid the massive footgun that is
intel_sanitize_encoder(), which passes NULL as the 'state'
argument to encoder .disable() and .post_disable().
TODO: figure out how to actually fix intel_sanitize_encoder()...
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58074",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:33:28.906604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:41:39.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_crt.c",
"drivers/gpu/drm/i915/display/intel_tv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3a03ef592ef9b900698b46703015f9134721479c",
"status": "affected",
"version": "ab0b0eb5c85c5961913bdb9b8011cc8f5c14978a",
"versionType": "git"
},
{
"lessThan": "1885401569f24eb35c631bcc4e6543360dbe9292",
"status": "affected",
"version": "ab0b0eb5c85c5961913bdb9b8011cc8f5c14978a",
"versionType": "git"
},
{
"lessThan": "dc3806d9eb66d0105f8d55d462d4ef681d9eac59",
"status": "affected",
"version": "ab0b0eb5c85c5961913bdb9b8011cc8f5c14978a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_crt.c",
"drivers/gpu/drm/i915/display/intel_tv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.13.*",
"status": "unaffected",
"version": "6.13.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.14",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Grab intel_display from the encoder to avoid potential oopsies\n\nGrab the intel_display from \u0027encoder\u0027 rather than \u0027state\u0027\nin the encoder hooks to avoid the massive footgun that is\nintel_sanitize_encoder(), which passes NULL as the \u0027state\u0027\nargument to encoder .disable() and .post_disable().\n\nTODO: figure out how to actually fix intel_sanitize_encoder()..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:35:51.173Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3a03ef592ef9b900698b46703015f9134721479c"
},
{
"url": "https://git.kernel.org/stable/c/1885401569f24eb35c631bcc4e6543360dbe9292"
},
{
"url": "https://git.kernel.org/stable/c/dc3806d9eb66d0105f8d55d462d4ef681d9eac59"
}
],
"title": "drm/i915: Grab intel_display from the encoder to avoid potential oopsies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-58074",
"datePublished": "2025-03-06T16:04:30.170Z",
"dateReserved": "2025-03-06T15:52:09.182Z",
"dateUpdated": "2026-11-05T20:41:39.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74338 (GCVE-0-2026-74338)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should
not attach any sleepable BPF programs there. Add support to the verifier
to explicitly reject attempts to load sleepable BPF programs destined
for LSM cgroup attachment.
Without this, we get the following splat from a BPF_LSM_CGROUP
program marked BPF_F_SLEEPABLE attached to file_open when it calls
bpf_get_dentry_xattr():
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load
preempt_count: 0, expected: 0
RCU nest depth: 2, expected: 0
Call Trace:
down_read+0x76/0x480
ext4_xattr_get+0x11f/0x700
__vfs_getxattr+0xf0/0x150
bpf_get_dentry_xattr+0xbb/0xf0
bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85
__cgroup_bpf_run_lsm_current+0x326/0x840
bpf_trampoline_6442534646+0x62/0x14d
security_file_open+0x34/0x60
do_dentry_open+0x340/0x1260
vfs_open+0x7a/0x440
path_openat+0x1bac/0x30a0
libbpf provides a .s named section variant for every sleepable
program type except lsm_cgroup, reflecting that per-cgroup LSM programs
are intended to only run in a non-sleepable context.
The above splat was obtained by bypassing libbpf by using bpf(2)
directly.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e Version: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e Version: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e Version: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e Version: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e Version: 69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:53:52.626746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:33.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b0c76212af693734e5a2c9e9a48568f99f5bc46c",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "f0a49d16804d319774388a32d8cdcef319a9e481",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "4b9d8bdeb19e709f9bc3c317d48b0c0add3b2b1d",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "b4059a1f57eff3e206d44697f64ad81076512760",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "be9eaf2bb5db4ad3de61ef739fd268fd7f135737",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
},
{
"lessThan": "5b038319be442c620f774e6fc9e9283deeca1c75",
"status": "affected",
"version": "69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject sleepable BPF_LSM_CGROUP programs at load time\n\nThe cgroup shim runs under rcu_read_lock_dont_migrate(), so we should\nnot attach any sleepable BPF programs there. Add support to the verifier\nto explicitly reject attempts to load sleepable BPF programs destined\nfor LSM cgroup attachment.\n\nWithout this, we get the following splat from a BPF_LSM_CGROUP\nprogram marked BPF_F_SLEEPABLE attached to file_open when it calls\nbpf_get_dentry_xattr():\n\n BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567\n in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 34317, name: load\n preempt_count: 0, expected: 0\n RCU nest depth: 2, expected: 0\n Call Trace:\n down_read+0x76/0x480\n ext4_xattr_get+0x11f/0x700\n __vfs_getxattr+0xf0/0x150\n bpf_get_dentry_xattr+0xbb/0xf0\n bpf_prog_e76a298dac9218c6_test_open+0x6a/0x85\n __cgroup_bpf_run_lsm_current+0x326/0x840\n bpf_trampoline_6442534646+0x62/0x14d\n security_file_open+0x34/0x60\n do_dentry_open+0x340/0x1260\n vfs_open+0x7a/0x440\n path_openat+0x1bac/0x30a0\n\nlibbpf provides a .s named section variant for every sleepable\nprogram type except lsm_cgroup, reflecting that per-cgroup LSM programs\nare intended to only run in a non-sleepable context.\n\nThe above splat was obtained by bypassing libbpf by using bpf(2)\ndirectly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires bpf(2) to load/attach a BPF_LSM_CGROUP program and a local file open to hit security_file_open; BPF/cgroup control is syscall-local, not reachable from remote network protocols.\nAC:L - On kernels with CONFIG_BPF_LSM and CONFIG_CGROUP_BPF, an attacker with BPF privileges can deterministically load BPF_F_SLEEPABLE BPF_LSM_CGROUP on file_open and trigger it with their own open(), without races or external preconditions.\nPR:L - Loading BPF_PROG_TYPE_LSM requires CAP_BPF and CAP_PERFMON, and attaching to a cgroup2 fd requires cgroup write access; both are obtainable by an unprivileged user via user namespaces (unshare -Urn) per kernel CVSS guidance.\nUI:N - No victim interaction is required; once the sleepable BPF_LSM_CGROUP program is attached, any file open in that cgroup automatically invokes the vulnerable non-sleepable cgroup LSM shim path.\nS:U - Impact stays within kernel security authority (kernel panic/hang or memory corruption from invalid-context sleeping); it is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Calling sleepable helpers like bpf_get_dentry_xattr from rcu_read_lock_dont_migrate() can sleep on inode rwsems while RCU references remain, enabling use-after-free and arbitrary kernel memory disclosure beyond the intended xattr read.\nI:H - Sleeping in the cgroup BPF LSM RCU-critical section can corrupt VFS/inode lifetime and lock state, plausibly yielding arbitrary kernel write or control-flow hijack primitives, not merely a contained helper failure.\nA:H - The bug triggers \"BUG: sleeping function called from invalid context\" (demonstrated on file_open) and can also cause RCU stalls, deadlocks, oops, or kernel panic when production kernels actually block in down_read under RCU."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:44.566Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b0c76212af693734e5a2c9e9a48568f99f5bc46c"
},
{
"url": "https://git.kernel.org/stable/c/f0a49d16804d319774388a32d8cdcef319a9e481"
},
{
"url": "https://git.kernel.org/stable/c/4b9d8bdeb19e709f9bc3c317d48b0c0add3b2b1d"
},
{
"url": "https://git.kernel.org/stable/c/b4059a1f57eff3e206d44697f64ad81076512760"
},
{
"url": "https://git.kernel.org/stable/c/be9eaf2bb5db4ad3de61ef739fd268fd7f135737"
},
{
"url": "https://git.kernel.org/stable/c/5b038319be442c620f774e6fc9e9283deeca1c75"
}
],
"title": "bpf: Reject sleepable BPF_LSM_CGROUP programs at load time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74338",
"datePublished": "2026-08-15T05:58:29.222Z",
"dateReserved": "2026-08-15T05:44:03.885Z",
"dateUpdated": "2026-10-30T12:29:44.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72495 (GCVE-0-2026-72495)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
Applications can request multiple WC pages for the same ucontext.
As of now, only 1 WC page per ucontext is supported. Add a lock to
avoid concurrent access and a check to fail repeated requests.
Also, if the mmap entry insert fails for the WC, free the Doorbell
page index mapped for the WC page.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:00.430753Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:26.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c",
"drivers/infiniband/hw/bnxt_re/ib_verbs.h",
"drivers/infiniband/hw/bnxt_re/uapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "00c71846874fea4917961236e49287a1850dcf98",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "478c4d24193fe3e6aa2accd4874ae43000e4a217",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "da406b8b49c1dfe661a497483940d7ee781430db",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "441baa79043431807115fd030d7d0bb14ed441a0",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c",
"drivers/infiniband/hw/bnxt_re/ib_verbs.h",
"drivers/infiniband/hw/bnxt_re/uapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Avoid repeated requests to allocate WC pages\n\nApplications can request multiple WC pages for the same ucontext.\nAs of now, only 1 WC page per ucontext is supported. Add a lock to\navoid concurrent access and a check to fail repeated requests.\nAlso, if the mmap entry insert fails for the WC, free the Doorbell\npage index mapped for the WC page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in BNXT_RE_METHOD_ALLOC_PAGE, reached only via write/ioctl on /dev/infiniband/uverbs* after IB ucontext creation; remote RoCE packet handling and in-kernel RDMA target/server paths never invoke this WC DPI allocation routine.\nAC:L - An attacker can deterministically trigger the bug by issuing repeated or concurrent BNXT_RE_ALLOC_WC_PAGE calls from multiple threads on the same ucontext; they control both sides of the race and need no uncontrollable memory layout or victim-specific state.\nPR:N - Standard uverbs character devices are created mode 0666, so any local process can open the bnxt_re device, allocate a ucontext, and invoke BNXT_RE_METHOD_ALLOC_PAGE without CAP_SYS_ADMIN, init-namespace root, or other elevated capabilities.\nUI:N - No victim interaction is required; exploitation needs only the attacker (or a compromised local RDMA workload) repeatedly or concurrently calling ALLOC_PAGE on resources it already controls through normal RDMA verbs.\nS:C - On HPC/cloud hosts exposing bnxt_re to tenant containers or unprivileged RDMA workloads, corrupting shared per-device DPI bookkeeping or exhausting finite doorbell indices crosses the container/tenant boundary to impact the host/kernel security authority.\nC:H - Without serialization or duplicate checks, corrupt DPI index bookkeeping and premature slot reuse can alias WC doorbell BAR pages across contexts, exposing other users\u0027 doorbell state and providing resource-corruption primitives usable for information disclosure.\nI:H - Destroying one ALLOC_PAGE object can deallocate another object\u0027s live WC DPI slot while its BAR mmap remains active, letting a later allocation share the same doorbell page and enabling cross-context WC doorbell writes that corrupt other tenants\u0027 RDMA queue signaling.\nA:H - Each orphaned DPI entry permanently consumes a finite per-device doorbell index (exhaustible via repeated or concurrent ALLOC_PAGE), denying RDMA service cluster-wide; unsynchronized wcdpi updates can also destabilize kernel DPI teardown paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:04.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e59bd37d6d63a06ed452eaffe6c9d4ad903af7b"
},
{
"url": "https://git.kernel.org/stable/c/00c71846874fea4917961236e49287a1850dcf98"
},
{
"url": "https://git.kernel.org/stable/c/478c4d24193fe3e6aa2accd4874ae43000e4a217"
},
{
"url": "https://git.kernel.org/stable/c/da406b8b49c1dfe661a497483940d7ee781430db"
},
{
"url": "https://git.kernel.org/stable/c/441baa79043431807115fd030d7d0bb14ed441a0"
}
],
"title": "RDMA/bnxt_re: Avoid repeated requests to allocate WC pages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72495",
"datePublished": "2026-08-15T05:57:28.920Z",
"dateReserved": "2026-08-09T03:40:39.937Z",
"dateUpdated": "2026-10-21T12:45:04.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80581 (GCVE-0-2026-80581)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Ignore IPC errors for pipeline state change if the firmware state is
crashed or the IPC has timed out.
If the firmware has crashed the kernel still needs to go through the state
changes to reset its internal to be able to correctly work the next time
the DSP is booted up.
The case with IPC timeout is a bit more problematic, but it has been
rootcaused to be the result of system scheduling blockage and the firmware
did actually received and handled the message, but the reply handling got
blocked by issues outside of the SOF stack.
So far the best way to handle this is to continue with setting the state.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3cac6eebea9b4bc5f041e157e45c76e212ad6759 Version: c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 Version: c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 Version: c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 Version: c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 Version: 6ee66295542f88e5179439f60053de792df3f90e Version: d153e8b154f9746ac969c85a4e6474760453647c Version: 6.6.23 ≤ Version: 6.1.191 ≤ Version: 6.7.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4931c09d83877dc350106bae745321c3f295129b",
"status": "affected",
"version": "3cac6eebea9b4bc5f041e157e45c76e212ad6759",
"versionType": "git"
},
{
"lessThan": "96d51b8c5a909937d41f9c03495188d4190f877d",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"lessThan": "f2435a46dfa1a5693cf2664afd022db66ee58121",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"lessThan": "6b512a5330ef1a41db7aff4b80c4e952b8d52f17",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"lessThan": "17661c67b206612cb3ba65d5ae726cd2015d0a53",
"status": "affected",
"version": "c40aad7c81e5fba34b70123ed7ce3397fa62a4d2",
"versionType": "git"
},
{
"status": "affected",
"version": "6ee66295542f88e5179439f60053de792df3f90e",
"versionType": "git"
},
{
"status": "affected",
"version": "d153e8b154f9746ac969c85a4e6474760453647c",
"versionType": "git"
},
{
"lessThan": "6.6.154",
"status": "affected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "6.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.191",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout\n\nIgnore IPC errors for pipeline state change if the firmware state is\ncrashed or the IPC has timed out.\n\nIf the firmware has crashed the kernel still needs to go through the state\nchanges to reset its internal to be able to correctly work the next time\nthe DSP is booted up.\n\nThe case with IPC timeout is a bit more problematic, but it has been\nrootcaused to be the result of system scheduling blockage and the firmware\ndid actually received and handled the message, but the reply handling got\nblocked by issues outside of the SOF stack.\nSo far the best way to handle this is to continue with setting the state."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:39.206Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4931c09d83877dc350106bae745321c3f295129b"
},
{
"url": "https://git.kernel.org/stable/c/96d51b8c5a909937d41f9c03495188d4190f877d"
},
{
"url": "https://git.kernel.org/stable/c/f2435a46dfa1a5693cf2664afd022db66ee58121"
},
{
"url": "https://git.kernel.org/stable/c/6b512a5330ef1a41db7aff4b80c4e952b8d52f17"
},
{
"url": "https://git.kernel.org/stable/c/17661c67b206612cb3ba65d5ae726cd2015d0a53"
}
],
"title": "ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80581",
"datePublished": "2026-08-26T14:37:38.510Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-10-30T12:30:39.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100074 (GCVE-0-2026-100074)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix
this oversight.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "015f9fbcf3382c5eb563a157ee8cabb6fbfcfe5e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "20b3c72c1b83054c568d2322a95e217fdc281bc3",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "e42cede6f90177f4f92f80d3de18f628e61d2087",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "641f814965d733936ca3618d4d5a12a8fa9be00e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "61e655391cb19c31f94ecd4354f624c81ce4cf75",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:46.286Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/015f9fbcf3382c5eb563a157ee8cabb6fbfcfe5e"
},
{
"url": "https://git.kernel.org/stable/c/20b3c72c1b83054c568d2322a95e217fdc281bc3"
},
{
"url": "https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087"
},
{
"url": "https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e"
},
{
"url": "https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75"
}
],
"title": "bpf: Mark bpf_refcount field as unique",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100074",
"datePublished": "2026-09-25T13:06:46.777Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-10-21T12:38:46.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93251 (GCVE-0-2026-93251)
Vulnerability from cvelistv5
Published
2026-09-24 15:51
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: bus: Introduce acpi_bus_get_primary_device()
The function used for obtaining the first "physical" device for which
the given ACPI one is the ACPI companion, acpi_get_first_physical_node(),
may return a stale device pointer (mostly in theory) because
acpi_unbind_one() may run as a whole after dropping the ACPI device's
physical_node_lock in acpi_get_first_physical_node() and before it
returns. The last reference to the "physical" device may be dropped
then before the pointer to it is returned to the caller.
If that happens and the acpi_get_first_physical_node() caller invokes
get_device() on the pointer obtained from it, which is done by the
majority of its callers, a use-after-free will occur.
To prepare for addressing this problem, introduce a new function for
getting the first "physical" device associated with the given ACPI one
(the "primary physical device") that will also reference count the
device in question before returning a pointer to it.
Make that new function and acpi_get_first_physical_node() share the
physical node list lookup code.
No intentional functional impact.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 91e5687805885f9fceb60b95e950a3d3bdcf4764 Version: 91e5687805885f9fceb60b95e950a3d3bdcf4764 Version: 91e5687805885f9fceb60b95e950a3d3bdcf4764 Version: 91e5687805885f9fceb60b95e950a3d3bdcf4764 Version: 91e5687805885f9fceb60b95e950a3d3bdcf4764 Version: 91e5687805885f9fceb60b95e950a3d3bdcf4764 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/bus.c",
"include/acpi/acpi_bus.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f912f88126e385f6cfcd1a28de73afb7d3943c8d",
"status": "affected",
"version": "91e5687805885f9fceb60b95e950a3d3bdcf4764",
"versionType": "git"
},
{
"lessThan": "50ddd82b88b1d1cc467b5df953344c1a9feec268",
"status": "affected",
"version": "91e5687805885f9fceb60b95e950a3d3bdcf4764",
"versionType": "git"
},
{
"lessThan": "fd4f907b558721716da30acd6630191acf811b95",
"status": "affected",
"version": "91e5687805885f9fceb60b95e950a3d3bdcf4764",
"versionType": "git"
},
{
"lessThan": "ebdd932dc24c1cf7cc31710b7730515e4e66d886",
"status": "affected",
"version": "91e5687805885f9fceb60b95e950a3d3bdcf4764",
"versionType": "git"
},
{
"lessThan": "5657859851abb65105220a6cdb5804926249f714",
"status": "affected",
"version": "91e5687805885f9fceb60b95e950a3d3bdcf4764",
"versionType": "git"
},
{
"lessThan": "72530e1f72b0515a73fd88292254d04fecf03649",
"status": "affected",
"version": "91e5687805885f9fceb60b95e950a3d3bdcf4764",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/bus.c",
"include/acpi/acpi_bus.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: bus: Introduce acpi_bus_get_primary_device()\n\nThe function used for obtaining the first \"physical\" device for which\nthe given ACPI one is the ACPI companion, acpi_get_first_physical_node(),\nmay return a stale device pointer (mostly in theory) because\nacpi_unbind_one() may run as a whole after dropping the ACPI device\u0027s\nphysical_node_lock in acpi_get_first_physical_node() and before it\nreturns. The last reference to the \"physical\" device may be dropped\nthen before the pointer to it is returned to the caller.\n\nIf that happens and the acpi_get_first_physical_node() caller invokes\nget_device() on the pointer obtained from it, which is done by the\nmajority of its callers, a use-after-free will occur.\n\nTo prepare for addressing this problem, introduce a new function for\ngetting the first \"physical\" device associated with the given ACPI one\n(the \"primary physical device\") that will also reference count the\ndevice in question before returning a pointer to it.\n\nMake that new function and acpi_get_first_physical_node() share the\nphysical node list lookup code.\n\nNo intentional functional impact."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:32.328Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f912f88126e385f6cfcd1a28de73afb7d3943c8d"
},
{
"url": "https://git.kernel.org/stable/c/50ddd82b88b1d1cc467b5df953344c1a9feec268"
},
{
"url": "https://git.kernel.org/stable/c/fd4f907b558721716da30acd6630191acf811b95"
},
{
"url": "https://git.kernel.org/stable/c/ebdd932dc24c1cf7cc31710b7730515e4e66d886"
},
{
"url": "https://git.kernel.org/stable/c/5657859851abb65105220a6cdb5804926249f714"
},
{
"url": "https://git.kernel.org/stable/c/72530e1f72b0515a73fd88292254d04fecf03649"
}
],
"title": "ACPI: bus: Introduce acpi_bus_get_primary_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93251",
"datePublished": "2026-09-24T15:51:27.511Z",
"dateReserved": "2026-09-17T16:02:15.096Z",
"dateUpdated": "2026-10-30T12:36:32.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72288 (GCVE-0-2026-72288)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Hyunwoo Kim reports some really bad races should the following
situation occur:
- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to vcpu-B's RD to disable its LPIs
- vcpu-C moves I from B to C
If the last two race nicely enough, vgic_prune_ap_list() can drop
the irq and AP list locks, reacquire them, and in the interval
the irq has been freed. UAF follows.
The fix is two-fold:
- Before dropping the irq and ap_list locks, take a reference on
the irq
- Do not try to handle migration of the pending bit: there is no
expectation that this state is retained, as per the architecture
With that, we're sure that the interrupt is still around, and we
safely remove it from the AP list as it has no target at this
stage (unless another interrupt fires, but that's another story).
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5dd4b924e390af426e424d5e52c1b4d1566af817 Version: 5dd4b924e390af426e424d5e52c1b4d1566af817 Version: 5dd4b924e390af426e424d5e52c1b4d1566af817 Version: 5dd4b924e390af426e424d5e52c1b4d1566af817 Version: 5dd4b924e390af426e424d5e52c1b4d1566af817 Version: 5dd4b924e390af426e424d5e52c1b4d1566af817 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:49.610829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7328cff91703ac4e93c200b20cebaa36d2f314ed",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "eb74f3feb68e64cf69f86cb806a15d8cfb6757f4",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "77c61235d66246dd6a5f55587f0afc273d832775",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "d19dca8194ebed371e624331c6be2cb73b562caf",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "b1a89d12d35a8256d2b170ced0b1c86851f3def2",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "7258770e5814f15e8308ebda82ac9acf6964ba8e",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling\n\nHyunwoo Kim reports some really bad races should the following\nsituation occur:\n\n- LPI-I is pending in vcpu-B\u0027s AP list\n- vcpu-A writes to vcpu-B\u0027s RD to disable its LPIs\n- vcpu-C moves I from B to C\n\nIf the last two race nicely enough, vgic_prune_ap_list() can drop\nthe irq and AP list locks, reacquire them, and in the interval\nthe irq has been freed. UAF follows.\n\nThe fix is two-fold:\n\n- Before dropping the irq and ap_list locks, take a reference on\n the irq\n\n- Do not try to handle migration of the pending bit: there is no\n expectation that this state is retained, as per the architecture\n\nWith that, we\u0027re sure that the interrupt is still around, and we\nsafely remove it from the AP list as it has no target at this\nstage (unless another interrupt fires, but that\u0027s another story)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:00.768Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7328cff91703ac4e93c200b20cebaa36d2f314ed"
},
{
"url": "https://git.kernel.org/stable/c/eb74f3feb68e64cf69f86cb806a15d8cfb6757f4"
},
{
"url": "https://git.kernel.org/stable/c/77c61235d66246dd6a5f55587f0afc273d832775"
},
{
"url": "https://git.kernel.org/stable/c/d19dca8194ebed371e624331c6be2cb73b562caf"
},
{
"url": "https://git.kernel.org/stable/c/b1a89d12d35a8256d2b170ced0b1c86851f3def2"
},
{
"url": "https://git.kernel.org/stable/c/7258770e5814f15e8308ebda82ac9acf6964ba8e"
}
],
"title": "KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72288",
"datePublished": "2026-08-15T05:55:10.256Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-30T12:29:00.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80866 (GCVE-0-2026-80866)
Vulnerability from cvelistv5
Published
2026-09-04 16:48
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: avoid busy looping in tipc_exit_net()
Blamed commit introduced a busy-wait loop in tipc_exit_net()
to wait for pending UDP bearer cleanup works to complete:
while (atomic_read(&tn->wq_count))
cond_resched();
This loop can busy-wait for a long time if cond_resched() is a NOP. This
typically happens if the netns exit is executed by a high priority task,
or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In
such cases, it wastes CPU cycles and can lead to soft lockups.
Fix this by replacing the busy loop with wait_var_event(), allowing the
thread to sleep properly until the work queue count reaches zero.
Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and
wake_up_var() to wake up the waiter when the count drops to zero.
This uses the global wait queue hash table, avoiding the need to bloat
struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test()
provides the necessary memory barrier to ensure the wakeup is not missed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 04c26faa51d1e2fe71cf13c45791f5174c37f986 Version: 04c26faa51d1e2fe71cf13c45791f5174c37f986 Version: 04c26faa51d1e2fe71cf13c45791f5174c37f986 Version: 04c26faa51d1e2fe71cf13c45791f5174c37f986 Version: 04c26faa51d1e2fe71cf13c45791f5174c37f986 Version: 04c26faa51d1e2fe71cf13c45791f5174c37f986 Version: d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa Version: 5195ec5e365a2a9331bfeb585b613a6e94f98dba Version: b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d Version: 5.4.124 ≤ Version: 5.10.42 ≤ Version: 5.12.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/udp_media.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "772769859226a5b004442403510acb58a1c32e72",
"status": "affected",
"version": "04c26faa51d1e2fe71cf13c45791f5174c37f986",
"versionType": "git"
},
{
"lessThan": "99b82c8452887408ea908fdfa5df33c4a5dfa88f",
"status": "affected",
"version": "04c26faa51d1e2fe71cf13c45791f5174c37f986",
"versionType": "git"
},
{
"lessThan": "110bb16d37bdba03213156c0df37e7119c190936",
"status": "affected",
"version": "04c26faa51d1e2fe71cf13c45791f5174c37f986",
"versionType": "git"
},
{
"lessThan": "7672973957e3e20780afe5937a9fec70b72bc060",
"status": "affected",
"version": "04c26faa51d1e2fe71cf13c45791f5174c37f986",
"versionType": "git"
},
{
"lessThan": "522d1d950b9e3b68190a6de7534827c8dccedb73",
"status": "affected",
"version": "04c26faa51d1e2fe71cf13c45791f5174c37f986",
"versionType": "git"
},
{
"lessThan": "c1481c94e74c955e0448ddf46b8615a44d840c1e",
"status": "affected",
"version": "04c26faa51d1e2fe71cf13c45791f5174c37f986",
"versionType": "git"
},
{
"status": "affected",
"version": "d1f76dfadaf8f47ed1753f97dbcbd41c16215ffa",
"versionType": "git"
},
{
"status": "affected",
"version": "5195ec5e365a2a9331bfeb585b613a6e94f98dba",
"versionType": "git"
},
{
"status": "affected",
"version": "b9f5b7ad4ac3af006443f535b1ce7bff1d130d7d",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.124",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.42",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/udp_media.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: avoid busy looping in tipc_exit_net()\n\nBlamed commit introduced a busy-wait loop in tipc_exit_net()\nto wait for pending UDP bearer cleanup works to complete:\n\n while (atomic_read(\u0026tn-\u003ewq_count))\n cond_resched();\n\nThis loop can busy-wait for a long time if cond_resched() is a NOP. This\ntypically happens if the netns exit is executed by a high priority task,\nor under kernels configured without preemption (CONFIG_PREEMPT_NONE). In\nsuch cases, it wastes CPU cycles and can lead to soft lockups.\n\nFix this by replacing the busy loop with wait_var_event(), allowing the\nthread to sleep properly until the work queue count reaches zero.\n\nAccordingly, update cleanup_bearer() to use atomic_dec_and_test() and\nwake_up_var() to wake up the waiter when the count drops to zero.\n\nThis uses the global wait queue hash table, avoiding the need to bloat\nstruct tipc_net with a wait_queue_head_t. The atomic_dec_and_test()\nprovides the necessary memory barrier to ensure the wakeup is not missed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:21.261Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/772769859226a5b004442403510acb58a1c32e72"
},
{
"url": "https://git.kernel.org/stable/c/99b82c8452887408ea908fdfa5df33c4a5dfa88f"
},
{
"url": "https://git.kernel.org/stable/c/110bb16d37bdba03213156c0df37e7119c190936"
},
{
"url": "https://git.kernel.org/stable/c/7672973957e3e20780afe5937a9fec70b72bc060"
},
{
"url": "https://git.kernel.org/stable/c/522d1d950b9e3b68190a6de7534827c8dccedb73"
},
{
"url": "https://git.kernel.org/stable/c/c1481c94e74c955e0448ddf46b8615a44d840c1e"
}
],
"title": "tipc: avoid busy looping in tipc_exit_net()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80866",
"datePublished": "2026-09-04T16:48:11.682Z",
"dateReserved": "2026-08-26T14:34:25.798Z",
"dateUpdated": "2026-10-30T12:31:21.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53104 (GCVE-0-2026-53104)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-11-06 16:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: Fix memory leak destroying device
All MT76 rx queues have an associated page_pool even if the queue is not
associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the
page_pool running mt76_dma_cleanup routine during module unload.
Moreover returns pages to the page pool if WED is not enabled for WED RRO
queues.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53104",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:18:44.375596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:24:00.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c363fc4dbdb77a3f02dcf6ba90c1f0a111ef055",
"status": "affected",
"version": "950d0abb5cd94f2b0710c5c42ac4398c91a7ff22",
"versionType": "git"
},
{
"lessThan": "dcbc13d19bef3326c72f324b10f5a3e5fc4d71de",
"status": "affected",
"version": "950d0abb5cd94f2b0710c5c42ac4398c91a7ff22",
"versionType": "git"
},
{
"lessThan": "4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f",
"status": "affected",
"version": "950d0abb5cd94f2b0710c5c42ac4398c91a7ff22",
"versionType": "git"
},
{
"lessThan": "6b470f36616e3448d44b0ef4b1de2a3e3a31b5be",
"status": "affected",
"version": "950d0abb5cd94f2b0710c5c42ac4398c91a7ff22",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: Fix memory leak destroying device\n\nAll MT76 rx queues have an associated page_pool even if the queue is not\nassociated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the\npage_pool running mt76_dma_cleanup routine during module unload.\nMoreover returns pages to the page pool if WED is not enabled for WED RRO\nqueues."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:00.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c363fc4dbdb77a3f02dcf6ba90c1f0a111ef055"
},
{
"url": "https://git.kernel.org/stable/c/dcbc13d19bef3326c72f324b10f5a3e5fc4d71de"
},
{
"url": "https://git.kernel.org/stable/c/4b7c92fd8b8700fac387ff43c6f6e0c4e05ec93f"
},
{
"url": "https://git.kernel.org/stable/c/6b470f36616e3448d44b0ef4b1de2a3e3a31b5be"
}
],
"title": "wifi: mt76: Fix memory leak destroying device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53104",
"datePublished": "2026-06-24T16:30:39.844Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-11-06T16:24:00.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38261 (GCVE-0-2025-38261)
Vulnerability from cvelistv5
Published
2025-07-09 10:42
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: save the SR_SUM status over switches
When threads/tasks are switched we need to ensure the old execution's
SR_SUM state is saved and the new thread has the old SR_SUM state
restored.
The issue was seen under heavy load especially with the syz-stress tool
running, with crashes as follows in schedule_tail:
Unable to handle kernel access to user memory without uaccess routines
at virtual address 000000002749f0d0
Oops [#1]
Modules linked in:
CPU: 1 PID: 4875 Comm: syz-executor.0 Not tainted
5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0
Hardware name: riscv-virtio,qemu (DT)
epc : schedule_tail+0x72/0xb2 kernel/sched/core.c:4264
ra : task_pid_vnr include/linux/sched.h:1421 [inline]
ra : schedule_tail+0x70/0xb2 kernel/sched/core.c:4264
epc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp : ffffffe025d17ec0
gp : ffffffe005d25378 tp : ffffffe00f0d0000 t0 : 0000000000000000
t1 : 0000000000000001 t2 : 00000000000f4240 s0 : ffffffe025d17ee0
s1 : 000000002749f0d0 a0 : 000000000000002a a1 : 0000000000000003
a2 : 1ffffffc0cfac500 a3 : ffffffe0000c80cc a4 : 5ae9db91c19bbe00
a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffe000082eba
s2 : 0000000000040000 s3 : ffffffe00eef96c0 s4 : ffffffe022c77fe0
s5 : 0000000000004000 s6 : ffffffe067d74e00 s7 : ffffffe067d74850
s8 : ffffffe067d73e18 s9 : ffffffe067d74e00 s10: ffffffe00eef96e8
s11: 000000ae6cdf8368 t3 : 5ae9db91c19bbe00 t4 : ffffffc4043cafb2
t5 : ffffffc4043cafba t6 : 0000000000040000
status: 0000000000000120 badaddr: 000000002749f0d0 cause:
000000000000000f
Call Trace:
[<ffffffe00008c8b0>] schedule_tail+0x72/0xb2 kernel/sched/core.c:4264
[<ffffffe000005570>] ret_from_exception+0x0/0x14
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace b5f8f9231dc87dda ]---
The issue comes from the put_user() in schedule_tail
(kernel/sched/core.c) doing the following:
asmlinkage __visible void schedule_tail(struct task_struct *prev)
{
...
if (current->set_child_tid)
put_user(task_pid_vnr(current), current->set_child_tid);
...
}
the put_user() macro causes the code sequence to come out as follows:
1: __enable_user_access()
2: reg = task_pid_vnr(current);
3: *current->set_child_tid = reg;
4: __disable_user_access()
The problem is that we may have a sleeping function as argument which
could clear SR_SUM causing the panic above. This was fixed by
evaluating the argument of the put_user() macro outside the user-enabled
section in commit 285a76bb2cf5 ("riscv: evaluate put_user() arg before
enabling user access")"
In order for riscv to take advantage of unsafe_get/put_XXX() macros and
to avoid the same issue we had with put_user() and sleeping functions we
must ensure code flow can go through switch_to() from within a region of
code with SR_SUM enabled and come back with SR_SUM still enabled. This
patch addresses the problem allowing future work to enable full use of
unsafe_get/put_XXX() macros without needing to take a CSR bit flip cost
on every access. Make switch_to() save and restore SR_SUM.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/include/asm/processor.h",
"arch/riscv/kernel/asm-offsets.c",
"arch/riscv/kernel/entry.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c75dc906eef2a31c18318236f1047c6e0ef4e9dd",
"status": "affected",
"version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446",
"versionType": "git"
},
{
"lessThan": "1b63cdc0d63ae33522b4714642fbefa298acc274",
"status": "affected",
"version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446",
"versionType": "git"
},
{
"lessThan": "9e7005c3638134df5b7df467c1d884a2482c77cb",
"status": "affected",
"version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446",
"versionType": "git"
},
{
"lessThan": "69ea599a8dab93a620c92c255be4239a06290a77",
"status": "affected",
"version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446",
"versionType": "git"
},
{
"lessThan": "788aa64c01f1262310b4c1fb827a36df170d86ea",
"status": "affected",
"version": "76d2a0493a17d4c8ecc781366850c3c4f8e1a446",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/include/asm/processor.h",
"arch/riscv/kernel/asm-offsets.c",
"arch/riscv/kernel/entry.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.5",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: save the SR_SUM status over switches\n\nWhen threads/tasks are switched we need to ensure the old execution\u0027s\nSR_SUM state is saved and the new thread has the old SR_SUM state\nrestored.\n\nThe issue was seen under heavy load especially with the syz-stress tool\nrunning, with crashes as follows in schedule_tail:\n\nUnable to handle kernel access to user memory without uaccess routines\nat virtual address 000000002749f0d0\nOops [#1]\nModules linked in:\nCPU: 1 PID: 4875 Comm: syz-executor.0 Not tainted\n5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0\nHardware name: riscv-virtio,qemu (DT)\nepc : schedule_tail+0x72/0xb2 kernel/sched/core.c:4264\n ra : task_pid_vnr include/linux/sched.h:1421 [inline]\n ra : schedule_tail+0x70/0xb2 kernel/sched/core.c:4264\nepc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp : ffffffe025d17ec0\n gp : ffffffe005d25378 tp : ffffffe00f0d0000 t0 : 0000000000000000\n t1 : 0000000000000001 t2 : 00000000000f4240 s0 : ffffffe025d17ee0\n s1 : 000000002749f0d0 a0 : 000000000000002a a1 : 0000000000000003\n a2 : 1ffffffc0cfac500 a3 : ffffffe0000c80cc a4 : 5ae9db91c19bbe00\n a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffe000082eba\n s2 : 0000000000040000 s3 : ffffffe00eef96c0 s4 : ffffffe022c77fe0\n s5 : 0000000000004000 s6 : ffffffe067d74e00 s7 : ffffffe067d74850\n s8 : ffffffe067d73e18 s9 : ffffffe067d74e00 s10: ffffffe00eef96e8\n s11: 000000ae6cdf8368 t3 : 5ae9db91c19bbe00 t4 : ffffffc4043cafb2\n t5 : ffffffc4043cafba t6 : 0000000000040000\nstatus: 0000000000000120 badaddr: 000000002749f0d0 cause:\n000000000000000f\nCall Trace:\n[\u003cffffffe00008c8b0\u003e] schedule_tail+0x72/0xb2 kernel/sched/core.c:4264\n[\u003cffffffe000005570\u003e] ret_from_exception+0x0/0x14\nDumping ftrace buffer:\n (ftrace buffer empty)\n---[ end trace b5f8f9231dc87dda ]---\n\nThe issue comes from the put_user() in schedule_tail\n(kernel/sched/core.c) doing the following:\n\nasmlinkage __visible void schedule_tail(struct task_struct *prev)\n{\n...\n if (current-\u003eset_child_tid)\n put_user(task_pid_vnr(current), current-\u003eset_child_tid);\n...\n}\n\nthe put_user() macro causes the code sequence to come out as follows:\n\n1:\t__enable_user_access()\n2:\treg = task_pid_vnr(current);\n3:\t*current-\u003eset_child_tid = reg;\n4:\t__disable_user_access()\n\nThe problem is that we may have a sleeping function as argument which\ncould clear SR_SUM causing the panic above. This was fixed by\nevaluating the argument of the put_user() macro outside the user-enabled\nsection in commit 285a76bb2cf5 (\"riscv: evaluate put_user() arg before\nenabling user access\")\"\n\nIn order for riscv to take advantage of unsafe_get/put_XXX() macros and\nto avoid the same issue we had with put_user() and sleeping functions we\nmust ensure code flow can go through switch_to() from within a region of\ncode with SR_SUM enabled and come back with SR_SUM still enabled. This\npatch addresses the problem allowing future work to enable full use of\nunsafe_get/put_XXX() macros without needing to take a CSR bit flip cost\non every access. Make switch_to() save and restore SR_SUM."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is the RISC-V context switch, reached only by executing code on the machine \u2014 ordinary syscalls such as clone(), read()/write() with partially-mapped buffers, or futex operations. There is no network-facing path to __switch_to.\nAC:L - The attacker controls both sides of the race: an unprivileged process can pin threads to a single CPU with sched_setaffinity and drive clone()/uaccess-heavy syscalls to force a context switch inside a SUM-enabled window, which is exactly the syz-stress workload that produced the reported oops. No condition depends on state outside the attacker\u0027s influence.\nPR:L - Only the ability to run unprivileged code is needed \u2014 the trigger paths (fork/clone reaching schedule_tail\u0027s put_user, copy_to_user/copy_from_user, futex) are available to any user with no capability, namespace, or filesystem gate. The original reporter\u0027s syz-executor process hit it as a plain unprivileged task.\nUI:N - The attacker triggers the condition entirely through their own syscalls and scheduling pressure. No victim action, mount, or file open is required.\nS:U - Both the vulnerable component and the impacted component are the kernel itself; although SUM leaks across task contexts, that remains within a single security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - A stale SR_SUM left set means kernel code in an unrelated task executes with S-mode access to U-mode pages enabled \u2014 the RISC-V SMAP equivalent disabled \u2014 which the maintainers explicitly labelled a vulnerability in the sibling fix c08b4848f596. Combined with attacker-controlled user mappings this yields an arbitrary kernel-side read primitive against attacker-authored data.\nI:H - The same protection bypass is symmetric: with SUM erroneously set, kernel stores to user-range addresses succeed silently, giving a write primitive that converts any kernel wild/NULL pointer dereference into controlled memory corruption and privilege escalation.\nA:H - The opposite direction \u2014 resuming with SUM unexpectedly cleared inside a uaccess window \u2014 reaches die_kernel_fault(\"access to user memory without uaccess routines\") in arch/riscv/mm/fault.c, the exact schedule_tail oops in the report. Dying in the scheduler tail destabilises the runqueue, and with panic_on_oops set it is an outright kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:52.117Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c75dc906eef2a31c18318236f1047c6e0ef4e9dd"
},
{
"url": "https://git.kernel.org/stable/c/1b63cdc0d63ae33522b4714642fbefa298acc274"
},
{
"url": "https://git.kernel.org/stable/c/9e7005c3638134df5b7df467c1d884a2482c77cb"
},
{
"url": "https://git.kernel.org/stable/c/69ea599a8dab93a620c92c255be4239a06290a77"
},
{
"url": "https://git.kernel.org/stable/c/788aa64c01f1262310b4c1fb827a36df170d86ea"
}
],
"title": "riscv: save the SR_SUM status over switches",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38261",
"datePublished": "2025-07-09T10:42:36.810Z",
"dateReserved": "2025-04-16T04:51:23.997Z",
"dateUpdated": "2026-10-30T12:21:52.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92480 (GCVE-0-2026-92480)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Validate string descriptors
The string descriptor length includes a two-byte header while the UTF-16
payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code
units, not bytes. Passing the payload byte count can make it read beyond
the descriptor buffer.
Validate that the payload has an even byte count, pass a code-unit count to
the converter, and allocate sufficient UTF-8 output space.
The raw string buffer starts after the descriptor header but its size is
bLength. Copying bLength bytes from that pointer can read beyond the
response buffer.
Allocate a zeroed bLength-sized buffer and copy only the UTF-16
payload. This preserves the raw buffer size consumed by the RPMB device-ID
ABI while avoiding the overread.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4b828fe156a662a4b6135019bf077040340f299b Version: 4b828fe156a662a4b6135019bf077040340f299b Version: 4b828fe156a662a4b6135019bf077040340f299b Version: 4b828fe156a662a4b6135019bf077040340f299b Version: 4b828fe156a662a4b6135019bf077040340f299b Version: 4b828fe156a662a4b6135019bf077040340f299b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22c076f72ad67d89dab58d9c97a17c33e8130e82",
"status": "affected",
"version": "4b828fe156a662a4b6135019bf077040340f299b",
"versionType": "git"
},
{
"lessThan": "566109f1ee4e389b4effab43b0ce1fdab302e9de",
"status": "affected",
"version": "4b828fe156a662a4b6135019bf077040340f299b",
"versionType": "git"
},
{
"lessThan": "02dd1a65dff842d9360a38ebe243dc8f6adbbaf5",
"status": "affected",
"version": "4b828fe156a662a4b6135019bf077040340f299b",
"versionType": "git"
},
{
"lessThan": "f3480c59f4ce97d831e9d06f5a2b9c20547ed1a4",
"status": "affected",
"version": "4b828fe156a662a4b6135019bf077040340f299b",
"versionType": "git"
},
{
"lessThan": "66da25277256b6bf4c3fdbf3c9bfd43324c9cf25",
"status": "affected",
"version": "4b828fe156a662a4b6135019bf077040340f299b",
"versionType": "git"
},
{
"lessThan": "d96e83d028d7d8762e424e49c671d49ac2ecf14f",
"status": "affected",
"version": "4b828fe156a662a4b6135019bf077040340f299b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Validate string descriptors\n\nThe string descriptor length includes a two-byte header while the UTF-16\npayload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code\nunits, not bytes. Passing the payload byte count can make it read beyond\nthe descriptor buffer.\n\nValidate that the payload has an even byte count, pass a code-unit count to\nthe converter, and allocate sufficient UTF-8 output space.\n\nThe raw string buffer starts after the descriptor header but its size is\nbLength. Copying bLength bytes from that pointer can read beyond the\nresponse buffer.\n\nAllocate a zeroed bLength-sized buffer and copy only the UTF-16\npayload. This preserves the raw buffer size consumed by the RPMB device-ID\nABI while avoiding the overread."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:36.682Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22c076f72ad67d89dab58d9c97a17c33e8130e82"
},
{
"url": "https://git.kernel.org/stable/c/566109f1ee4e389b4effab43b0ce1fdab302e9de"
},
{
"url": "https://git.kernel.org/stable/c/02dd1a65dff842d9360a38ebe243dc8f6adbbaf5"
},
{
"url": "https://git.kernel.org/stable/c/f3480c59f4ce97d831e9d06f5a2b9c20547ed1a4"
},
{
"url": "https://git.kernel.org/stable/c/66da25277256b6bf4c3fdbf3c9bfd43324c9cf25"
},
{
"url": "https://git.kernel.org/stable/c/d96e83d028d7d8762e424e49c671d49ac2ecf14f"
}
],
"title": "scsi: ufs: core: Validate string descriptors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-92480",
"datePublished": "2026-09-17T16:09:57.719Z",
"dateReserved": "2026-09-16T12:21:13.870Z",
"dateUpdated": "2026-10-30T12:35:36.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99153 (GCVE-0-2026-99153)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
A Reject PDU carries a copy of the header it rejects, and
iscsi_handle_reject() takes the ITT out of that copy to find the task to
clean up:
memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr));
...
task = iscsi_itt_to_task(conn, rejected_pdu.itt);
That value is whatever the target put there. iscsi_itt_to_task() bounds
the index against cmds_max and checks nothing else, so any task in the
pool can be named, and iscsi_nop_out_rsp() then completes it.
An index that has never been used gives a NULL task->conn: the pool is
zeroed at session setup and conn is assigned only when a task is
allocated. If the task was used and returned, iscsi_complete_task() hits
its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount
underflows. An in-flight SCSI command is completed as successful - a 1
MiB read returned 1048576 with none of its buffer written and no
warning.
Validate the reflected ITT the way iscsi_itt_to_ctask() validates a
command ITT, and require the task to be in flight and not a SCSI
command.
[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
[ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
[ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160
[ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00
[ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206
[ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25
[ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060
[ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504
[ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000
[ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000
[ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000
[ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0
[ 6.255439] PKRU: 55555554
[ 6.255564] Call Trace:
[ 6.255674] <IRQ>
[ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0
[ 6.256733] iscsi_complete_pdu+0x54/0xa0
[ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250
[ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0
[ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390
[ 6.258061] __tcp_read_sock+0x1ab/0x810
[ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510
[ 6.259808] tcp_data_queue+0x1f13/0x4cd0
[ 6.260567] tcp_rcv_established+0x8a5/0x3a00
[ 6.261931] tcp_v4_do_rcv+0x449/0x960
[ 6.262269] tcp_v4_rcv+0x2245/0x3bc0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de Version: 8afa1439fcff58da8f28c1d083046f229f6ab3de |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3637a4ad1d07477f1c60609876da6b60154d224b",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "21ef746340ce246344f34278e205b8960c1d8874",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "d20583a9dbe0d32a9af8384c857c95c0fc115103",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "ebb8c5ef2aabf66895253600e8390e8fc7094807",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "576125e7382a7826bd6c3c1ca4d9c582ed5be21d",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "7215a69b6456fda79c0935c2959045dff3fcaac8",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
},
{
"lessThan": "c5958c770b2a0ee492414e26b07da9164a0d1f5d",
"status": "affected",
"version": "8afa1439fcff58da8f28c1d083046f229f6ab3de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the ITT reflected in a Reject PDU\n\nA Reject PDU carries a copy of the header it rejects, and\niscsi_handle_reject() takes the ITT out of that copy to find the task to\nclean up:\n\n memcpy(\u0026rejected_pdu, data, sizeof(struct iscsi_hdr));\n ...\n task = iscsi_itt_to_task(conn, rejected_pdu.itt);\n\nThat value is whatever the target put there. iscsi_itt_to_task() bounds\nthe index against cmds_max and checks nothing else, so any task in the\npool can be named, and iscsi_nop_out_rsp() then completes it.\n\nAn index that has never been used gives a NULL task-\u003econn: the pool is\nzeroed at session setup and conn is assigned only when a task is\nallocated. If the task was used and returned, iscsi_complete_task() hits\nits WARN_ON_ONCE(task-\u003estate == ISCSI_TASK_FREE) and the refcount\nunderflows. An in-flight SCSI command is completed as successful - a 1\nMiB read returned 1048576 with none of its buffer written and no\nwarning.\n\nValidate the reflected ITT the way iscsi_itt_to_ctask() validates a\ncommand ITT, and require the task to be in flight and not a SCSI\ncommand.\n\n[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206\n[ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25\n[ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060\n[ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504\n[ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000\n[ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000\n[ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000\n[ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0\n[ 6.255439] PKRU: 55555554\n[ 6.255564] Call Trace:\n[ 6.255674] \u003cIRQ\u003e\n[ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0\n[ 6.256733] iscsi_complete_pdu+0x54/0xa0\n[ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250\n[ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0\n[ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390\n[ 6.258061] __tcp_read_sock+0x1ab/0x810\n[ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510\n[ 6.259808] tcp_data_queue+0x1f13/0x4cd0\n[ 6.260567] tcp_rcv_established+0x8a5/0x3a00\n[ 6.261931] tcp_v4_do_rcv+0x449/0x960\n[ 6.262269] tcp_v4_rcv+0x2245/0x3bc0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A target-supplied ISCSI_OP_REJECT traverses iscsi_sw_tcp_data_ready(), iscsi_tcp_recv_skb(), iscsi_tcp_data_recv_done(), iscsi_complete_pdu(), and __iscsi_complete_pdu() to the patched iscsi_handle_reject(); the forged NOOP_OUT ITT is carried in the Reject PDU data over routable TCP.\nAC:L - The target sees live SCSI ITTs in initiator commands and can withhold their responses before naming one in a forged Reject; alternatively, index 1 in a freshly bound kzalloc\u0027ed pool deterministically has task-\u003econn == NULL. No race or uncontrolled condition is required.\nPR:N - iscsi_sw_tcp_conn_bind() installs receive callbacks before iscsi_conn_start() marks the session logged in, while __iscsi_complete_pdu() and iscsi_handle_reject() impose no login-state or authentication check on Reject PDUs. A target can therefore trigger the crash during login without credentials.\nUI:N - Once a configured initiator binds or automatically reconnects its iSCSI socket, the target\u0027s Reject is processed directly by iscsi_sw_tcp_data_ready(); selecting an unused task slot requires no victim read, mount, or other action.\nS:U - iscsi_handle_reject() corrupts task completion state or faults within the initiator host kernel; it does not cross a VM, IOMMU, or separate security-authority boundary.\nC:H - For a READ ITT, iscsi_nop_out_rsp() reaches iscsi_complete_task() and scsi_done() with sc-\u003eresult still zero despite no Data-In; non-zeroed page-cache folios can consequently be marked uptodate and exposed as valid data, with the commit demonstrating a 1 MiB untouched read.\nI:H - The unchecked ITT lets iscsi_nop_out_rsp() falsely complete any observed in-flight SCSI task successfully; untouched READ buffers become valid filesystem data and WRITE commands can be acknowledged without commitment, permitting silent persistent storage or filesystem corruption.\nA:H - Selecting a never-used pool slot returns a task whose kzalloc\u0027ed task-\u003econn is NULL, which iscsi_nop_out_rsp() dereferences; the commit records the resulting general-protection fault, so one crafted Reject can oops or panic the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:04.972Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b"
},
{
"url": "https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874"
},
{
"url": "https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103"
},
{
"url": "https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807"
},
{
"url": "https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d"
},
{
"url": "https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8"
},
{
"url": "https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a"
},
{
"url": "https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d"
}
],
"title": "scsi: libiscsi: Validate the ITT reflected in a Reject PDU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99153",
"datePublished": "2026-10-28T10:35:08.287Z",
"dateReserved": "2026-09-25T10:25:14.396Z",
"dateUpdated": "2026-10-31T12:44:04.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40113 (GCVE-0-2025-40113)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E
The ADSP firmware on X1E has separate firmware binaries for the main
firmware and the DTB. The same applies for the "lite" firmware loaded by
the boot firmware.
When preparing to load the new ADSP firmware we shutdown the lite_pas_id
for the main firmware, but we don't shutdown the corresponding lite pas_id
for the DTB. The fact that we're leaving it "running" forever becomes
obvious if you try to reuse (or just access) the memory region used by the
"lite" firmware: The &adsp_boot_mem is accessible, but accessing the
&adsp_boot_dtb_mem results in a crash.
We don't support reusing the memory regions currently, but nevertheless we
should not keep part of the lite firmware running. Fix this by adding the
lite_dtb_pas_id and shutting it down as well.
We don't have a way to detect if the lite firmware is actually running yet,
so ignore the return status of qcom_scm_pas_shutdown() for now. This was
already the case before, the assignment to "ret" is not used anywhere.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/qcom_q6v5_pas.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce536b90fc6a32629577f81db333f39ebacef0cb",
"status": "affected",
"version": "62210f7509e13a2caa7b080722a45229b8f17a0a",
"versionType": "git"
},
{
"lessThan": "ee150acd273aded01a726ce39b1f6128200799e6",
"status": "affected",
"version": "62210f7509e13a2caa7b080722a45229b8f17a0a",
"versionType": "git"
},
{
"lessThan": "142964960c7c35de5c5f7bdd61c32699de693630",
"status": "affected",
"version": "62210f7509e13a2caa7b080722a45229b8f17a0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/qcom_q6v5_pas.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E\n\nThe ADSP firmware on X1E has separate firmware binaries for the main\nfirmware and the DTB. The same applies for the \"lite\" firmware loaded by\nthe boot firmware.\n\nWhen preparing to load the new ADSP firmware we shutdown the lite_pas_id\nfor the main firmware, but we don\u0027t shutdown the corresponding lite pas_id\nfor the DTB. The fact that we\u0027re leaving it \"running\" forever becomes\nobvious if you try to reuse (or just access) the memory region used by the\n\"lite\" firmware: The \u0026adsp_boot_mem is accessible, but accessing the\n\u0026adsp_boot_dtb_mem results in a crash.\n\nWe don\u0027t support reusing the memory regions currently, but nevertheless we\nshould not keep part of the lite firmware running. Fix this by adding the\nlite_dtb_pas_id and shutting it down as well.\n\nWe don\u0027t have a way to detect if the lite firmware is actually running yet,\nso ignore the return status of qcom_scm_pas_shutdown() for now. This was\nalready the case before, the assignment to \"ret\" is not used anywhere."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:47.506Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce536b90fc6a32629577f81db333f39ebacef0cb"
},
{
"url": "https://git.kernel.org/stable/c/ee150acd273aded01a726ce39b1f6128200799e6"
},
{
"url": "https://git.kernel.org/stable/c/142964960c7c35de5c5f7bdd61c32699de693630"
}
],
"title": "remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40113",
"datePublished": "2025-11-12T10:23:16.992Z",
"dateReserved": "2025-04-16T07:20:57.168Z",
"dateUpdated": "2026-10-21T12:37:47.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97513 (GCVE-0-2026-97513)
Vulnerability from cvelistv5
Published
2026-09-24 16:05
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
Possible use after free if IRQ thread manages to obtain spinlock between
m2m_ctx release and wave5_release function removing stream instance from
list of active instances. The IRQ thread looks for the m2m_ctx which is
freed so null pointer dereference occurs.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e6bdd437a3c7a5d8846d7f58fe9645a60ec0933",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Release m2m_ctx after Instance Removed from List\n\nPossible use after free if IRQ thread manages to obtain spinlock between\nm2m_ctx release and wave5_release function removing stream instance from\nlist of active instances. The IRQ thread looks for the m2m_ctx which is\nfreed so null pointer dereference occurs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in wave5_vpu_release_device(), reached only by close() on the Wave5 V4L2 mem2mem node (/dev/videoN): v4l2_release -\u003e wave5_vpu_dec_release/wave5_vpu_enc_release. No network, Bluetooth, or USB packet supplies the triggering state.\nAC:L - The attacker queues decode/encode work so the VPU raises INT_WAVE5_DEC_PIC/ENC_PIC into inst-\u003eirq_status, then close()s so v4l2_m2m_ctx_release() kfree\u0027s m2m_ctx while the instance is still on dev-\u003einstances. Both sides of the race (STREAMON/QBUF vs close) are attacker-controlled and retryable.\nPR:L - v4l2_open, wave5_vpu_open_dec(), and wave5_vpu_open_enc() perform no capable() checks; access is only the video node. On TI K3 systems that ship this driver, that node is available to unprivileged video-group or media-client users, not init-namespace root.\nUI:N - The attacker opens the Wave5 decoder or encoder themselves, STREAMONs, and close()s that fd to enter wave5_vpu_release_device(). No separate victim action such as mounting a filesystem is required.\nS:U - The UAF of inst-\u003ev4l2_fh.m2m_ctx is in the host Wave5 media driver and affects the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - After v4l2_m2m_ctx_release() kfree\u0027s m2m_ctx, wave5_vpu_irq_thread() still finds the instance on dev-\u003einstances and wave5_vpu_dec_finish_decode()/wave5_vpu_enc_finish_encode() read the freed object (v4l2_m2m_get_dst_vq and related helpers), a slab UAF that enables arbitrary read.\nI:H - The same finish_process path writes through the freed m2m_ctx via v4l2_m2m_job_finish(), v4l2_m2m_dst_buf_remove_by_idx()/v4l2_m2m_src_buf_remove_by_idx(), and v4l2_m2m_buf_done(), so reclaiming the kzalloc\u0027d context yields a kernel write/control-flow primitive.\nA:H - Use of the dangling m2m_ctx in wave5_vpu_dec_finish_decode()/wave5_vpu_enc_finish_encode() oopses the kernel (the commit documents a NULL deref of the freed context) even when the UAF is not fully exploited."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:59.580Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e6bdd437a3c7a5d8846d7f58fe9645a60ec0933"
},
{
"url": "https://git.kernel.org/stable/c/04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659"
},
{
"url": "https://git.kernel.org/stable/c/7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c"
}
],
"title": "media: chips-media: wave5: Release m2m_ctx after Instance Removed from List",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97513",
"datePublished": "2026-09-24T16:05:10.589Z",
"dateReserved": "2026-09-24T16:01:01.151Z",
"dateUpdated": "2026-10-21T12:52:59.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93176 (GCVE-0-2026-93176)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix dangling pointer in plane reset function
amdgpu_dm_plane_drm_plane_reset() frees the old state before allocating
a new one. If kzalloc() fails, the function returns without updating
the state pointer, leaving a dangling pointer to already freed memory.
Fix this by allocating the new state first. On allocation failure, the
old state remains untouched and the function safely returns.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[adjust for movement around current amd-staging-drm-next]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5d945cbcd4b16a29d6470a80dfb19738f9a4319f Version: 5d945cbcd4b16a29d6470a80dfb19738f9a4319f Version: 5d945cbcd4b16a29d6470a80dfb19738f9a4319f Version: 5d945cbcd4b16a29d6470a80dfb19738f9a4319f Version: 5d945cbcd4b16a29d6470a80dfb19738f9a4319f Version: 5d945cbcd4b16a29d6470a80dfb19738f9a4319f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "154883749cae674fb38e83c1b3a096ce71122229",
"status": "affected",
"version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f",
"versionType": "git"
},
{
"lessThan": "cda8af27b787d79eadc4eb8109d9f2e856dadac2",
"status": "affected",
"version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f",
"versionType": "git"
},
{
"lessThan": "0999a267bdc13648b6b0db893e7eabe30bc13e7c",
"status": "affected",
"version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f",
"versionType": "git"
},
{
"lessThan": "3d8391d3149a1aeb93505a4f9fb9ed8364882c42",
"status": "affected",
"version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f",
"versionType": "git"
},
{
"lessThan": "80c0f51aced43d6eaf72f95a2833b0a77cf7880d",
"status": "affected",
"version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f",
"versionType": "git"
},
{
"lessThan": "98cad4bd1443975d972f4c7f705980da03722a22",
"status": "affected",
"version": "5d945cbcd4b16a29d6470a80dfb19738f9a4319f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dangling pointer in plane reset function\n\namdgpu_dm_plane_drm_plane_reset() frees the old state before allocating\na new one. If kzalloc() fails, the function returns without updating\nthe state pointer, leaving a dangling pointer to already freed memory.\n\nFix this by allocating the new state first. On allocation failure, the\nold state remains untouched and the function safely returns.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[adjust for movement around current amd-staging-drm-next]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in amdgpu_dm_plane_drm_plane_reset() after plane-\u003estate is already live, reached from drm_mode_config_reset() in drm_atomic_helper_resume() via dm_destroy_cached_state() in dm_resume(). Callers are local: amdgpu_pmops_resume (S3/S0ix) and amdgpu_drm_ioctl then pm_runtime_get_sync then amdgpu_pmops_runtime_resume. No network protocol message is involved.\nAC:H - The dangling plane-\u003estate exists only when kzalloc of struct dm_plane_state fails after amdgpu_dm_plane_drm_plane_destroy_state() has already kfree\u0027d the previous state. That GFP_KERNEL miss during dm_resume()/drm_mode_config_reset() is not reliably attacker-controlled.\nPR:L - amdgpu_drm_ioctl() issues pm_runtime_get_sync() with no capable() check, so any local user who can open /dev/dri/renderD* or card* (typical video/render-group access) can runtime-resume into dm_resume() and drm_mode_config_reset(). This is not init-namespace root.\nUI:N - The attacker opens the DRM node and issues their own ioctl to drive amdgpu_pmops_runtime_resume() into dm_resume(), or initiates their own session suspend/resume; no separate victim must mount media, attach a display, or accept a prompt.\nS:U - The freed object is the host-kernel struct dm_plane_state stored in drm_plane.state by amdgpu_dm; the UAF stays in the same kernel security authority and is not a KVM/Xen, IOMMU, or sandbox escape.\nC:H - After the kfree, drm_atomic_helper_commit_duplicated_state() stores the dangling plane-\u003estate as old_state and amdgpu_dm_plane_drm_plane_duplicate_state() uses to_dm_plane_state(plane-\u003estate) to read dc_state and degamma/ctm/lut blobs from the freed heap object.\nI:H - drm_atomic_helper_swap_state() later calls atomic_destroy_state() on that already-freed plane-\u003estate (double-free), and duplicate_state copies reclaimed dc_state/fb pointers into the new live dm_plane_state, enabling a kernel write and control-flow hijack.\nA:H - drm_atomic_helper_resume() uses the freed plane-\u003estate immediately in drm_atomic_helper_commit_duplicated_state(), and DRM_IOCTL_MODE_GETPLANE loads plane-\u003estate-\u003ecrtc/fb; either path oopses or panics the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:16.325Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/154883749cae674fb38e83c1b3a096ce71122229"
},
{
"url": "https://git.kernel.org/stable/c/cda8af27b787d79eadc4eb8109d9f2e856dadac2"
},
{
"url": "https://git.kernel.org/stable/c/0999a267bdc13648b6b0db893e7eabe30bc13e7c"
},
{
"url": "https://git.kernel.org/stable/c/3d8391d3149a1aeb93505a4f9fb9ed8364882c42"
},
{
"url": "https://git.kernel.org/stable/c/80c0f51aced43d6eaf72f95a2833b0a77cf7880d"
},
{
"url": "https://git.kernel.org/stable/c/98cad4bd1443975d972f4c7f705980da03722a22"
}
],
"title": "drm/amd/display: Fix dangling pointer in plane reset function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93176",
"datePublished": "2026-09-17T16:12:05.278Z",
"dateReserved": "2026-09-17T16:02:15.090Z",
"dateUpdated": "2026-10-30T12:36:16.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93260 (GCVE-0-2026-93260)
Vulnerability from cvelistv5
Published
2026-09-24 15:51
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive: propagate IPI init errors to prevent use-after-free
When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),
the error path frees the global xive_ipis array. However,
xive_smp_probe() previously ignored this failure and proceeded to
call xive_setup_cpu_ipi(), which dereferences the already-freed
xive_ipis pointer -- a use-after-free.
Now that xive_smp_probe() returns int (previous patch), propagate
the error from xive_init_ipis() and xive_setup_cpu_ipi() through
xive_smp_probe(). Check the return value in both pnv_smp_probe()
and pSeries_smp_probe() so that IPI setup is aborted cleanly on
failure, avoiding the use-after-free.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 243e25112d06b348f087a6f7aba4bbc288285bdd Version: 243e25112d06b348f087a6f7aba4bbc288285bdd Version: 243e25112d06b348f087a6f7aba4bbc288285bdd Version: 243e25112d06b348f087a6f7aba4bbc288285bdd Version: 243e25112d06b348f087a6f7aba4bbc288285bdd Version: 243e25112d06b348f087a6f7aba4bbc288285bdd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/powernv/smp.c",
"arch/powerpc/platforms/pseries/smp.c",
"arch/powerpc/sysdev/xive/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89e1caa5b0aafe23e9938d9a311e9d41baee583e",
"status": "affected",
"version": "243e25112d06b348f087a6f7aba4bbc288285bdd",
"versionType": "git"
},
{
"lessThan": "e36b1c2eafcaaddefa70d55e6fda74cf6cda38af",
"status": "affected",
"version": "243e25112d06b348f087a6f7aba4bbc288285bdd",
"versionType": "git"
},
{
"lessThan": "2ea6238343691309e68308131c7e80c3ae05afea",
"status": "affected",
"version": "243e25112d06b348f087a6f7aba4bbc288285bdd",
"versionType": "git"
},
{
"lessThan": "5c9ab0c9cede9f149733d330e2d7d45341b71359",
"status": "affected",
"version": "243e25112d06b348f087a6f7aba4bbc288285bdd",
"versionType": "git"
},
{
"lessThan": "c554a8d376d5aea1b237ed6bef6f9fbfc550e67f",
"status": "affected",
"version": "243e25112d06b348f087a6f7aba4bbc288285bdd",
"versionType": "git"
},
{
"lessThan": "411a3c016e7a95f5fa105a0587e07d0647a77727",
"status": "affected",
"version": "243e25112d06b348f087a6f7aba4bbc288285bdd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/powernv/smp.c",
"arch/powerpc/platforms/pseries/smp.c",
"arch/powerpc/sysdev/xive/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: propagate IPI init errors to prevent use-after-free\n\nWhen xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),\nthe error path frees the global xive_ipis array. However,\nxive_smp_probe() previously ignored this failure and proceeded to\ncall xive_setup_cpu_ipi(), which dereferences the already-freed\nxive_ipis pointer -- a use-after-free.\n\nNow that xive_smp_probe() returns int (previous patch), propagate\nthe error from xive_init_ipis() and xive_setup_cpu_ipi() through\nxive_smp_probe(). Check the return value in both pnv_smp_probe()\nand pSeries_smp_probe() so that IPI setup is aborted cleanly on\nfailure, avoiding the use-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in xive_setup_cpu_ipi() after xive_init_ipis() kfree\u0027s xive_ipis, reached only from kernel_init_freeable()-\u003esmp_prepare_cpus()-\u003epnv_smp_probe()/pSeries_smp_probe()-\u003exive_smp_probe(); no protocol message or received packet supplies the trigger.\nAC:H - The free-then-use fires only when irq_domain_alloc_irqs() fails in xive_init_ipis()\u0027s for_each_node loop (irq_desc ENOMEM/ENOSPC), after which kfree(xive_ipis) runs; that allocator failure during early SMP probe cannot be induced on demand.\nPR:N - xive_smp_probe() runs as swapper/0 from smp_prepare_cpus() in kernel_init_freeable() before userspace, with no capable() or credential check on pnv_smp_probe() or pSeries_smp_probe().\nUI:N - SMP IPI probe is invoked unconditionally by smp_prepare_cpus() during ordinary boot once xive_core_init() has set __xive_enabled; no victim mount, file open, or other interactive step is required.\nS:U - The dangling xive_ipis dereference corrupts heap in the same Linux instance that runs XIVE (PowerNV host or pSeries guest); it is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - After kfree(xive_ipis) without NULLing, xive_ipi_cpu_to_irq() and xive_request_ipi() read xid-\u003eirq and xid-\u003ename from the freed xive_ipi_desc array; that heap use-after-free can disclose whatever reclaimed the slab.\nI:H - xive_request_ipi() then atomic_inc_return(\u0026xid-\u003estarted) on the freed descriptor and request_irq(xid-\u003eirq, xive_muxed_ipi_action) using the UAF-read virq, a write-after-free of the xive_ipi_desc slab that can corrupt a reused object and install a handler on the wrong irq.\nA:H - Dereferencing the kfree\u0027d xive_ipis pointer in xive_setup_cpu_ipi() during xive_smp_probe() oopses or panics the kernel while bringing up SMP, so the machine fails to boot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:35.383Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89e1caa5b0aafe23e9938d9a311e9d41baee583e"
},
{
"url": "https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af"
},
{
"url": "https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea"
},
{
"url": "https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359"
},
{
"url": "https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f"
},
{
"url": "https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727"
}
],
"title": "powerpc/xive: propagate IPI init errors to prevent use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93260",
"datePublished": "2026-09-24T15:51:46.703Z",
"dateReserved": "2026-09-17T16:02:15.097Z",
"dateUpdated": "2026-10-30T12:36:35.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97422 (GCVE-0-2026-97422)
Vulnerability from cvelistv5
Published
2026-09-24 16:03
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix SMI event cross-process information leak
kfd_smi_ev_enabled() skips the suser privilege check when pid=0.
PROCESS_START, PROCESS_END, and VMFAULT events are emitted with
pid=0 while carrying another process's PID and command name, so any
/dev/kfd user in the render group can monitor all GPU workloads.
Pass the target process PID into kfd_smi_event_add() for these events
so the existing per-client filter restricts delivery to the owning
process or CAP_SYS_ADMIN subscribers.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b8151aeb4f34e913315058c192f78fea2223f36a",
"status": "affected",
"version": "938a0650aae6275ba8e924685836bdee2c6aa3db",
"versionType": "git"
},
{
"lessThan": "6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a",
"status": "affected",
"version": "938a0650aae6275ba8e924685836bdee2c6aa3db",
"versionType": "git"
},
{
"lessThan": "470319a893f616ef661a63e825a8e1b9b6eddb91",
"status": "affected",
"version": "938a0650aae6275ba8e924685836bdee2c6aa3db",
"versionType": "git"
},
{
"lessThan": "5bb2dfa65d8da83e87b2a31c270bc567df69a5ca",
"status": "affected",
"version": "938a0650aae6275ba8e924685836bdee2c6aa3db",
"versionType": "git"
},
{
"lessThan": "92a8dba246d371fe268280e5fd74b0955688e6df",
"status": "affected",
"version": "938a0650aae6275ba8e924685836bdee2c6aa3db",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix SMI event cross-process information leak\n\nkfd_smi_ev_enabled() skips the suser privilege check when pid=0.\nPROCESS_START, PROCESS_END, and VMFAULT events are emitted with\npid=0 while carrying another process\u0027s PID and command name, so any\n/dev/kfd user in the render group can monitor all GPU workloads.\n\nPass the target process PID into kfd_smi_event_add() for these events\nso the existing per-client filter restricts delivery to the owning\nprocess or CAP_SYS_ADMIN subscribers."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:55.282Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b8151aeb4f34e913315058c192f78fea2223f36a"
},
{
"url": "https://git.kernel.org/stable/c/6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a"
},
{
"url": "https://git.kernel.org/stable/c/470319a893f616ef661a63e825a8e1b9b6eddb91"
},
{
"url": "https://git.kernel.org/stable/c/5bb2dfa65d8da83e87b2a31c270bc567df69a5ca"
},
{
"url": "https://git.kernel.org/stable/c/92a8dba246d371fe268280e5fd74b0955688e6df"
}
],
"title": "drm/amdkfd: fix SMI event cross-process information leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97422",
"datePublished": "2026-09-24T16:03:32.463Z",
"dateReserved": "2026-09-24T14:53:16.868Z",
"dateUpdated": "2026-10-30T12:36:55.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43353 (GCVE-0-2026-43353)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for
multiple transfers that timeout around the same time. However, the
function is not serialized and can race with itself.
When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes
incomplete transfers, and then restarts the ring. If another timeout
triggers a parallel call into the same function, the two instances may
interfere with each other - stopping or restarting the ring at unexpected
times.
Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to
itself.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/mipi-i3c-hci/core.c",
"drivers/i3c/master/mipi-i3c-hci/dma.c",
"drivers/i3c/master/mipi-i3c-hci/hci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2fa9b855c7b42b34b2fb32731bf533952370384",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "73bb6b15f1fd71479ed12b314876f3ce5935b80a",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "16061383a9def977e4be908c7dcede9a8a4227fd",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "4faa1e9c67a2229f6749190aedaf88ce0391efd2",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "1dca8aee80eea76d2aae21265de5dd64f6ba0f09",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/mipi-i3c-hci/core.c",
"drivers/i3c/master/mipi-i3c-hci/dma.c",
"drivers/i3c/master/mipi-i3c-hci/hci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Fix race in DMA ring dequeue\n\nThe HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for\nmultiple transfers that timeout around the same time. However, the\nfunction is not serialized and can race with itself.\n\nWhen a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes\nincomplete transfers, and then restarts the ring. If another timeout\ntriggers a parallel call into the same function, the two instances may\ninterfere with each other - stopping or restarting the ring at unexpected\ntimes.\n\nAdd a mutex so that hci_dma_dequeue_xfer() is serialized with respect to\nitself."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable DMA dequeue path is reached through local kernel I3C/I2C transfer APIs, including userspace-triggerable device/client paths on systems exposing I3C-backed devices. There is no evidence of direct internet/network packet reachability for this HCI master driver.\nAC:L - The I3C core explicitly permits parallel normal transfers, and the bug is a missing serialization primitive when multiple transfers time out together. An attacker who can trigger concurrent transfers can create the race rather than relying on an uncontrollable rare condition.\nPR:L - Reaching the path requires local ability to cause I3C/I2C client transfers, such as access to exposed device interfaces or subsystem clients, but no kernel capability check is present in the vulnerable HCI dequeue logic itself. This is best treated as low local privilege rather than real administrator/root-only privilege.\nUI:N - Once the attacker can trigger the relevant transfers, no separate victim action is required. The timeout/dequeue handling runs in the kernel as part of transfer completion/error handling.\nS:U - The vulnerability corrupts or destabilizes kernel-controlled I3C HCI/DMA state within the same kernel security authority. It does not constitute a VM escape or an IOMMU/DMA isolation boundary bypass by itself.\nC:H - The race can restart or manipulate a DMA ring while another dequeue path is still aborting, replacing descriptors, and unmapping DMA buffers, leaving hardware able to access stale or unintended kernel memory. Under the required overestimate rule, this DMA memory corruption is treated as capable of high confidentiality impact.\nI:H - The same stale descriptor/unmap race can allow device DMA or ring state corruption to write into unintended or freed kernel memory. That is a memory corruption primitive, so high integrity impact is defensible.\nA:H - The vulnerable path can leave the DMA ring and host controller in an inconsistent state, trigger WARN/oops-like failure paths, or cause DMA/ring corruption. A kernel crash, hang, or persistent controller failure gives high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:29.436Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2fa9b855c7b42b34b2fb32731bf533952370384"
},
{
"url": "https://git.kernel.org/stable/c/73bb6b15f1fd71479ed12b314876f3ce5935b80a"
},
{
"url": "https://git.kernel.org/stable/c/16061383a9def977e4be908c7dcede9a8a4227fd"
},
{
"url": "https://git.kernel.org/stable/c/b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e"
},
{
"url": "https://git.kernel.org/stable/c/4faa1e9c67a2229f6749190aedaf88ce0391efd2"
},
{
"url": "https://git.kernel.org/stable/c/1dca8aee80eea76d2aae21265de5dd64f6ba0f09"
}
],
"title": "i3c: mipi-i3c-hci: Fix race in DMA ring dequeue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43353",
"datePublished": "2026-05-08T14:21:10.282Z",
"dateReserved": "2026-05-01T14:12:56.005Z",
"dateUpdated": "2026-10-30T12:25:29.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38029 (GCVE-0-2025-38029)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
kasan: avoid sleepable page allocation from atomic context
apply_to_pte_range() enters the lazy MMU mode and then invokes
kasan_populate_vmalloc_pte() callback on each page table walk iteration.
However, the callback can go into sleep when trying to allocate a single
page, e.g. if an architecutre disables preemption on lazy MMU mode enter.
On s390 if make arch_enter_lazy_mmu_mode() -> preempt_enable() and
arch_leave_lazy_mmu_mode() -> preempt_disable(), such crash occurs:
[ 0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
[ 0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd
[ 0.663358] preempt_count: 1, expected: 0
[ 0.663366] RCU nest depth: 0, expected: 0
[ 0.663375] no locks held by kthreadd/2.
[ 0.663383] Preemption disabled at:
[ 0.663386] [<0002f3284cbb4eda>] apply_to_pte_range+0xfa/0x4a0
[ 0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT
[ 0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux)
[ 0.663409] Call Trace:
[ 0.663410] [<0002f3284c385f58>] dump_stack_lvl+0xe8/0x140
[ 0.663413] [<0002f3284c507b9e>] __might_resched+0x66e/0x700
[ 0.663415] [<0002f3284cc4f6c0>] __alloc_frozen_pages_noprof+0x370/0x4b0
[ 0.663419] [<0002f3284ccc73c0>] alloc_pages_mpol+0x1a0/0x4a0
[ 0.663421] [<0002f3284ccc8518>] alloc_frozen_pages_noprof+0x88/0xc0
[ 0.663424] [<0002f3284ccc8572>] alloc_pages_noprof+0x22/0x120
[ 0.663427] [<0002f3284cc341ac>] get_free_pages_noprof+0x2c/0xc0
[ 0.663429] [<0002f3284cceba70>] kasan_populate_vmalloc_pte+0x50/0x120
[ 0.663433] [<0002f3284cbb4ef8>] apply_to_pte_range+0x118/0x4a0
[ 0.663435] [<0002f3284cbc7c14>] apply_to_pmd_range+0x194/0x3e0
[ 0.663437] [<0002f3284cbc99be>] __apply_to_page_range+0x2fe/0x7a0
[ 0.663440] [<0002f3284cbc9e88>] apply_to_page_range+0x28/0x40
[ 0.663442] [<0002f3284ccebf12>] kasan_populate_vmalloc+0x82/0xa0
[ 0.663445] [<0002f3284cc1578c>] alloc_vmap_area+0x34c/0xc10
[ 0.663448] [<0002f3284cc1c2a6>] __get_vm_area_node+0x186/0x2a0
[ 0.663451] [<0002f3284cc1e696>] __vmalloc_node_range_noprof+0x116/0x310
[ 0.663454] [<0002f3284cc1d950>] __vmalloc_node_noprof+0xd0/0x110
[ 0.663457] [<0002f3284c454b88>] alloc_thread_stack_node+0xf8/0x330
[ 0.663460] [<0002f3284c458d56>] dup_task_struct+0x66/0x4d0
[ 0.663463] [<0002f3284c45be90>] copy_process+0x280/0x4b90
[ 0.663465] [<0002f3284c460940>] kernel_clone+0xd0/0x4b0
[ 0.663467] [<0002f3284c46115e>] kernel_thread+0xbe/0xe0
[ 0.663469] [<0002f3284c4e440e>] kthreadd+0x50e/0x7f0
[ 0.663472] [<0002f3284c38c04a>] __ret_from_fork+0x8a/0xf0
[ 0.663475] [<0002f3284ed57ff2>] ret_from_fork+0xa/0x38
Instead of allocating single pages per-PTE, bulk-allocate the shadow
memory prior to applying kasan_populate_vmalloc_pte() callback on a page
range.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/kasan/shadow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6a895d88fbd453dc8f1c5e038188b49b272afe6",
"status": "affected",
"version": "3c5c3cfb9ef4da957e3357a2bd36f76ee34c0862",
"versionType": "git"
},
{
"lessThan": "c33a7fe6dda591694cebfe15abf4644abb4f61c0",
"status": "affected",
"version": "3c5c3cfb9ef4da957e3357a2bd36f76ee34c0862",
"versionType": "git"
},
{
"lessThan": "468e7d51dba433a72dcd63eee6db9ad721d39ac5",
"status": "affected",
"version": "3c5c3cfb9ef4da957e3357a2bd36f76ee34c0862",
"versionType": "git"
},
{
"lessThan": "6748dd09196248b985cca39eaf651d5317271977",
"status": "affected",
"version": "3c5c3cfb9ef4da957e3357a2bd36f76ee34c0862",
"versionType": "git"
},
{
"lessThan": "b6ea95a34cbd014ab6ade4248107b86b0aaf2d6c",
"status": "affected",
"version": "3c5c3cfb9ef4da957e3357a2bd36f76ee34c0862",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/kasan/shadow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.9",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkasan: avoid sleepable page allocation from atomic context\n\napply_to_pte_range() enters the lazy MMU mode and then invokes\nkasan_populate_vmalloc_pte() callback on each page table walk iteration. \nHowever, the callback can go into sleep when trying to allocate a single\npage, e.g. if an architecutre disables preemption on lazy MMU mode enter.\n\nOn s390 if make arch_enter_lazy_mmu_mode() -\u003e preempt_enable() and\narch_leave_lazy_mmu_mode() -\u003e preempt_disable(), such crash occurs:\n\n[ 0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321\n[ 0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd\n[ 0.663358] preempt_count: 1, expected: 0\n[ 0.663366] RCU nest depth: 0, expected: 0\n[ 0.663375] no locks held by kthreadd/2.\n[ 0.663383] Preemption disabled at:\n[ 0.663386] [\u003c0002f3284cbb4eda\u003e] apply_to_pte_range+0xfa/0x4a0\n[ 0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT\n[ 0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux)\n[ 0.663409] Call Trace:\n[ 0.663410] [\u003c0002f3284c385f58\u003e] dump_stack_lvl+0xe8/0x140\n[ 0.663413] [\u003c0002f3284c507b9e\u003e] __might_resched+0x66e/0x700\n[ 0.663415] [\u003c0002f3284cc4f6c0\u003e] __alloc_frozen_pages_noprof+0x370/0x4b0\n[ 0.663419] [\u003c0002f3284ccc73c0\u003e] alloc_pages_mpol+0x1a0/0x4a0\n[ 0.663421] [\u003c0002f3284ccc8518\u003e] alloc_frozen_pages_noprof+0x88/0xc0\n[ 0.663424] [\u003c0002f3284ccc8572\u003e] alloc_pages_noprof+0x22/0x120\n[ 0.663427] [\u003c0002f3284cc341ac\u003e] get_free_pages_noprof+0x2c/0xc0\n[ 0.663429] [\u003c0002f3284cceba70\u003e] kasan_populate_vmalloc_pte+0x50/0x120\n[ 0.663433] [\u003c0002f3284cbb4ef8\u003e] apply_to_pte_range+0x118/0x4a0\n[ 0.663435] [\u003c0002f3284cbc7c14\u003e] apply_to_pmd_range+0x194/0x3e0\n[ 0.663437] [\u003c0002f3284cbc99be\u003e] __apply_to_page_range+0x2fe/0x7a0\n[ 0.663440] [\u003c0002f3284cbc9e88\u003e] apply_to_page_range+0x28/0x40\n[ 0.663442] [\u003c0002f3284ccebf12\u003e] kasan_populate_vmalloc+0x82/0xa0\n[ 0.663445] [\u003c0002f3284cc1578c\u003e] alloc_vmap_area+0x34c/0xc10\n[ 0.663448] [\u003c0002f3284cc1c2a6\u003e] __get_vm_area_node+0x186/0x2a0\n[ 0.663451] [\u003c0002f3284cc1e696\u003e] __vmalloc_node_range_noprof+0x116/0x310\n[ 0.663454] [\u003c0002f3284cc1d950\u003e] __vmalloc_node_noprof+0xd0/0x110\n[ 0.663457] [\u003c0002f3284c454b88\u003e] alloc_thread_stack_node+0xf8/0x330\n[ 0.663460] [\u003c0002f3284c458d56\u003e] dup_task_struct+0x66/0x4d0\n[ 0.663463] [\u003c0002f3284c45be90\u003e] copy_process+0x280/0x4b90\n[ 0.663465] [\u003c0002f3284c460940\u003e] kernel_clone+0xd0/0x4b0\n[ 0.663467] [\u003c0002f3284c46115e\u003e] kernel_thread+0xbe/0xe0\n[ 0.663469] [\u003c0002f3284c4e440e\u003e] kthreadd+0x50e/0x7f0\n[ 0.663472] [\u003c0002f3284c38c04a\u003e] __ret_from_fork+0x8a/0xf0\n[ 0.663475] [\u003c0002f3284ed57ff2\u003e] ret_from_fork+0xa/0x38\n\nInstead of allocating single pages per-PTE, bulk-allocate the shadow\nmemory prior to applying kasan_populate_vmalloc_pte() callback on a page\nrange."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:32.818Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6a895d88fbd453dc8f1c5e038188b49b272afe6"
},
{
"url": "https://git.kernel.org/stable/c/c33a7fe6dda591694cebfe15abf4644abb4f61c0"
},
{
"url": "https://git.kernel.org/stable/c/468e7d51dba433a72dcd63eee6db9ad721d39ac5"
},
{
"url": "https://git.kernel.org/stable/c/6748dd09196248b985cca39eaf651d5317271977"
},
{
"url": "https://git.kernel.org/stable/c/b6ea95a34cbd014ab6ade4248107b86b0aaf2d6c"
}
],
"title": "kasan: avoid sleepable page allocation from atomic context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38029",
"datePublished": "2025-06-18T09:33:17.632Z",
"dateReserved": "2025-04-16T04:51:23.978Z",
"dateUpdated": "2026-10-30T12:21:32.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93081 (GCVE-0-2026-93081)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix SCMI device destroy lifetimes
scmi_child_dev_find() drops the reference returned by
device_find_child() before returning the scmi_device pointer. A
concurrent unregister can then release the device while the destroy path
is still using the returned pointer.
Make the lookup helper return the device_find_child() reference and keep
it until scmi_device_destroy() has finished unregistering the child.
Also split device_unregister() in __scmi_device_destroy() so the SCMI bus
ID is not made reusable until after device_del() has removed the old
scmi_dev.N name from sysfs. This avoids a new SCMI device reusing the
same ID while the old device is still registered.
The final device release callback is also a possible cleanup path when
SCMI children are deleted by driver core recursion rather than
__scmi_device_destroy(). Release the SCMI bus ID from a common helper
used by destroy, register-failure and final-release paths, and clear
scmi_dev->id after freeing it so the final release cannot free the same
ID again.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ff4273d47da81b95ed9396110bcbd1b7b7470fe8 Version: 2fbf6c9695ad9f05e7e5c166bf43fac7cb3276b3 Version: 969d8beaa2e374387bf9aa5602ef84fc50bb48d8 Version: 9ca67840c0ddf3f39407339624cef824a4f27599 Version: 9ca67840c0ddf3f39407339624cef824a4f27599 Version: 9ca67840c0ddf3f39407339624cef824a4f27599 Version: 91ff1e9652fb9beb0174267d6bb38243dff211bb Version: 8a8a3547d5c4960da053df49c75bf623827a25da Version: 6.1.138 ≤ Version: 6.6.90 ≤ Version: 6.12.28 ≤ Version: 5.15.182 ≤ Version: 6.14.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scmi/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "afe5c022a180e0ade394d3fffbafc1a701f50993",
"status": "affected",
"version": "ff4273d47da81b95ed9396110bcbd1b7b7470fe8",
"versionType": "git"
},
{
"lessThan": "d8ecdceeb90cd2c265b222a7b65487faf68fea73",
"status": "affected",
"version": "2fbf6c9695ad9f05e7e5c166bf43fac7cb3276b3",
"versionType": "git"
},
{
"lessThan": "916e27f71a80f6d77c48d1a1a5782d6d5ef9017c",
"status": "affected",
"version": "969d8beaa2e374387bf9aa5602ef84fc50bb48d8",
"versionType": "git"
},
{
"lessThan": "a60bc2df2d323cc1342f0cf95563cae266801e20",
"status": "affected",
"version": "9ca67840c0ddf3f39407339624cef824a4f27599",
"versionType": "git"
},
{
"lessThan": "c59b3393df1348a12308aaabd5fbc58ed6b21cf5",
"status": "affected",
"version": "9ca67840c0ddf3f39407339624cef824a4f27599",
"versionType": "git"
},
{
"lessThan": "6abe8fe36b29ff51d1a42c2f338972883f4751a5",
"status": "affected",
"version": "9ca67840c0ddf3f39407339624cef824a4f27599",
"versionType": "git"
},
{
"status": "affected",
"version": "91ff1e9652fb9beb0174267d6bb38243dff211bb",
"versionType": "git"
},
{
"status": "affected",
"version": "8a8a3547d5c4960da053df49c75bf623827a25da",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.138",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.90",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.28",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.182",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scmi/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.138",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.182",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix SCMI device destroy lifetimes\n\nscmi_child_dev_find() drops the reference returned by\ndevice_find_child() before returning the scmi_device pointer. A\nconcurrent unregister can then release the device while the destroy path\nis still using the returned pointer.\n\nMake the lookup helper return the device_find_child() reference and keep\nit until scmi_device_destroy() has finished unregistering the child.\n\nAlso split device_unregister() in __scmi_device_destroy() so the SCMI bus\nID is not made reusable until after device_del() has removed the old\nscmi_dev.N name from sysfs. This avoids a new SCMI device reusing the\nsame ID while the old device is still registered.\n\nThe final device release callback is also a possible cleanup path when\nSCMI children are deleted by driver core recursion rather than\n__scmi_device_destroy(). Release the SCMI bus ID from a common helper\nused by destroy, register-failure and final-release paths, and clear\nscmi_dev-\u003eid after freeing it so the final release cannot free the same\nID again."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:49.648Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/afe5c022a180e0ade394d3fffbafc1a701f50993"
},
{
"url": "https://git.kernel.org/stable/c/d8ecdceeb90cd2c265b222a7b65487faf68fea73"
},
{
"url": "https://git.kernel.org/stable/c/916e27f71a80f6d77c48d1a1a5782d6d5ef9017c"
},
{
"url": "https://git.kernel.org/stable/c/a60bc2df2d323cc1342f0cf95563cae266801e20"
},
{
"url": "https://git.kernel.org/stable/c/c59b3393df1348a12308aaabd5fbc58ed6b21cf5"
},
{
"url": "https://git.kernel.org/stable/c/6abe8fe36b29ff51d1a42c2f338972883f4751a5"
}
],
"title": "firmware: arm_scmi: Fix SCMI device destroy lifetimes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93081",
"datePublished": "2026-09-17T16:11:01.679Z",
"dateReserved": "2026-09-17T15:57:05.662Z",
"dateUpdated": "2026-10-30T12:35:49.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63811 (GCVE-0-2026-63811)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: read COW data with the original inode during atomic write
When updating an atomic-write file, f2fs_write_begin() may read the
previously written data back from the COW inode:
prepare_atomic_write_begin() locates the block in the COW inode and sets
use_cow, and the read bio is then built with the COW inode:
f2fs_submit_page_read(use_cow ? F2FS_I(inode)->cow_inode : inode,
...);
and f2fs_grab_read_bio() decides whether to schedule fs-layer decryption
(STEP_DECRYPT) for the bio based on that inode via
fscrypt_inode_uses_fs_layer_crypto().
However, the folio being filled belongs to the original inode
(folio->mapping->host == inode), and the data stored in the COW block was
encrypted (or left as plaintext) using the original inode's context, not
the COW inode's -- see f2fs_encrypt_one_page(), which keys off
fio->page->mapping->host. fscrypt_decrypt_pagecache_blocks() likewise
operates on folio->mapping->host.
The COW inode is created as a tmpfile in the parent directory and inherits
its encryption policy from there. With test_dummy_encryption the newly
created COW inode gets the dummy policy and becomes encrypted, while a
pre-existing regular file -- created before the policy applied, e.g.
already present in the on-disk image -- stays unencrypted. The read
path then sets STEP_DECRYPT based on the encrypted COW inode and calls
fscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted
original inode) has a NULL ->i_crypt_info, dereferencing it:
Oops: general protection fault, probably for non-canonical address ...
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310
Workqueue: f2fs_post_read_wq f2fs_post_read_work
Call Trace:
fscrypt_decrypt_bio+0x1eb/0x340
f2fs_post_read_work+0xba/0x140
process_one_work+0x91c/0x1a40
worker_thread+0x677/0xe90
kthread+0x2bc/0x3a0
The COW inode is only needed to locate the on-disk block, and that block
address is already resolved into @blkaddr by prepare_atomic_write_begin()
via __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads
from that physical @blkaddr directly, so the inode argument only selects
the post-read crypto context, not which block is fetched. Reading with
@inode therefore returns the same (latest, not-yet-committed) COW data,
while making both the fs-layer decryption decision and the inline crypto
path use the correct (original inode's) key.
With the COW inode no longer used at the read site, the use_cow flag has no
remaining consumer; drop it from f2fs_write_begin() and
prepare_atomic_write_begin().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcc9df992f3cbc43f2ecfe0b22e428e50f326e72",
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"versionType": "git"
},
{
"lessThan": "655d55c5740d37ffdf6233ff5fe21cea879407f1",
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"versionType": "git"
},
{
"lessThan": "7e4ab3907f44dc243d026048d7f5d477dae9267b",
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"versionType": "git"
},
{
"lessThan": "a92332f32a8d31a7eee47b1dc1d751cb3319908f",
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"versionType": "git"
},
{
"lessThan": "a41075acde0124d2f8a5f563068a5d63e8ffd57b",
"status": "affected",
"version": "591fc34e1f98b0d7eef4aa3440bfdff3c5a1cadd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: read COW data with the original inode during atomic write\n\nWhen updating an atomic-write file, f2fs_write_begin() may read the\npreviously written data back from the COW inode:\nprepare_atomic_write_begin() locates the block in the COW inode and sets\nuse_cow, and the read bio is then built with the COW inode:\n\n\tf2fs_submit_page_read(use_cow ? F2FS_I(inode)-\u003ecow_inode : inode,\n\t\t\t ...);\n\nand f2fs_grab_read_bio() decides whether to schedule fs-layer decryption\n(STEP_DECRYPT) for the bio based on that inode via\nfscrypt_inode_uses_fs_layer_crypto().\n\nHowever, the folio being filled belongs to the original inode\n(folio-\u003emapping-\u003ehost == inode), and the data stored in the COW block was\nencrypted (or left as plaintext) using the original inode\u0027s context, not\nthe COW inode\u0027s -- see f2fs_encrypt_one_page(), which keys off\nfio-\u003epage-\u003emapping-\u003ehost. fscrypt_decrypt_pagecache_blocks() likewise\noperates on folio-\u003emapping-\u003ehost.\n\nThe COW inode is created as a tmpfile in the parent directory and inherits\nits encryption policy from there. With test_dummy_encryption the newly\ncreated COW inode gets the dummy policy and becomes encrypted, while a\npre-existing regular file -- created before the policy applied, e.g.\nalready present in the on-disk image -- stays unencrypted. The read\npath then sets STEP_DECRYPT based on the encrypted COW inode and calls\nfscrypt_decrypt_pagecache_blocks() on a folio whose host (the unencrypted\noriginal inode) has a NULL -\u003ei_crypt_info, dereferencing it:\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:fscrypt_decrypt_pagecache_blocks+0xa0/0x310\n Workqueue: f2fs_post_read_wq f2fs_post_read_work\n Call Trace:\n fscrypt_decrypt_bio+0x1eb/0x340\n f2fs_post_read_work+0xba/0x140\n process_one_work+0x91c/0x1a40\n worker_thread+0x677/0xe90\n kthread+0x2bc/0x3a0\n\nThe COW inode is only needed to locate the on-disk block, and that block\naddress is already resolved into @blkaddr by prepare_atomic_write_begin()\nvia __find_data_block(cow_inode, ...); f2fs_submit_page_read() then reads\nfrom that physical @blkaddr directly, so the inode argument only selects\nthe post-read crypto context, not which block is fetched. Reading with\n@inode therefore returns the same (latest, not-yet-committed) COW data,\nwhile making both the fs-layer decryption decision and the inline crypto\npath use the correct (original inode\u0027s) key.\n\nWith the COW inode no longer used at the read site, the use_cow flag has no\nremaining consumer; drop it from f2fs_write_begin() and\nprepare_atomic_write_begin()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:37.074Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcc9df992f3cbc43f2ecfe0b22e428e50f326e72"
},
{
"url": "https://git.kernel.org/stable/c/655d55c5740d37ffdf6233ff5fe21cea879407f1"
},
{
"url": "https://git.kernel.org/stable/c/7e4ab3907f44dc243d026048d7f5d477dae9267b"
},
{
"url": "https://git.kernel.org/stable/c/a92332f32a8d31a7eee47b1dc1d751cb3319908f"
},
{
"url": "https://git.kernel.org/stable/c/a41075acde0124d2f8a5f563068a5d63e8ffd57b"
}
],
"title": "f2fs: read COW data with the original inode during atomic write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63811",
"datePublished": "2026-07-19T12:02:13.057Z",
"dateReserved": "2026-07-19T07:54:57.013Z",
"dateUpdated": "2026-10-21T12:42:37.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72493 (GCVE-0-2026-72493)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: serialize netif_running() check in enqueue_to_backlog()
Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup().
The root cause is a race condition where packets can escape the backlog
flushing during device unregistration (e.g., during netns exit).
Commit e9e4dd3267d0 ("net: do not process device backlog during unregistration")
introduced a lockless netif_running() check in enqueue_to_backlog() to
prevent queuing packets to an unregistering device.
However, this creates a TOCTOU race window.
A lockless transmitter (like veth_xmit) can pass
the check before dev_close() clears IFF_UP. If the transmitter is then
delayed, flush_all_backlogs() can run and finish before the transmitter
grabs the backlog lock and queues the packet. The packet then escapes
the flush and triggers UAF later when processed.
Fix this by moving the netif_running() check inside the backlog lock.
This serializes the check with the flush work (which also grabs the lock).
We then either queue the packet before the flush runs (so it gets flushed),
or check netif_running() after the flush/close completes (so it gets dropped).
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9e4dd3267d0c5234c5c0f47440456b10875dec9 Version: e9e4dd3267d0c5234c5c0f47440456b10875dec9 Version: e9e4dd3267d0c5234c5c0f47440456b10875dec9 Version: e9e4dd3267d0c5234c5c0f47440456b10875dec9 Version: 78b6803a1961369d0b8350ff1f99b7375bbd7a8f Version: b5d73d9cdd6be22795499890ea928a6f57ef829c Version: f6533fed1bfa842e391ee50f9a9c5e963c71e579 Version: 2095ab2456da766174cda8bc105d7a7b1bc70e16 Version: f1fdb184aefa8447560e3ea0e605171592ffee41 Version: f75c8a3015422128ca150e81c730bc2a471b5f4a Version: 3.2.71 ≤ Version: 3.4.111 ≤ Version: 3.12.48 ≤ Version: 3.14.54 ≤ Version: 3.18.22 ≤ Version: 4.1.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:52.967716Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:26.667Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7",
"status": "affected",
"version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
"versionType": "git"
},
{
"lessThan": "b422e3eff0edf0975de4883929adbed28f9d08bc",
"status": "affected",
"version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
"versionType": "git"
},
{
"lessThan": "2fface6e0bbd6314d1d9d071abf2c4d67548511c",
"status": "affected",
"version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
"versionType": "git"
},
{
"lessThan": "46762cefe7f4e5bffc1eb467810a7bbb02e461d7",
"status": "affected",
"version": "e9e4dd3267d0c5234c5c0f47440456b10875dec9",
"versionType": "git"
},
{
"status": "affected",
"version": "78b6803a1961369d0b8350ff1f99b7375bbd7a8f",
"versionType": "git"
},
{
"status": "affected",
"version": "b5d73d9cdd6be22795499890ea928a6f57ef829c",
"versionType": "git"
},
{
"status": "affected",
"version": "f6533fed1bfa842e391ee50f9a9c5e963c71e579",
"versionType": "git"
},
{
"status": "affected",
"version": "2095ab2456da766174cda8bc105d7a7b1bc70e16",
"versionType": "git"
},
{
"status": "affected",
"version": "f1fdb184aefa8447560e3ea0e605171592ffee41",
"versionType": "git"
},
{
"status": "affected",
"version": "f75c8a3015422128ca150e81c730bc2a471b5f4a",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.71",
"versionType": "semver"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.111",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.48",
"versionType": "semver"
},
{
"lessThan": "3.15",
"status": "affected",
"version": "3.14.54",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.22",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.14.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: serialize netif_running() check in enqueue_to_backlog()\n\nSyzbot reported a KASAN slab-use-after-free in fib_rules_lookup().\n\nThe root cause is a race condition where packets can escape the backlog\nflushing during device unregistration (e.g., during netns exit).\n\nCommit e9e4dd3267d0 (\"net: do not process device backlog during unregistration\")\nintroduced a lockless netif_running() check in enqueue_to_backlog() to\nprevent queuing packets to an unregistering device.\n\nHowever, this creates a TOCTOU race window.\n\nA lockless transmitter (like veth_xmit) can pass\nthe check before dev_close() clears IFF_UP. If the transmitter is then\ndelayed, flush_all_backlogs() can run and finish before the transmitter\ngrabs the backlog lock and queues the packet. The packet then escapes\nthe flush and triggers UAF later when processed.\n\nFix this by moving the netif_running() check inside the backlog lock.\nThis serializes the check with the flush work (which also grabs the lock).\nWe then either queue the packet before the flush runs (so it gets flushed),\nor check netif_running() after the flush/close completes (so it gets dropped)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the generic per-CPU backlog receive path (`netif_rx`/`netif_receive_skb` -\u003e `enqueue_to_backlog`); packets can originate from remote peers reaching veth/bridge/NIC interfaces, and syzbot reproduced it via network transmit/receive activity during device unregistration.\nAC:L - The attacker controls both racing sides by concurrently flooding packets through a lockless transmitter (e.g. veth) while unregistering the device/netns (e.g. `ip link del` or netns exit); no victim-specific timing or memory layout is required beyond repeatable parallel traffic and teardown.\nPR:L - Triggering veth creation, traffic injection, and netdev/netns teardown requires only `CAP_NET_ADMIN` inside a network namespace, obtainable by an unprivileged local user via user namespaces (`unshare -Urn`); init-namespace root is not required.\nUI:N - Exploitation needs only the attacker\u0027s own concurrent packet transmission and interface/netns teardown; no independent action by another user or administrator is required at trigger time.\nS:C - The use-after-free is triggered from within an isolated network namespace yet corrupts host-global kernel routing state (`fib_rules_lookup` on freed namespace/rule data), crossing the container/netns security boundary into the host kernel\u0027s integrity and availability.\nC:H - KASAN reported slab-use-after-free in `fib_rules_lookup()` walking `net-\u003erules_ops`; freed namespace/device-associated structures can be reallocated and read through stale pointers, yielding an attacker-influenceable kernel memory read/disclosure primitive.\nI:H - Processing the escaped backlog skb invokes routing through freed `fib_rules_ops` and indirect function pointers (`ops-\u003ematch`/`ops-\u003eaction`); UAF on these heap objects enables heap grooming, control-flow hijack, and arbitrary kernel write leading to privilege escalation.\nA:H - Confirmed slab-use-after-free in core packet processing during device unregistration reliably causes kernel oops/panic (syzbot KASAN splat in `fib_rules_lookup()`), and repeated triggering can deny service to the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:02.169Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7"
},
{
"url": "https://git.kernel.org/stable/c/b422e3eff0edf0975de4883929adbed28f9d08bc"
},
{
"url": "https://git.kernel.org/stable/c/2fface6e0bbd6314d1d9d071abf2c4d67548511c"
},
{
"url": "https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7"
}
],
"title": "net: serialize netif_running() check in enqueue_to_backlog()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72493",
"datePublished": "2026-08-15T05:57:27.642Z",
"dateReserved": "2026-08-09T03:40:39.937Z",
"dateUpdated": "2026-10-21T12:45:02.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80738 (GCVE-0-2026-80738)
Vulnerability from cvelistv5
Published
2026-09-03 08:21
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer
'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access
sk->sk_protocol without validating whether 'sk' represents a full socket.
Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting
sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.
Since mini-sockets are never in the TCP_LISTEN state, the condition
short-circuits and prevents dereferencing fullsock-specific fields.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 399040847084a69f345e0a52fd62f04654e0fce3 Version: 399040847084a69f345e0a52fd62f04654e0fce3 Version: 399040847084a69f345e0a52fd62f04654e0fce3 Version: 399040847084a69f345e0a52fd62f04654e0fce3 Version: 399040847084a69f345e0a52fd62f04654e0fce3 Version: 399040847084a69f345e0a52fd62f04654e0fce3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b75f1c071f31be7f4b950721e04240c250091ad4",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
},
{
"lessThan": "5702e4c259809c760912c477c4ae34e9217bb4d9",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
},
{
"lessThan": "b5525e853a2a08a9559adb84b0616025958dc542",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
},
{
"lessThan": "22c2169770ad3b3595690e51caac875178cf496d",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
},
{
"lessThan": "23f682083aa3fbc0c49667818efd6979a8bc5ac2",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
},
{
"lessThan": "31a420a822ff92e2090bd5d65efe8e34e2d6d9b8",
"status": "affected",
"version": "399040847084a69f345e0a52fd62f04654e0fce3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie\n\nbpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer\n\u0027sk\u0027 with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access\nsk-\u003esk_protocol without validating whether \u0027sk\u0027 represents a full socket.\n\nFix this issue by checking sk-\u003esk_state != TCP_LISTEN before inspecting\nsk-\u003esk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.\nSince mini-sockets are never in the TCP_LISTEN state, the condition\nshort-circuits and prevents dereferencing fullsock-specific fields."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in bpf_tcp_gen_syncookie/bpf_tcp_check_syncookie BPF helpers invoked only from locally loaded and attached TC clsact or XDP programs via bpf(); per kernel CNA guidance BPF/tc paths are Local even when later triggered by ingress packets.\nAC:L - An attacker who loads the BPF program fully controls passing bpf_skc_lookup_tcp() results (request_sock/TCP_NEW_SYN_RECV or timewait sockets) into the syncookie helpers and can reliably trigger the bad sk_protocol read with crafted SYN/ACK traffic; no uncontrollable races or rare layout are required.\nPR:L - Exploitation requires bpf(BPF_PROG_LOAD) (CAP_BPF, obtainable in user namespaces) plus attaching TC/XDP hooks (CAP_NET_ADMIN via unshare -Urn); no init-namespace root is needed, matching CNA guidance for namespace-reachable net/BPF capabilities.\nUI:N - No victim mount, login, or cooperative action is required; once the attacker loads and attaches their BPF program, sending network packets from their own processes deterministically reaches the vulnerable helper on each matching lookup.\nS:U - Impact is confined to kernel heap disclosure/type confusion within the host kernel security domain; it does not cross VM, container runtime, IOMMU, or other security-authority boundaries.\nC:H - Casting a mini-socket to struct sock and reading sk_protocol performs a fixed-offset out-of-bounds read (~300+ bytes past request_sock/inet_timewait_sock) into adjacent slab memory, leaking kernel heap contents including pointers usable for further local exploitation.\nI:H - This is type confusion between ARG_PTR_TO_BTF_ID_SOCK_COMMON mini-sockets and full struct sock fields; per CNA guidance type confusion is rated High integrity impact even though the immediate bug is a read, because mis-typed socket pointers corrupt the kernel\u0027s object model.\nA:L - The primary impact is information disclosure; while the out-of-bounds u16 read usually stays within the slab page, reads near allocation boundaries or under KASAN can fault and oops the kernel, giving at least Low availability impact when uncertain."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:02.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b75f1c071f31be7f4b950721e04240c250091ad4"
},
{
"url": "https://git.kernel.org/stable/c/5702e4c259809c760912c477c4ae34e9217bb4d9"
},
{
"url": "https://git.kernel.org/stable/c/b5525e853a2a08a9559adb84b0616025958dc542"
},
{
"url": "https://git.kernel.org/stable/c/22c2169770ad3b3595690e51caac875178cf496d"
},
{
"url": "https://git.kernel.org/stable/c/23f682083aa3fbc0c49667818efd6979a8bc5ac2"
},
{
"url": "https://git.kernel.org/stable/c/31a420a822ff92e2090bd5d65efe8e34e2d6d9b8"
}
],
"title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80738",
"datePublished": "2026-09-03T08:21:53.143Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-10-30T12:31:02.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45932 (GCVE-0-2026-45932)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix tcx/netkit detach permissions when prog fd isn't given
This commit fixes a security issue where BPF_PROG_DETACH on tcx or
netkit devices could be executed by any user when no program fd was
provided, bypassing permission checks. The fix adds a capability
check for CAP_NET_ADMIN or CAP_SYS_ADMIN in this case.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h",
"include/linux/bpf_mprog.h",
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8e1623e7d61faf16cbadc80550da874303611ff5",
"status": "affected",
"version": "e420bed025071a623d2720a92bc2245c84757ecb",
"versionType": "git"
},
{
"lessThan": "0c249f523175963b0a746bba673ecebdf6cefd86",
"status": "affected",
"version": "e420bed025071a623d2720a92bc2245c84757ecb",
"versionType": "git"
},
{
"lessThan": "4e0772cded109c238411f2fac36ac39302758b81",
"status": "affected",
"version": "e420bed025071a623d2720a92bc2245c84757ecb",
"versionType": "git"
},
{
"lessThan": "3f04cc1e5374da4c5e791ae010a06cfea7bacbe6",
"status": "affected",
"version": "e420bed025071a623d2720a92bc2245c84757ecb",
"versionType": "git"
},
{
"lessThan": "ae23bc81ddf7c17b663c4ed1b21e35527b0a7131",
"status": "affected",
"version": "e420bed025071a623d2720a92bc2245c84757ecb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h",
"include/linux/bpf_mprog.h",
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix tcx/netkit detach permissions when prog fd isn\u0027t given\n\nThis commit fixes a security issue where BPF_PROG_DETACH on tcx or\nnetkit devices could be executed by any user when no program fd was\nprovided, bypassing permission checks. The fix adds a capability\ncheck for CAP_NET_ADMIN or CAP_SYS_ADMIN in this case."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through the local bpf(2) syscall (BPF_PROG_DETACH command); there is no remote network entry point to this code.\nAC:L - An unprivileged user can reliably trigger the detach with a single deterministic syscall; there is no race, timing, or memory-layout dependency, and the only precondition (a tcx/netkit program already attached) is a standard deployment condition.\nPR:L - The entire bug is that no capability is required where CAP_NET_ADMIN/CAP_SYS_ADMIN should be; any basic local unprivileged user can call BPF_PROG_DETACH, which is not gated by unprivileged_bpf_disabled or any default check.\nUI:N - Detaching the program requires only the attacker\u0027s own syscall; no action by any other user or victim is needed.\nS:U - The impact stays within the kernel\u0027s own security authority (manipulating network BPF attachment state); no VM/IOMMU/sandbox boundary is crossed.\nC:L - Detaching does not read kernel memory directly, but removing a tcx/netkit filtering/isolation program (e.g., a Cilium network policy) can expose traffic or services that were previously confidential, a limited information exposure.\nI:H - An unprivileged user can make an unauthorized, CAP_NET_ADMIN-level modification to the device\u0027s network datapath, and by repeating the call can remove all attached programs, fully subverting the configured network security/policy enforcement.\nA:H - Removing the tcx/netkit datapath program disrupts packet processing for the affected device; in eBPF-datapath deployments this breaks forwarding/NAT/policy and causes loss of network connectivity for the node or its workloads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:59.729Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e1623e7d61faf16cbadc80550da874303611ff5"
},
{
"url": "https://git.kernel.org/stable/c/0c249f523175963b0a746bba673ecebdf6cefd86"
},
{
"url": "https://git.kernel.org/stable/c/4e0772cded109c238411f2fac36ac39302758b81"
},
{
"url": "https://git.kernel.org/stable/c/3f04cc1e5374da4c5e791ae010a06cfea7bacbe6"
},
{
"url": "https://git.kernel.org/stable/c/ae23bc81ddf7c17b663c4ed1b21e35527b0a7131"
}
],
"title": "bpf: Fix tcx/netkit detach permissions when prog fd isn\u0027t given",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45932",
"datePublished": "2026-05-27T12:17:50.353Z",
"dateReserved": "2026-05-13T15:03:33.086Z",
"dateUpdated": "2026-10-21T12:40:59.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99019 (GCVE-0-2026-99019)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ch: Do not keep references to data transfer element devices
ch_readconfig() looks up the scsi_device of every data transfer element
whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in
ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops
it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere
else - it only supplies the vendor, model and revision printed in the same
loop.
Once such a drive is removed, its scsi_device can never be released. It
stays on the host's device list at its address, so a new device there is
refused by anything that walks the list - target_core_pscsi reports
"scsi_device_get() failed for H:C:T:L" - and the low-level driver's module
can no longer be unloaded. Only a reboot recovers.
It shows with any changer that reports its drives' ids; with the mhvtl
virtual library (IBM 3573-TL personality), each create and remove of a
library with four drives leaves four references behind, counted by the
module's use count in lsmod. With ch not bound the count is unchanged, and
with this patch applied it is unchanged too.
Drop the reference as soon as the name has been printed, and remove the now
unused dt[] array. That also removes the array leaked when ch_probe() fails
after ch_readconfig().
The same leak was reported with an RFC patch in 2022, which was not merged.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda Version: daa6eda65a53e5addf86c6bc829129ff51b08bda |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/ch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7412c6fb671dda9776deebb283daf0bb2f1b48e5",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "03287b176e8f7cc5680a7053e2d53bd5cb05d80c",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "72ad7b08ffd5d9495715db0d74ce325a485f1b52",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "ec6ecab1b7577ae555ee6b81480814d123dd9ec0",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "cef2cedb6f7a394b278775b3d6ffb9b20ecd61db",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "a34a230ccea1b8b667ae59dca11295a2c8f81738",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "1d35a17f1c2ed4154731895694a1a3557f0da766",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
},
{
"lessThan": "27c0f718d3b3c99e6d315308e95d987d0382a8a8",
"status": "affected",
"version": "daa6eda65a53e5addf86c6bc829129ff51b08bda",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/ch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.13"
},
{
"lessThan": "2.6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ch: Do not keep references to data transfer element devices\n\nch_readconfig() looks up the scsi_device of every data transfer element\nwhose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in\nch-\u003edt[]. scsi_device_lookup() takes a reference, and nothing ever drops\nit: ch_destroy() frees the array with kfree(). ch-\u003edt[] is read nowhere\nelse - it only supplies the vendor, model and revision printed in the same\nloop.\n\nOnce such a drive is removed, its scsi_device can never be released. It\nstays on the host\u0027s device list at its address, so a new device there is\nrefused by anything that walks the list - target_core_pscsi reports\n\"scsi_device_get() failed for H:C:T:L\" - and the low-level driver\u0027s module\ncan no longer be unloaded. Only a reboot recovers.\n\nIt shows with any changer that reports its drives\u0027 ids; with the mhvtl\nvirtual library (IBM 3573-TL personality), each create and remove of a\nlibrary with four drives leaves four references behind, counted by the\nmodule\u0027s use count in lsmod. With ch not bound the count is unchanged, and\nwith this patch applied it is unchanged too.\n\nDrop the reference as soon as the name has been printed, and remove the now\nunused dt[] array. That also removes the array leaked when ch_probe() fails\nafter ch_readconfig().\n\nThe same leak was reported with an RFC patch in 2022, which was not merged."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:58.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7412c6fb671dda9776deebb283daf0bb2f1b48e5"
},
{
"url": "https://git.kernel.org/stable/c/03287b176e8f7cc5680a7053e2d53bd5cb05d80c"
},
{
"url": "https://git.kernel.org/stable/c/72ad7b08ffd5d9495715db0d74ce325a485f1b52"
},
{
"url": "https://git.kernel.org/stable/c/ec6ecab1b7577ae555ee6b81480814d123dd9ec0"
},
{
"url": "https://git.kernel.org/stable/c/cef2cedb6f7a394b278775b3d6ffb9b20ecd61db"
},
{
"url": "https://git.kernel.org/stable/c/a34a230ccea1b8b667ae59dca11295a2c8f81738"
},
{
"url": "https://git.kernel.org/stable/c/1d35a17f1c2ed4154731895694a1a3557f0da766"
},
{
"url": "https://git.kernel.org/stable/c/27c0f718d3b3c99e6d315308e95d987d0382a8a8"
}
],
"title": "scsi: ch: Do not keep references to data transfer element devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99019",
"datePublished": "2026-10-23T12:20:55.832Z",
"dateReserved": "2026-09-25T10:25:14.386Z",
"dateUpdated": "2026-10-30T12:40:58.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72388 (GCVE-0-2026-72388)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
Since dma_fence objects can be shared with other subsystems, they may be
accessed from hardirq context in those drivers, and we have to take
that into account by also using the IRQ-safe variant when acquiring
the lock.
While at it, switch to the guard model.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1804a760422a7d75eb6e1fc0638aaff18d1dde88",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "9de9e8f279de0c299631f530de66c51642eef50a",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "2946aa6c97ac0e0d777baef8c0e6d944da8724a3",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "778c57d624974e64535ef1c9d9b4d8e5066153f4",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Always use the IRQ-safe variant when acquiring the fence lock\n\nSince dma_fence objects can be shared with other subsystems, they may be\naccessed from hardirq context in those drivers, and we have to take\nthat into account by also using the IRQ-safe variant when acquiring\nthe lock.\n\nWhile at it, switch to the guard model."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:47.279Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1804a760422a7d75eb6e1fc0638aaff18d1dde88"
},
{
"url": "https://git.kernel.org/stable/c/9de9e8f279de0c299631f530de66c51642eef50a"
},
{
"url": "https://git.kernel.org/stable/c/2946aa6c97ac0e0d777baef8c0e6d944da8724a3"
},
{
"url": "https://git.kernel.org/stable/c/778c57d624974e64535ef1c9d9b4d8e5066153f4"
}
],
"title": "drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72388",
"datePublished": "2026-08-15T05:56:17.918Z",
"dateReserved": "2026-08-09T03:40:39.923Z",
"dateUpdated": "2026-10-21T12:44:47.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53000 (GCVE-0-2026-53000)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nat: use kfree_rcu to release ops
Florian Westphal says:
"Historically this is not an issue, even for normal base hooks: the data
path doesn't use the original nf_hook_ops that are used to register the
callbacks.
However, in v5.14 I added the ability to dump the active netfilter
hooks from userspace.
This code will peek back into the nf_hook_ops that are available
at the tail of the pointer-array blob used by the datapath.
The nat hooks are special, because they are called indirectly from
the central nat dispatcher hook. They are currently invisible to
the nfnl hook dump subsystem though.
But once that changes the nat ops structures have to be deferred too."
Update nf_nat_register_fn() to deal with partial exposition of the hooks
from error path which can be also an issue for nfnetlink_hook.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 Version: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 Version: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 Version: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 Version: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 Version: e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.98.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.45.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.141.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s netfilter component, specifically within the Network Address Translation (NAT) subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system crash, leading to a Denial of Service (DoS), or to gain unauthorized access to sensitive information due to the partial exposure of internal hook data during error handling."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "Release of Invalid Pointer or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:04:39.036Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53000"
},
{
"name": "RHBZ#2492273",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492273"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53000.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55445"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68100"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:64808"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:68100: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:67720: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:64808: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: netfilter: nat: use kfree_rcu to release ops",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53000",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:26.886742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "CWE-763 Release of Invalid Pointer or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:12.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/netfilter/iptable_nat.c",
"net/ipv6/netfilter/ip6table_nat.c",
"net/netfilter/nf_nat_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf17f1d3b307196d9282c4b1dd8be0d0e5f8e529",
"status": "affected",
"version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
"versionType": "git"
},
{
"lessThan": "ede973d62d26d9c550269af05366ab9e30fc92ee",
"status": "affected",
"version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
"versionType": "git"
},
{
"lessThan": "050f98e56782b14677c5bae50800e60775bbf6bb",
"status": "affected",
"version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
"versionType": "git"
},
{
"lessThan": "32fdd2e38e7435a368d88f5977a7d6585ebc8b0e",
"status": "affected",
"version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
"versionType": "git"
},
{
"lessThan": "3c7511f38ab511b791196b13ae48bf4973bf7dfd",
"status": "affected",
"version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
"versionType": "git"
},
{
"lessThan": "6eda0d771f94267f73f57c94630aa47e90957915",
"status": "affected",
"version": "e2cf17d3774c323ef6dab6e9f7c0cfc5e742afd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/netfilter/iptable_nat.c",
"net/ipv6/netfilter/ip6table_nat.c",
"net/netfilter/nf_nat_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nat: use kfree_rcu to release ops\n\nFlorian Westphal says:\n\n\"Historically this is not an issue, even for normal base hooks: the data\npath doesn\u0027t use the original nf_hook_ops that are used to register the\ncallbacks.\n\nHowever, in v5.14 I added the ability to dump the active netfilter\nhooks from userspace.\n\nThis code will peek back into the nf_hook_ops that are available\nat the tail of the pointer-array blob used by the datapath.\n\nThe nat hooks are special, because they are called indirectly from\nthe central nat dispatcher hook. They are currently invisible to\nthe nfnl hook dump subsystem though.\n\nBut once that changes the nat ops structures have to be deferred too.\"\n\nUpdate nf_nat_register_fn() to deal with partial exposition of the hooks\nfrom error path which can be also an issue for nfnetlink_hook."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local netfilter/nfnetlink operations, including hook dumps and NAT hook registration/unregistration via netlink or xtables control paths. Remote packets may traverse NAT hooks, but the unsafe freed nf_hook_ops metadata is exposed through local control-plane operations.\nAC:L - The relevant race is between hook dumping and NAT hook teardown/error unwind, and an attacker with netfilter control can drive both sides concurrently. There are no required conditions outside the attacker\u2019s influence beyond normal scheduling.\nPR:L - The paths require CAP_NET_ADMIN in the target network namespace. Netfilter/nftables operations are reachable by an unprivileged local user through user and network namespaces, so this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution. The attacker can issue the netlink/xtables operations directly.\nS:U - The impact is within the same kernel security authority and represents a standard local kernel memory-safety issue. It does not cross a VM, IOMMU, or similar separate security boundary.\nC:H - This is a use-after-free of kernel heap objects referenced by RCU-visible hook metadata. Reclaiming the freed object can drive kernel reads through attacker-influenced nf_hook_ops fields, making high confidentiality impact defensible.\nI:H - A kernel use-after-free is a memory corruption primitive and may be leveraged beyond a crash with heap grooming. Following the higher-severity rule for UAFs, arbitrary modification or code execution is defensible.\nA:H - The stale hook metadata can be dereferenced after free in kernel context. At minimum this can cause an oops/panic, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:25.872Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf17f1d3b307196d9282c4b1dd8be0d0e5f8e529"
},
{
"url": "https://git.kernel.org/stable/c/ede973d62d26d9c550269af05366ab9e30fc92ee"
},
{
"url": "https://git.kernel.org/stable/c/050f98e56782b14677c5bae50800e60775bbf6bb"
},
{
"url": "https://git.kernel.org/stable/c/32fdd2e38e7435a368d88f5977a7d6585ebc8b0e"
},
{
"url": "https://git.kernel.org/stable/c/3c7511f38ab511b791196b13ae48bf4973bf7dfd"
},
{
"url": "https://git.kernel.org/stable/c/6eda0d771f94267f73f57c94630aa47e90957915"
}
],
"title": "netfilter: nat: use kfree_rcu to release ops",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53000",
"datePublished": "2026-06-24T16:29:12.635Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-10-30T12:26:25.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89654 (GCVE-0-2026-89654)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix UAF in check_new_map() on session freed during unlock
check_new_map() iterates mdsc->sessions[] and for each active session
drops mdsc->mutex to perform per-session operations. The forced-close
path (rank removed from map) correctly takes a reference on s via
ceph_get_mds_session() before releasing mdsc->mutex, but three other
paths do not:
Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex)
Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s)
Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)
Without the extra reference, another thread can acquire mdsc->mutex
during the unlock window, call __unregister_session() which drops the
last reference on s, and free it. The original thread then accesses
freed memory via s->s_mutex.
Fix by adding ceph_get_mds_session(s) before each mutex_unlock and
ceph_put_mds_session(s) after the corresponding mutex_lock, matching
the pattern already used in the forced-close path.
Race timeline (Path A):
Thread A (check_new_map) Thread B (another map update
holds mdsc->mutex or session teardown)
-------------------------- --------------------------
s = mdsc->sessions[i]
(refcount == 1, held only by
sessions[] array)
mutex_unlock(&mdsc->mutex)
---> acquires mdsc->mutex
__unregister_session(mdsc, s)
sessions[i] = NULL
ceph_put_mds_session(s)
refcount: 1 -> 0
kfree(s) <--- freed!
mutex_lock(&s->s_mutex)
UAF on freed s->s_mutex
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 Version: 2f2dc053404febedc9c273452d9d518fb31fde72 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:25.205939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:47.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/mds_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "989343b7ee5b1a08778be0c7c4bf6030d3910807",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "352a278d5a1965aae3f817ce5d24a67ee42d45d1",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "820871e9dbeecd2533c4c5f5d91878ceaf02324c",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "9646dfee880730aae4b379a4b8ee6c88ac735acd",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "21d5be092d947f8d83f76f7ebf3989e7e9230a98",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
},
{
"lessThan": "ee611a7509554c4ca1f54f6aefe592fb1df7ea70",
"status": "affected",
"version": "2f2dc053404febedc9c273452d9d518fb31fde72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/mds_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc-\u003esessions[] and for each active session\ndrops mdsc-\u003emutex to perform per-session operations. The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc-\u003emutex, but three other\npaths do not:\n\n Path A (address changed): mutex_unlock \u2192 mutex_lock(\u0026s-\u003es_mutex)\n Path B (reconnect): mutex_unlock \u2192 send_mds_reconnect(mdsc, s)\n Path C (active transition): mutex_unlock \u2192 mutex_lock(\u0026s-\u003es_mutex)\n\nWithout the extra reference, another thread can acquire mdsc-\u003emutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it. The original thread then accesses\nfreed memory via s-\u003es_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n Thread A (check_new_map) Thread B (another map update\n holds mdsc-\u003emutex or session teardown)\n -------------------------- --------------------------\n s = mdsc-\u003esessions[i]\n (refcount == 1, held only by\n sessions[] array)\n\n mutex_unlock(\u0026mdsc-\u003emutex)\n ---\u003e acquires mdsc-\u003emutex\n __unregister_session(mdsc, s)\n sessions[i] = NULL\n ceph_put_mds_session(s)\n refcount: 1 -\u003e 0\n kfree(s) \u003c--- freed!\n\n mutex_lock(\u0026s-\u003es_mutex)\n UAF on freed s-\u003es_mutex"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - check_new_map() runs from ceph_mdsc_handle_mdsmap() on CEPH_MSG_MDS_MAP received over TCP from a monitor (extra_mon_dispatch) or MDS (mds_dispatch); a malicious or compromised Ceph peer reaches the UAF on already-mounted CephFS clients without a local syscall.\nAC:L - A cluster attacker controls both race sides: one TCP session delivers an MDS map that drops mdsc-\u003emutex in the address-change, reconnect, or active-transition paths, while another concurrently sends a rank-removing map, CEPH_SESSION_CLOSE, or connection reset into __unregister_session(); Path B\u0027s send_mds_reconnect() GFP_NOFS work makes the window retryable.\nPR:N - The attacker acts as the remote MON/MDS peer, or an on-path attacker on a legacy unsigned msgr session, and needs no UID, capability, or init-namespace root on the victim; any kernel CephFS client already connected to that cluster is exposed.\nUI:N - Once CephFS is mounted, as is standard on Rook/Kubernetes, HPC, and cloud nodes, MDS-map updates and session teardown messages are processed automatically in ceph-msgr kworker context with no further victim mount, open, or interactive action.\nS:U - The session-object use-after-free corrupts kernel heap on the client host within the same security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of struct ceph_mds_session allows reclaim of the freed object so later reads of session fields, embedded connection state, and cap lists can disclose arbitrary kernel memory, matching CNA guidance that UAFs enable high confidentiality impact.\nI:H - The same reclaimed session is written (s_mutex, s_state, ceph_con_close, reconnect and cap-kick paths), enabling heap corruption and hijack of the embedded ceph_connection ops for arbitrary kernel writes and control-flow hijacking.\nA:H - Locking or dereferencing the freed session mutex and fields causes a kernel oops or panic, and the attacker can repeat map updates and session teardown to trigger the crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:33.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/989343b7ee5b1a08778be0c7c4bf6030d3910807"
},
{
"url": "https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1"
},
{
"url": "https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c"
},
{
"url": "https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd"
},
{
"url": "https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98"
},
{
"url": "https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70"
}
],
"title": "ceph: fix UAF in check_new_map() on session freed during unlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89654",
"datePublished": "2026-09-11T19:45:44.086Z",
"dateReserved": "2026-09-11T19:38:34.743Z",
"dateUpdated": "2026-10-30T12:32:33.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80668 (GCVE-0-2026-80668)
Vulnerability from cvelistv5
Published
2026-08-28 06:49
Modified
2026-11-06 17:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
This patch replaces the timer API by GC worker approach for
expectations, as it already happened in many other subsystems.
Use the existing conntrack GC worker to iterate over the local list of
expectations in the master conntrack to reap expired expectations.
Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct
expectation which nevers sets it. Hold the expectation spinlock while
iterating over the master conntrack expectation list to synchronize with
nf_ct_remove_expectations(). This also performs runtime packet path
garbage collection through the expectation insertion and lookup
functions while walking over one of the chains of the global expectation
hashtables. Unconfirmed conntrack entries are skipped since ct->ext can
be reallocated and dying are skipped since those will be gone soon.
Set on IPS_HELPER_BIT if the helper ct extension is added, then the new
GC worker does not need to bump the ct refcount to check if the ct->ext
helper is available.
This removes the extra bump on the refcount for expectation timers, this
allows to remove several nf_ct_expect_put() calls after the unlink,
after this update only refcount remains at 1 while on the expectation
hashes.
This patch implicitly addresses a race with the existing timer API
allowing an expectation to access a stale exp->master pointer which has
been already released when expectation removal loses races with an
expiring timer, ie. timer_del() reporting false.
Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This
is needed by nf_conntrack_unexpect_related() which is called in error
paths to invalidate newly created expectations that has been added into
the hashes. These expectactions cannot be inmediately released as GC or
nf_ct_remove_expectations() could race to make it. On expectation
insert, the runtime GC reaps stale expectations before checking the
expectation limit set by policy.
Set current timestamp in nf_ct_expect_alloc(), then add the expectation
policy timeout (or custom timeout specified added on top of this) to
specify the expectation lifetime.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9e1196d27ef496f404c76f7a9d03761142d991c4 Version: 5e1c1d22268ae710c238342c8030c21daf298168 Version: d52fa1fa7440676b8c238037a050ab008c22737f Version: f338ced0473849c9f6ed0b77ca99f1aab5826787 Version: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 Version: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 Version: 497f99b26fffdc5635706d1b4811f1ed8ee21a5b Version: 6.1.176 ≤ Version: 6.6.143 ≤ Version: 6.12.94 ≤ Version: 6.18.24 ≤ Version: 6.19.14 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:19:36.318697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:32.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_expect.h",
"include/uapi/linux/netfilter/nf_conntrack_common.h",
"net/netfilter/nf_conntrack_core.c",
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_h323_main.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nft_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61ca26e1a45965590f7e477c4d6f711162642e1c",
"status": "affected",
"version": "9e1196d27ef496f404c76f7a9d03761142d991c4",
"versionType": "git"
},
{
"lessThan": "3d7b808ec35291ee75dcdb2b6fe5f587bfe9b1df",
"status": "affected",
"version": "5e1c1d22268ae710c238342c8030c21daf298168",
"versionType": "git"
},
{
"lessThan": "02f7809a19fc88cfd9bc113a4bfe7add6305db39",
"status": "affected",
"version": "d52fa1fa7440676b8c238037a050ab008c22737f",
"versionType": "git"
},
{
"lessThan": "bc6b1da681abe631ed21b7fdced48546189d64a4",
"status": "affected",
"version": "f338ced0473849c9f6ed0b77ca99f1aab5826787",
"versionType": "git"
},
{
"lessThan": "7ec786f4230c2a9b2eaf97a2d45368933b49d2b2",
"status": "affected",
"version": "bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5",
"versionType": "git"
},
{
"lessThan": "b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2",
"status": "affected",
"version": "bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5",
"versionType": "git"
},
{
"status": "affected",
"version": "497f99b26fffdc5635706d1b4811f1ed8ee21a5b",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThan": "6.18.61",
"status": "affected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_expect.h",
"include/uapi/linux/netfilter/nf_conntrack_common.h",
"net/netfilter/nf_conntrack_core.c",
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_h323_main.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nft_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.61",
"versionStartIncluding": "6.18.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: use conntrack GC to reap expectations\n\nThis patch replaces the timer API by GC worker approach for\nexpectations, as it already happened in many other subsystems.\n\nUse the existing conntrack GC worker to iterate over the local list of\nexpectations in the master conntrack to reap expired expectations.\nCheck IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct\nexpectation which nevers sets it. Hold the expectation spinlock while\niterating over the master conntrack expectation list to synchronize with\nnf_ct_remove_expectations(). This also performs runtime packet path\ngarbage collection through the expectation insertion and lookup\nfunctions while walking over one of the chains of the global expectation\nhashtables. Unconfirmed conntrack entries are skipped since ct-\u003eext can\nbe reallocated and dying are skipped since those will be gone soon.\nSet on IPS_HELPER_BIT if the helper ct extension is added, then the new\nGC worker does not need to bump the ct refcount to check if the ct-\u003eext\nhelper is available.\n\nThis removes the extra bump on the refcount for expectation timers, this\nallows to remove several nf_ct_expect_put() calls after the unlink,\nafter this update only refcount remains at 1 while on the expectation\nhashes.\n\nThis patch implicitly addresses a race with the existing timer API\nallowing an expectation to access a stale exp-\u003emaster pointer which has\nbeen already released when expectation removal loses races with an\nexpiring timer, ie. timer_del() reporting false.\n\nAdd a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This\nis needed by nf_conntrack_unexpect_related() which is called in error\npaths to invalidate newly created expectations that has been added into\nthe hashes. These expectactions cannot be inmediately released as GC or\nnf_ct_remove_expectations() could race to make it. On expectation\ninsert, the runtime GC reaps stale expectations before checking the\nexpectation limit set by policy.\n\nSet current timestamp in nf_ct_expect_alloc(), then add the expectation\npolicy timeout (or custom timeout specified added on top of this) to\nspecify the expectation lifetime."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote attackers can create expectations via conntrack ALG helpers (FTP, SIP, H.323, etc.) on internet-facing NAT/firewalls when processing attacker packets in nf_confirm, then trigger the timer-vs-teardown race during master connection expiry.\nAC:L - The attacker controls both sides of the race by opening/closing the master connection and timing traffic against the expectation timer; parallel sessions allow reliable retries without depending on uncontrollable layout or victim state.\nPR:N - Only initial helper/NAT configuration needs admin privilege; exploitation requires no kernel credentials\u2014a remote protocol client can create expectations and drive teardown on typical edge gateways and VoIP/NAT deployments.\nUI:N - No victim interaction beyond the attacker\u0027s own network sessions; triggering helper-driven expectation creation and subsequent connection teardown does not require any local user action.\nS:U - Impact is kernel heap use-after-free within the same host security domain and does not cross VM, container, or IOMMU boundaries absent separate escalation.\nC:H - nf_ct_unlink_expect and nf_ct_find_expectation dereference exp-\u003emaster after the master nf_conn is freed when timer_delete fails, a classic slab UAF enabling arbitrary kernel memory disclosure via heap grooming.\nI:H - Freed struct nf_conn reuse lets an attacker corrupt kernel heap metadata or object contents, defensibly enabling arbitrary write or control-flow hijack beyond the immediate stale pointer dereference.\nA:H - Accessing the freed master conntrack in the expectation timeout or lookup path can cause immediate kernel oops/panic, and UAF corruption can crash or hang the system even during failed exploit attempts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:14:57.837Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61ca26e1a45965590f7e477c4d6f711162642e1c"
},
{
"url": "https://git.kernel.org/stable/c/3d7b808ec35291ee75dcdb2b6fe5f587bfe9b1df"
},
{
"url": "https://git.kernel.org/stable/c/02f7809a19fc88cfd9bc113a4bfe7add6305db39"
},
{
"url": "https://git.kernel.org/stable/c/bc6b1da681abe631ed21b7fdced48546189d64a4"
},
{
"url": "https://git.kernel.org/stable/c/7ec786f4230c2a9b2eaf97a2d45368933b49d2b2"
},
{
"url": "https://git.kernel.org/stable/c/b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2"
}
],
"title": "netfilter: nf_conntrack_expect: use conntrack GC to reap expectations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80668",
"datePublished": "2026-08-28T06:49:09.877Z",
"dateReserved": "2026-08-26T14:34:25.782Z",
"dateUpdated": "2026-11-06T17:14:57.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80734 (GCVE-0-2026-80734)
Vulnerability from cvelistv5
Published
2026-09-03 08:21
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: initialize inode mapping flags for cached inodes
[BUG]
When running generic/795 with 8K block size, 4K page size, the test
always fails, triggering some ASSERT()s related to folio size:
795 (241074): drop_caches: 3
assertion failed: IS_ALIGNED(start, blocksize) && IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (blocksize=8192 root=262 ino=258 start=16826368 end=16830463 mapping min order=0)
------------[ cut here ]------------
kernel BUG at extent_io.c:1404!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 8 UID: 0 PID: 241105 Comm: fsstress Tainted: G OE 7.2.0-rc5-custom+ #442 PREEMPT(full) f4bfb352566f3949f29c233ce6f735050a03b245
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:assert_folio_range.cold+0x3d/0x3f [btrfs]
Call Trace:
<TASK>
btrfs_read_folio+0x9e/0x170 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
prepare_one_folio.constprop.0+0x104/0x2a0 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
btrfs_buffered_write+0x285/0xa50 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
btrfs_do_write_iter+0x1aa/0x210 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]
iter_file_splice_write+0x31a/0x540
direct_splice_actor+0x53/0x170
splice_direct_to_actor+0xe9/0x240
do_splice_direct+0x76/0xb0
vfs_copy_file_range+0x1fd/0x630
__x64_sys_copy_file_range+0xf9/0x220
do_syscall_64+0xe1/0x790
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
---[ end trace 0000000000000000 ]---
The ASSERT() itself is added by a later patch.
The crash is triggered with that new debug patch, and without this fix.
[CAUSE]
In the above case, the start 16826368 is properly 8K aligned, but the
end (16830463 + 1) is not 8K aligned.
Furthermore the mapping's minimal folio order is 0, not the expected 1
for 8K block size with 4K page size.
So this means some inodes do not have btrfs_set_inode_mapping_order()
called on it.
The missing btrfs_set_inode_mapping_order() call happens for cached
inodes, through the following events:
- btrfs_create_new_inode() called for inode X
Which properly sets minimal folio order for the VFS inode.
- btrfs_update_inode() called for inode X
Which calls btrfs_delayed_update_inode() to create a delayed_node
into root->delayed_nodes xarray.
- Drop cache/memory pressure, evicting in-memory inode X
Which evicted the inode X, but delayed_node is still in
root->delayed_nodes for future reuse.
- btrfs_iget() for inode X called again
btrfs_iget()
|- btrfs_iget_locked()
| |- iget5_locked_rcu()
| Which creates a new vfs_inode for btrfs, whose mapping still
| has the minimal order as 0.
|
|- btrfs_read_locked_inode()
|- btrfs_fill_inode()
| |- btrfs_get_delayed_node()
| Which found out the previous node, and use that delayed
| node to initialize the new inode.
|
|- filled = true;
|- if (filled) goto cache_index;
Which skips the btrfs_update_inode_mapping_flags() and
btrfs_set_inode_mapping_order() calls.
So the inode still has minimal folio order set as 0, not
the required 1.
Thus later page cache read will get a folio whose size is smaller than
block size, as the mapping has its minimal folio order set as 0 not 1,
then trigger the ASSERT().
[FIX]
Move the btrfs_update_inode_mapping_flags() and
btrfs_set_inode_mapping_order() calls under cache_index label,
so that the mapping flags and minimal folio order is always set
no matter if we have a cached inode.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 01b002151539a4c2b27bfff9af033329a9b659e7 Version: ecde48a1a6b3256bd49db8780bf37556b157783c Version: ecde48a1a6b3256bd49db8780bf37556b157783c Version: ecde48a1a6b3256bd49db8780bf37556b157783c Version: ae584726e6eddf6cfbe49b3f4a78b3197716b6f8 Version: 6.12.111 ≤ Version: 6.14.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4d997a1ec1d0dbb72dde35a99fda1850fee6a53",
"status": "affected",
"version": "01b002151539a4c2b27bfff9af033329a9b659e7",
"versionType": "git"
},
{
"lessThan": "e18b8236c57fcc67d793bfc866f4bb2581be9f72",
"status": "affected",
"version": "ecde48a1a6b3256bd49db8780bf37556b157783c",
"versionType": "git"
},
{
"lessThan": "0d26249671171ab759cb4fdce673554a690fa655",
"status": "affected",
"version": "ecde48a1a6b3256bd49db8780bf37556b157783c",
"versionType": "git"
},
{
"lessThan": "0ef349734a93227b45f65fc50a3311d1cc5f03e9",
"status": "affected",
"version": "ecde48a1a6b3256bd49db8780bf37556b157783c",
"versionType": "git"
},
{
"status": "affected",
"version": "ae584726e6eddf6cfbe49b3f4a78b3197716b6f8",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: initialize inode mapping flags for cached inodes\n\n[BUG]\nWhen running generic/795 with 8K block size, 4K page size, the test\nalways fails, triggering some ASSERT()s related to folio size:\n\n 795 (241074): drop_caches: 3\n assertion failed: IS_ALIGNED(start, blocksize) \u0026\u0026 IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (blocksize=8192 root=262 ino=258 start=16826368 end=16830463 mapping min order=0)\n ------------[ cut here ]------------\n kernel BUG at extent_io.c:1404!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 8 UID: 0 PID: 241105 Comm: fsstress Tainted: G OE 7.2.0-rc5-custom+ #442 PREEMPT(full) f4bfb352566f3949f29c233ce6f735050a03b245\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n RIP: 0010:assert_folio_range.cold+0x3d/0x3f [btrfs]\n Call Trace:\n \u003cTASK\u003e\n btrfs_read_folio+0x9e/0x170 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n prepare_one_folio.constprop.0+0x104/0x2a0 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n btrfs_buffered_write+0x285/0xa50 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n btrfs_do_write_iter+0x1aa/0x210 [btrfs 4cd1dd93b341b8ef766643f9512f4a86259567a3]\n iter_file_splice_write+0x31a/0x540\n direct_splice_actor+0x53/0x170\n splice_direct_to_actor+0xe9/0x240\n do_splice_direct+0x76/0xb0\n vfs_copy_file_range+0x1fd/0x630\n __x64_sys_copy_file_range+0xf9/0x220\n do_syscall_64+0xe1/0x790\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nThe ASSERT() itself is added by a later patch.\nThe crash is triggered with that new debug patch, and without this fix.\n\n[CAUSE]\nIn the above case, the start 16826368 is properly 8K aligned, but the\nend (16830463 + 1) is not 8K aligned.\nFurthermore the mapping\u0027s minimal folio order is 0, not the expected 1\nfor 8K block size with 4K page size.\n\nSo this means some inodes do not have btrfs_set_inode_mapping_order()\ncalled on it.\n\nThe missing btrfs_set_inode_mapping_order() call happens for cached\ninodes, through the following events:\n\n- btrfs_create_new_inode() called for inode X\n Which properly sets minimal folio order for the VFS inode.\n\n- btrfs_update_inode() called for inode X\n Which calls btrfs_delayed_update_inode() to create a delayed_node\n into root-\u003edelayed_nodes xarray.\n\n- Drop cache/memory pressure, evicting in-memory inode X\n Which evicted the inode X, but delayed_node is still in\n root-\u003edelayed_nodes for future reuse.\n\n- btrfs_iget() for inode X called again\n\n btrfs_iget()\n |- btrfs_iget_locked()\n | |- iget5_locked_rcu()\n | Which creates a new vfs_inode for btrfs, whose mapping still\n | has the minimal order as 0.\n |\n |- btrfs_read_locked_inode()\n |- btrfs_fill_inode()\n | |- btrfs_get_delayed_node()\n | Which found out the previous node, and use that delayed\n | node to initialize the new inode.\n |\n |- filled = true;\n |- if (filled) goto cache_index;\n Which skips the btrfs_update_inode_mapping_flags() and\n\tbtrfs_set_inode_mapping_order() calls.\n\tSo the inode still has minimal folio order set as 0, not\n\tthe required 1.\n\nThus later page cache read will get a folio whose size is smaller than\nblock size, as the mapping has its minimal folio order set as 0 not 1,\nthen trigger the ASSERT().\n\n[FIX]\nMove the btrfs_update_inode_mapping_flags() and\nbtrfs_set_inode_mapping_order() calls under cache_index label,\nso that the mapping flags and minimal folio order is always set\nno matter if we have a cached inode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The fault is reached from vfs_copy_file_range/splice buffered-write paths on btrfs inodes (as in the xfstest repro); on NFS-exported btrfs volumes remote clients can drive the same VFS copy_file_range path via nfsd NFSv4 COPY, making this network-reachable on NAS deployments.\nAC:L - Once a btrfs volume uses CONFIG_BTRFS_EXPERIMENTAL blocksize\u003epagesize, an attacker can deterministically create the delayed-node/evict/re-iget sequence with ordinary writes plus memory pressure (xfstest generic/795 reproduces reliably) without uncontrollable races or layout luck.\nPR:L - Triggering requires only write access to files on a mounted btrfs filesystem (or an authenticated NFS/SMB client with export write permission); no init-namespace root or non-namespace capabilities are needed beyond normal filesystem access.\nUI:N - No victim interaction is required; the attacker issues their own copy_file_range/write/splice syscalls (or remote COPY) after creating the inode state, without needing another user to mount, open, or click anything.\nS:U - Impact is confined to incorrect btrfs page-cache I/O and filesystem data/kernel stability on the host; it does not cross VM, container, IOMMU, or other security-authority boundaries.\nC:H - Skipping btrfs_set_inode_mapping_order leaves 4K folios on 8K-sector volumes, so read paths operate on block-misaligned ranges and can return stale adjacent on-disk sectors into attacker buffers, disclosing other users\u0027 btrfs file content on shared volumes.\nI:H - Wrong mapping min folio order and stable-writes flags break btrfs block-aligned buffered I/O invariants, allowing misaligned writes/checksum-unsafe writeback that can persist corrupted data and violate CoW/checksum integrity on the affected volume.\nA:H - The bug provokes kernel BUG/oops via assert_folio_range on misaligned folio ranges (documented in the fix commit), and blocks_per_folio becomes zero when folio_size\u003csectorsize, breaking subpage bitmap assumptions and risking further kernel faults or wedged I/O."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:00.597Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4d997a1ec1d0dbb72dde35a99fda1850fee6a53"
},
{
"url": "https://git.kernel.org/stable/c/e18b8236c57fcc67d793bfc866f4bb2581be9f72"
},
{
"url": "https://git.kernel.org/stable/c/0d26249671171ab759cb4fdce673554a690fa655"
},
{
"url": "https://git.kernel.org/stable/c/0ef349734a93227b45f65fc50a3311d1cc5f03e9"
}
],
"title": "btrfs: initialize inode mapping flags for cached inodes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80734",
"datePublished": "2026-09-03T08:21:50.734Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-10-21T12:47:00.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80616 (GCVE-0-2026-80616)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
It's pointless to call WARN_ON() in case of an allocation failure in
dev_change_net_namespace() and device_rename(), since it only leads to
useless splats caused by deliberate fault injections, so avoid it.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 Version: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 Version: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 Version: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 Version: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 Version: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ieee802154/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6ff703da843d665ce7fc3fe5c202cf8121cc2a1f",
"status": "affected",
"version": "66e5c2672cd11b9310008099faf6a4ffb9dfb6d0",
"versionType": "git"
},
{
"lessThan": "c67e70202cfd602f86d3e59fe6fffecaf4110f40",
"status": "affected",
"version": "66e5c2672cd11b9310008099faf6a4ffb9dfb6d0",
"versionType": "git"
},
{
"lessThan": "f300e68014cf10af9aa0c0ad958750a8509c8e44",
"status": "affected",
"version": "66e5c2672cd11b9310008099faf6a4ffb9dfb6d0",
"versionType": "git"
},
{
"lessThan": "f4860dd988b1041d70595f2ed84de80f90cb7ebc",
"status": "affected",
"version": "66e5c2672cd11b9310008099faf6a4ffb9dfb6d0",
"versionType": "git"
},
{
"lessThan": "6fcba77571c53f656a2f109259601a7570d4c74a",
"status": "affected",
"version": "66e5c2672cd11b9310008099faf6a4ffb9dfb6d0",
"versionType": "git"
},
{
"lessThan": "0569f67ed6a7af838e2141da93c68e6b6013f483",
"status": "affected",
"version": "66e5c2672cd11b9310008099faf6a4ffb9dfb6d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ieee802154/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()\n\nIt\u0027s pointless to call WARN_ON() in case of an allocation failure in\ndev_change_net_namespace() and device_rename(), since it only leads to\nuseless splats caused by deliberate fault injections, so avoid it.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:43.551Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6ff703da843d665ce7fc3fe5c202cf8121cc2a1f"
},
{
"url": "https://git.kernel.org/stable/c/c67e70202cfd602f86d3e59fe6fffecaf4110f40"
},
{
"url": "https://git.kernel.org/stable/c/f300e68014cf10af9aa0c0ad958750a8509c8e44"
},
{
"url": "https://git.kernel.org/stable/c/f4860dd988b1041d70595f2ed84de80f90cb7ebc"
},
{
"url": "https://git.kernel.org/stable/c/6fcba77571c53f656a2f109259601a7570d4c74a"
},
{
"url": "https://git.kernel.org/stable/c/0569f67ed6a7af838e2141da93c68e6b6013f483"
}
],
"title": "ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80616",
"datePublished": "2026-08-28T06:48:36.911Z",
"dateReserved": "2026-08-26T14:34:25.774Z",
"dateUpdated": "2026-10-30T12:30:43.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46032 (GCVE-0-2026-46032)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit()
returns an error code that is ignored by most callers, and continues to
run L1 with corrupted state. A sane recovery is not possible in this
case, and HW behavior is to cause a shutdown. Inject a triple fault
instead, and do not return early from nested_svm_vmexit(). Continue
cleaning up the vCPU state (e.g. clear pending exceptions), to handle
the failure as gracefully as possible.
From the APM:
Upon #VMEXIT, the processor performs the following actions in order to
return to the host execution context:
...
if (illegal host state loaded, or exception while loading host state)
shutdown
else
execute first host instruction following the VMRUN
Remove the return value of nested_svm_vmexit(), which is mostly
unchecked anyway.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d82aaef9c88aa27bce63751d6d6329920b1fe8da Version: d82aaef9c88aa27bce63751d6d6329920b1fe8da Version: d82aaef9c88aa27bce63751d6d6329920b1fe8da Version: d82aaef9c88aa27bce63751d6d6329920b1fe8da Version: d82aaef9c88aa27bce63751d6d6329920b1fe8da Version: d82aaef9c88aa27bce63751d6d6329920b1fe8da |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46032",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:05:49.470870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:33.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/svm/svm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e6318570a9b4e137b0b744832b920b38bb069561",
"status": "affected",
"version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
"versionType": "git"
},
{
"lessThan": "2e661773890e6ba6b16064fad961da3dd311be43",
"status": "affected",
"version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
"versionType": "git"
},
{
"lessThan": "af79992ecdb6817970d757fb5d853b8d9b55a0d6",
"status": "affected",
"version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
"versionType": "git"
},
{
"lessThan": "b0eb0a8959ac2b808eb11548d002fe1f9b5650cc",
"status": "affected",
"version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
"versionType": "git"
},
{
"lessThan": "9a738cf170a4a2332ea3a15e23ec65b5757fe4a1",
"status": "affected",
"version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
"versionType": "git"
},
{
"lessThan": "5d291ef0585ed880ed4dd71ea1a5965e0a65fb53",
"status": "affected",
"version": "d82aaef9c88aa27bce63751d6d6329920b1fe8da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/svm/svm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT\n\nIf loading L1\u0027s CR3 fails on a nested #VMEXIT, nested_svm_vmexit()\nreturns an error code that is ignored by most callers, and continues to\nrun L1 with corrupted state. A sane recovery is not possible in this\ncase, and HW behavior is to cause a shutdown. Inject a triple fault\ninstead, and do not return early from nested_svm_vmexit(). Continue\ncleaning up the vCPU state (e.g. clear pending exceptions), to handle\nthe failure as gracefully as possible.\n\nFrom the APM:\n\n Upon #VMEXIT, the processor performs the following actions in order to\n return to the host execution context:\n\n ...\n\n if (illegal host state loaded, or exception while loading host state)\n shutdown\n else\n execute first host instruction following the VMRUN\n\nRemove the return value of nested_svm_vmexit(), which is mostly\nunchecked anyway."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:57.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e6318570a9b4e137b0b744832b920b38bb069561"
},
{
"url": "https://git.kernel.org/stable/c/2e661773890e6ba6b16064fad961da3dd311be43"
},
{
"url": "https://git.kernel.org/stable/c/af79992ecdb6817970d757fb5d853b8d9b55a0d6"
},
{
"url": "https://git.kernel.org/stable/c/b0eb0a8959ac2b808eb11548d002fe1f9b5650cc"
},
{
"url": "https://git.kernel.org/stable/c/9a738cf170a4a2332ea3a15e23ec65b5757fe4a1"
},
{
"url": "https://git.kernel.org/stable/c/5d291ef0585ed880ed4dd71ea1a5965e0a65fb53"
}
],
"title": "KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46032",
"datePublished": "2026-05-27T12:56:41.159Z",
"dateReserved": "2026-05-13T15:03:33.093Z",
"dateUpdated": "2026-11-06T16:13:33.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93058 (GCVE-0-2026-93058)
Vulnerability from cvelistv5
Published
2026-09-17 16:10
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Only fini scheduler after successful init
msm_ringbuffer_new() destroys a partially initialized ring through
msm_ringbuffer_destroy() when an allocation or scheduler setup step
fails.
If drm_sched_init() fails before it finishes initializing the scheduler,
the failure path still calls drm_sched_fini(). That teardown path assumes
the scheduler work items, lists, and workqueue state were initialized.
Track successful scheduler initialization and call drm_sched_fini() only
after drm_sched_init() returned 0.
This issue was found by a static analysis checker and confirmed by
manual source review.
Patchwork: https://patchwork.freedesktop.org/patch/738905/
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 Version: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 Version: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 Version: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 Version: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 Version: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_ringbuffer.c",
"drivers/gpu/drm/msm/msm_ringbuffer.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "20ea0ae8e90702acca83467207db4c9bd8c8bd03",
"status": "affected",
"version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
"versionType": "git"
},
{
"lessThan": "bd2a5a876904eaf688a093cd73986abc3571f26b",
"status": "affected",
"version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
"versionType": "git"
},
{
"lessThan": "aafc9258efeec98fcb7e3998356b4b25bf1ad159",
"status": "affected",
"version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
"versionType": "git"
},
{
"lessThan": "d43e1bbfd43458b9242806eec77ea3b032134baf",
"status": "affected",
"version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
"versionType": "git"
},
{
"lessThan": "09b360eb6ce345996a30fad8c86e9df80f41cd7e",
"status": "affected",
"version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
"versionType": "git"
},
{
"lessThan": "e2332abed2a4d3caa59052095dc16e4ce44791ea",
"status": "affected",
"version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_ringbuffer.c",
"drivers/gpu/drm/msm/msm_ringbuffer.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Only fini scheduler after successful init\n\nmsm_ringbuffer_new() destroys a partially initialized ring through\nmsm_ringbuffer_destroy() when an allocation or scheduler setup step\nfails.\n\nIf drm_sched_init() fails before it finishes initializing the scheduler,\nthe failure path still calls drm_sched_fini(). That teardown path assumes\nthe scheduler work items, lists, and workqueue state were initialized.\n\nTrack successful scheduler initialization and call drm_sched_fini() only\nafter drm_sched_init() returned 0.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review.\n\nPatchwork: https://patchwork.freedesktop.org/patch/738905/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:47.517Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/20ea0ae8e90702acca83467207db4c9bd8c8bd03"
},
{
"url": "https://git.kernel.org/stable/c/bd2a5a876904eaf688a093cd73986abc3571f26b"
},
{
"url": "https://git.kernel.org/stable/c/aafc9258efeec98fcb7e3998356b4b25bf1ad159"
},
{
"url": "https://git.kernel.org/stable/c/d43e1bbfd43458b9242806eec77ea3b032134baf"
},
{
"url": "https://git.kernel.org/stable/c/09b360eb6ce345996a30fad8c86e9df80f41cd7e"
},
{
"url": "https://git.kernel.org/stable/c/e2332abed2a4d3caa59052095dc16e4ce44791ea"
}
],
"title": "drm/msm: Only fini scheduler after successful init",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93058",
"datePublished": "2026-09-17T16:10:45.793Z",
"dateReserved": "2026-09-17T15:57:05.659Z",
"dateUpdated": "2026-10-30T12:35:47.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64146 (GCVE-0-2026-64146)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix metabuf leak in inode xattr initialization
commit bb88e8da0025 ("erofs: use meta buffers for xattr operations")
converted xattr operations to use on-stack erofs_buf instances.
erofs_init_inode_xattrs() uses such a metabuf while reading the inline
xattr header and shared xattr id array.
Some error paths after erofs_read_metabuf() leave through out_unlock
without dropping the metabuf, so the folio reference can leak.
Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a
no-op if no folio has been acquired, and this keeps all paths after
taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bb88e8da00253bea0e7f0f4cdfd7910572d7799f Version: bb88e8da00253bea0e7f0f4cdfd7910572d7799f Version: bb88e8da00253bea0e7f0f4cdfd7910572d7799f Version: bb88e8da00253bea0e7f0f4cdfd7910572d7799f Version: bb88e8da00253bea0e7f0f4cdfd7910572d7799f Version: bb88e8da00253bea0e7f0f4cdfd7910572d7799f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:30:42.615572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:27.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89682dd09efb3825b0f162a72e342c52b69ea14a",
"status": "affected",
"version": "bb88e8da00253bea0e7f0f4cdfd7910572d7799f",
"versionType": "git"
},
{
"lessThan": "3812cfe6cb0a5988df4fedcdaf9aab677b9cca61",
"status": "affected",
"version": "bb88e8da00253bea0e7f0f4cdfd7910572d7799f",
"versionType": "git"
},
{
"lessThan": "e4a552e0b6413c1af2e140b5bc14bb849b411b57",
"status": "affected",
"version": "bb88e8da00253bea0e7f0f4cdfd7910572d7799f",
"versionType": "git"
},
{
"lessThan": "fcb23bb31508b62e8a1b32adf6217820e90e29b0",
"status": "affected",
"version": "bb88e8da00253bea0e7f0f4cdfd7910572d7799f",
"versionType": "git"
},
{
"lessThan": "492c73b21fefa36f3869cb2b188ffb7fe37b3a9b",
"status": "affected",
"version": "bb88e8da00253bea0e7f0f4cdfd7910572d7799f",
"versionType": "git"
},
{
"lessThan": "79b09c54c6563df9846ca3094bcfd72082c3e1d7",
"status": "affected",
"version": "bb88e8da00253bea0e7f0f4cdfd7910572d7799f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix metabuf leak in inode xattr initialization\n\ncommit bb88e8da0025 (\"erofs: use meta buffers for xattr operations\")\nconverted xattr operations to use on-stack erofs_buf instances.\nerofs_init_inode_xattrs() uses such a metabuf while reading the inline\nxattr header and shared xattr id array.\n\nSome error paths after erofs_read_metabuf() leave through out_unlock\nwithout dropping the metabuf, so the folio reference can leak.\n\nConsolidate the cleanup at out_unlock. erofs_put_metabuf() is a\nno-op if no folio has been acquired, and this keeps all paths after\ntaking EROFS_I_BL_XATTR_BIT covered by a single cleanup site."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:38.382Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89682dd09efb3825b0f162a72e342c52b69ea14a"
},
{
"url": "https://git.kernel.org/stable/c/3812cfe6cb0a5988df4fedcdaf9aab677b9cca61"
},
{
"url": "https://git.kernel.org/stable/c/e4a552e0b6413c1af2e140b5bc14bb849b411b57"
},
{
"url": "https://git.kernel.org/stable/c/fcb23bb31508b62e8a1b32adf6217820e90e29b0"
},
{
"url": "https://git.kernel.org/stable/c/492c73b21fefa36f3869cb2b188ffb7fe37b3a9b"
},
{
"url": "https://git.kernel.org/stable/c/79b09c54c6563df9846ca3094bcfd72082c3e1d7"
}
],
"title": "erofs: fix metabuf leak in inode xattr initialization",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64146",
"datePublished": "2026-07-19T15:40:37.474Z",
"dateReserved": "2026-07-19T07:54:57.037Z",
"dateUpdated": "2026-11-06T16:34:27.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72321 (GCVE-0-2026-72321)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
When a timer is deleted and not re-armed in igmp_mod_timer(), or stopped
in igmp_stop_timer(), the code currently decrements the reference counter
of the multicast list entry @im using refcount_dec(&im->refcnt).
However, both functions can be called from the RCU reader path:
- igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu()
- igmp_stop_timer() via igmp_rcv() -> igmp_heard_report()
If the group im was concurrently removed from the list by ip_mc_dec_group(),
its reference count might have already been decremented to 1.
In this case, timer_delete() succeeds, and refcount_dec() decrements
the refcount from 1 to 0. Since refcount_dec() does not free the object
when it hits 0 (unlike ip_ma_put()), the im structure is leaked.
Fix this by using ip_ma_put(im) instead of refcount_dec(&im->refcnt),
and deferring the put until after the spinlock is released.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/igmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4fe30f4671033a27fba077b3976dc113ffc0169",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2d0effadf8d2cc9d006e4c4ab0ab6737aed28d77",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "40d6360ccf9bcbe17b5cb248a84e8e004aac2faa",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f60ec3058a85447008b88b762c859d336163acb3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "95128dc74425ec19ed4f2077ccc651e791ff4b75",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/igmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026im-\u003erefcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u003e for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u003e igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026im-\u003erefcnt),\nand deferring the put until after the spinlock is released."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:02.891Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4fe30f4671033a27fba077b3976dc113ffc0169"
},
{
"url": "https://git.kernel.org/stable/c/2d0effadf8d2cc9d006e4c4ab0ab6737aed28d77"
},
{
"url": "https://git.kernel.org/stable/c/40d6360ccf9bcbe17b5cb248a84e8e004aac2faa"
},
{
"url": "https://git.kernel.org/stable/c/f60ec3058a85447008b88b762c859d336163acb3"
},
{
"url": "https://git.kernel.org/stable/c/95128dc74425ec19ed4f2077ccc651e791ff4b75"
},
{
"url": "https://git.kernel.org/stable/c/3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36"
}
],
"title": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72321",
"datePublished": "2026-08-15T05:55:33.547Z",
"dateReserved": "2026-08-09T03:40:39.919Z",
"dateUpdated": "2026-10-30T12:29:02.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63853 (GCVE-0-2026-63853)
Vulnerability from cvelistv5
Published
2026-07-19 14:04
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
VCN encoder and decoder rings do not support 64-bit user fence writes,
reject CS submissions with user fences.
(cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827d9)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8da1170a16e4d4b49fa07d1f75ad480847ff7eca Version: 8da1170a16e4d4b49fa07d1f75ad480847ff7eca Version: 8da1170a16e4d4b49fa07d1f75ad480847ff7eca Version: 8da1170a16e4d4b49fa07d1f75ad480847ff7eca Version: 8da1170a16e4d4b49fa07d1f75ad480847ff7eca Version: 8da1170a16e4d4b49fa07d1f75ad480847ff7eca |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:32:17.901838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:51.666Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "772f83fc70b797ac88d696671780eaf175cc7f31",
"status": "affected",
"version": "8da1170a16e4d4b49fa07d1f75ad480847ff7eca",
"versionType": "git"
},
{
"lessThan": "525cc9df654365c147ae61e5562cf599ea2257f7",
"status": "affected",
"version": "8da1170a16e4d4b49fa07d1f75ad480847ff7eca",
"versionType": "git"
},
{
"lessThan": "d8df8918677136b018d71d0b94a1f6b816715946",
"status": "affected",
"version": "8da1170a16e4d4b49fa07d1f75ad480847ff7eca",
"versionType": "git"
},
{
"lessThan": "1286b6872de0aee1feeeaa6dbac86369806de9a5",
"status": "affected",
"version": "8da1170a16e4d4b49fa07d1f75ad480847ff7eca",
"versionType": "git"
},
{
"lessThan": "6bdd2ed6458d35c368fbe9550a4d7f342abd3a92",
"status": "affected",
"version": "8da1170a16e4d4b49fa07d1f75ad480847ff7eca",
"versionType": "git"
},
{
"lessThan": "51f694221047c84fa185be98210eb2c354ffb8c6",
"status": "affected",
"version": "8da1170a16e4d4b49fa07d1f75ad480847ff7eca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827d9)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires submitting a crafted AMDGPU command stream through DRM_IOCTL_AMDGPU_CS on a local /dev/dri/renderD* device; there is no network, adjacent-radio, or physical-access path to the vulnerable VCN v4.0 unified encoder ring handling.\nAC:L - An attacker with render-node access can deterministically submit a CS containing an AMDGPU_CHUNK_ID_FENCE chunk targeting the VCN encoder ring; no race, special timing, or victim state beyond having a VCN 4.0-capable AMDGPU is required.\nPR:L - The path is reachable by any local user who can open the DRM render node (typically membership in the render/video group on desktops, workstations, and cloud GPU VMs); it does not require real root in the init namespace.\nUI:N - Triggering the bug is fully programmatic via ioctl-based CS submission and does not require any victim to open files, mount filesystems, or perform other interactive actions.\nS:U - Impact is confined to the AMDGPU/VCN driver and GPU resources of the submitting security context; it does not cross a VM, container, or IOMMU security boundary to affect a different authority.\nC:H - Without the no_user_fence guard, amdgpu_ib_commit emits a 64-bit user fence (AMDGPU_FENCE_FLAG_64BIT) on a ring whose emit_fence path only supports 32-bit fence writes, causing the VCN hardware to perform an unvalidated GPU DMA write that can corrupt adjacent GPU-mapped memory and be leveraged for information disclosure.\nI:H - The same rogue GPU-initiated fence write is a memory-corruption primitive that can modify GPU-accessible buffers (including shared dma-buf mappings) outside the intended 8-byte fence field, enabling integrity violations and potential further exploitation.\nA:H - Malformed fence/trap commands on the VCN unified encoder ring can hang or fault the VCN block and force GPU/driver reset, denying graphics and compute availability to all users of the device on shared workstations and servers."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:16.028Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/772f83fc70b797ac88d696671780eaf175cc7f31"
},
{
"url": "https://git.kernel.org/stable/c/525cc9df654365c147ae61e5562cf599ea2257f7"
},
{
"url": "https://git.kernel.org/stable/c/d8df8918677136b018d71d0b94a1f6b816715946"
},
{
"url": "https://git.kernel.org/stable/c/1286b6872de0aee1feeeaa6dbac86369806de9a5"
},
{
"url": "https://git.kernel.org/stable/c/6bdd2ed6458d35c368fbe9550a4d7f342abd3a92"
},
{
"url": "https://git.kernel.org/stable/c/51f694221047c84fa185be98210eb2c354ffb8c6"
}
],
"title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63853",
"datePublished": "2026-07-19T14:04:43.885Z",
"dateReserved": "2026-07-19T07:54:57.016Z",
"dateUpdated": "2026-10-30T12:27:16.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38207 (GCVE-0-2025-38207)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: fix uprobe pte be overwritten when expanding vma
Patch series "Fix uprobe pte be overwritten when expanding vma".
This patch (of 4):
We encountered a BUG alert triggered by Syzkaller as follows:
BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1
And we can reproduce it with the following steps:
1. register uprobe on file at zero offset
2. mmap the file at zero offset:
addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0);
3. mremap part of vma1 to new vma2:
addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE);
4. mremap back to orig addr1:
mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1);
In step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2
with range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1
to vma2, then unmap the vma1 range [addr1, addr1 + 4096].
In step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the
addr range [addr1, addr1 + 4096]. Since the addr range [addr1 + 4096,
addr1 + 8192] still maps the file, it will take vma_merge_new_range to
expand the range, and then do uprobe_mmap in vma_complete. Since the
merged vma pgoff is also zero offset, it will install uprobe anon page to
the merged vma. However, the upcomming move_page_tables step, which use
set_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite
the newly uprobe pte in the merged vma, and lead that pte to be orphan.
Since the uprobe pte will be remapped to the merged vma, we can remove the
unnecessary uprobe_mmap upon merged vma.
This problem was first found in linux-6.6.y and also exists in the
community syzkaller:
https://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/vma.c",
"mm/vma.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7030046a9b4de8199a3cbc3de20366d95dce2142",
"status": "affected",
"version": "2b144498350860b6ee9dc57ff27a93ad488de5dc",
"versionType": "git"
},
{
"lessThan": "58b83b9a9a929611a2a2e7d88f45cb0d786b7ee0",
"status": "affected",
"version": "2b144498350860b6ee9dc57ff27a93ad488de5dc",
"versionType": "git"
},
{
"lessThan": "2b12d06c37fd3a394376f42f026a7478d826ed63",
"status": "affected",
"version": "2b144498350860b6ee9dc57ff27a93ad488de5dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/vma.c",
"mm/vma.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix uprobe pte be overwritten when expanding vma\n\nPatch series \"Fix uprobe pte be overwritten when expanding vma\".\n\n\nThis patch (of 4):\n\nWe encountered a BUG alert triggered by Syzkaller as follows:\n BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1\n\nAnd we can reproduce it with the following steps:\n1. register uprobe on file at zero offset\n2. mmap the file at zero offset:\n addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0);\n3. mremap part of vma1 to new vma2:\n addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE);\n4. mremap back to orig addr1:\n mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1);\n\nIn step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2\nwith range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1\nto vma2, then unmap the vma1 range [addr1, addr1 + 4096].\n\nIn step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the\naddr range [addr1, addr1 + 4096]. Since the addr range [addr1 + 4096,\naddr1 + 8192] still maps the file, it will take vma_merge_new_range to\nexpand the range, and then do uprobe_mmap in vma_complete. Since the\nmerged vma pgoff is also zero offset, it will install uprobe anon page to\nthe merged vma. However, the upcomming move_page_tables step, which use\nset_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite\nthe newly uprobe pte in the merged vma, and lead that pte to be orphan.\n\nSince the uprobe pte will be remapped to the merged vma, we can remove the\nunnecessary uprobe_mmap upon merged vma.\n\nThis problem was first found in linux-6.6.y and also exists in the\ncommunity syzkaller:\nhttps://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:52.413Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7030046a9b4de8199a3cbc3de20366d95dce2142"
},
{
"url": "https://git.kernel.org/stable/c/58b83b9a9a929611a2a2e7d88f45cb0d786b7ee0"
},
{
"url": "https://git.kernel.org/stable/c/2b12d06c37fd3a394376f42f026a7478d826ed63"
}
],
"title": "mm: fix uprobe pte be overwritten when expanding vma",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38207",
"datePublished": "2025-07-04T13:37:27.508Z",
"dateReserved": "2025-04-16T04:51:23.994Z",
"dateUpdated": "2026-10-21T12:36:52.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72366 (GCVE-0-2026-72366)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix netfs_create_write_req() to handle async cache object creation
netfs_create_write_req() will skip caching if the fscache cookie is
disabled, but this is a problem because async cache object creation might
not have got far enough yet that has been enabled - thereby causing the
call to fscache_begin_write_operation() to be skipped.
Fix this by removing the checks on the cookie and delegating this to
fscache_begin_write_operation().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/write_issue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aee03fbc8803a40d65e20f1af816a7219048a426",
"status": "affected",
"version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
"versionType": "git"
},
{
"lessThan": "8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a",
"status": "affected",
"version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
"versionType": "git"
},
{
"lessThan": "1188a9846fadeacf9d1430b528e5217f749d665b",
"status": "affected",
"version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
"versionType": "git"
},
{
"lessThan": "dbd6f56d975b23241b7bbb11bb8f562af548a0aa",
"status": "affected",
"version": "7b589a9b45ae32aa9d7bece597490e141198d7a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/write_issue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix netfs_create_write_req() to handle async cache object creation\n\nnetfs_create_write_req() will skip caching if the fscache cookie is\ndisabled, but this is a problem because async cache object creation might\nnot have got far enough yet that has been enabled - thereby causing the\ncall to fscache_begin_write_operation() to be skipped.\n\nFix this by removing the checks on the cookie and delegating this to\nfscache_begin_write_operation()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in netfs client write/cache coordination for CIFS, NFS+fscache, Ceph, AFS, and 9p. A malicious remote filesystem server can deliver file data and control protocol timing to drive async fscache object creation and subsequent kernel writeback over the network.\nAC:L - The attacker controls both sides of the race by interleaving reads and writes or triggering writeback while the fscache cookie is still in CREATING/LOOKING_UP; the async-creation window can be hit reliably with retries, not conditions outside attacker influence.\nPR:N - A malicious NFS/SMB/Ceph server needs no privileges on the victim client; once a fscache-enabled mount to that server exists, exploitation requires only ordinary file access or automated writeback, not real root or init-namespace capabilities.\nUI:N - After a triggering read from the remote server, kernel writeback can invoke netfs_writepages without further victim action; an attacker with file access can also drive the race directly through concurrent read/write syscalls.\nS:U - Impact is kernel heap/folio corruption during local pagecache I/O within the same kernel security authority; it does not inherently cross VM, container, IOMMU, or sandbox boundaries.\nC:H - Skipping fscache_begin_write_operation desynchronizes cache and writeback streams; the same netfs/fscache subsystem previously produced UAFs when PG_private_2 coordination failed, enabling disclosure via freed/reused folio memory.\nI:H - Inconsistent dual-stream write completion can free or reuse folios while still referenced, yielding heap corruption primitives that related netfs fscache bugs have leveraged for arbitrary kernel writes and privilege escalation.\nA:H - The related netfs fscache fix documented kernel oops, ceph caps warnings, RCU expedited stalls, and UAF crashes from this coordination failure class; skipping required cache setup can oops, panic, or hang the system during writeback."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:41.841Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aee03fbc8803a40d65e20f1af816a7219048a426"
},
{
"url": "https://git.kernel.org/stable/c/8ab75e445c161c4cb504aa98e20ce1dd1ecd8e9a"
},
{
"url": "https://git.kernel.org/stable/c/1188a9846fadeacf9d1430b528e5217f749d665b"
},
{
"url": "https://git.kernel.org/stable/c/dbd6f56d975b23241b7bbb11bb8f562af548a0aa"
}
],
"title": "netfs: Fix netfs_create_write_req() to handle async cache object creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72366",
"datePublished": "2026-08-15T05:56:04.016Z",
"dateReserved": "2026-08-09T03:40:39.922Z",
"dateUpdated": "2026-10-21T12:44:41.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53281 (GCVE-0-2026-53281)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
fixed a NULL pointer dereference in an unlikely situation partly.
If dev_pasid is not found in the dev_pasids list, it remains NULL.
However, the teardown operations are executed unconditionally, this lead
to a NULL pointer dereference or refcount corruption.
If the domain was never attached to this IOMMU, info will be NULL, which
would cause an immediate dereference when checking --info->refcnt.
Even if info is not NULL, decrementing the refcount without having removed
a valid PASID might unbalance the count. This could lead to premature
dropping of the refcount to 0, potentially causing a use-after-free for the
remaining active devices sharing the domain.
Fix it by returning early if dev_pasid is NULL, before executing the
teardown operations.
Issue found by AI review and suggested by Kevin Tian.
https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 68ec78beb4a3fb0877cbaaf49758c85410c05977 Version: 60f030f7418d3f1d94f2fb207fe3080e1844630b Version: 60f030f7418d3f1d94f2fb207fe3080e1844630b Version: 60f030f7418d3f1d94f2fb207fe3080e1844630b Version: df96876be3b064aefc493f760e0639765d13ed0d Version: 6.12.57 ≤ Version: 6.13.3 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.40.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.31.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Input-Output Memory Management Unit (IOMMU) virtualized direct memory access (VT-d) component. This vulnerability occurs when the system attempts to perform cleanup operations without a valid device identifier, leading to a null pointer dereference or incorrect management of resource references. An attacker with local access could exploit this to cause a system crash, resulting in a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:04:49.598Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53281"
},
{
"name": "RHBZ#2493728",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493728"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53281.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47040"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:47017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:47040: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-26T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:28:22.564890Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:43.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1a677f9c5e02c4ae49614044ac21296660d1391",
"status": "affected",
"version": "68ec78beb4a3fb0877cbaaf49758c85410c05977",
"versionType": "git"
},
{
"lessThan": "9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153",
"status": "affected",
"version": "60f030f7418d3f1d94f2fb207fe3080e1844630b",
"versionType": "git"
},
{
"lessThan": "cdfe3c9f2c9e28a8651ee463c88ad191ced2f840",
"status": "affected",
"version": "60f030f7418d3f1d94f2fb207fe3080e1844630b",
"versionType": "git"
},
{
"lessThan": "79ea2feb917b05366b49d85573c9c5331f043b2c",
"status": "affected",
"version": "60f030f7418d3f1d94f2fb207fe3080e1844630b",
"versionType": "git"
},
{
"status": "affected",
"version": "df96876be3b064aefc493f760e0639765d13ed0d",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.57",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid NULL pointer dereference or refcount corruption\n\nCommit 60f030f7418d (\"iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE\")\nfixed a NULL pointer dereference in an unlikely situation partly.\n\nIf dev_pasid is not found in the dev_pasids list, it remains NULL.\nHowever, the teardown operations are executed unconditionally, this lead\nto a NULL pointer dereference or refcount corruption.\n\nIf the domain was never attached to this IOMMU, info will be NULL, which\nwould cause an immediate dereference when checking --info-\u003erefcnt.\n\nEven if info is not NULL, decrementing the refcount without having removed\na valid PASID might unbalance the count. This could lead to premature\ndropping of the refcount to 0, potentially causing a use-after-free for the\nremaining active devices sharing the domain.\n\nFix it by returning early if dev_pasid is NULL, before executing the\nteardown operations.\n\nIssue found by AI review and suggested by Kevin Tian.\nhttps://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable VT-d PASID teardown path is reached through local IOMMU/VFIO/SVA device-management operations such as iommufd/VFIO PASID attach, detach, replace, or device reset recovery. It is not reachable by network packets or adjacent radio protocols.\nAC:L - The relevant paths are normal serialized attach/detach/reset flows and do not require winning an attacker-uncontrolled race. A PASID-capable Intel IOMMU device and suitable VFIO/SVA setup are prerequisites for the affected subsystem, but triggering the vulnerable teardown is otherwise straightforward in that environment.\nPR:L - The attacker needs local access to a PASID-capable VFIO/iommufd or SVA-capable accelerator device node, which can be delegated to an unprivileged userspace process such as QEMU or accelerator clients. It does not inherently require real root in the initial namespace once device access is granted.\nUI:N - No separate victim action is required after the attacker controls the local device-management file descriptors. The attacker can initiate the attach/detach/close/reset-triggering sequence directly.\nS:C - The corruption is in IOMMU/PASID domain bookkeeping that enforces DMA isolation for devices. Premature domain refcount teardown can affect resources outside the intended device/DMA translation boundary.\nC:H - Although one failure mode is a NULL dereference, the fix explicitly identifies refcount corruption that can prematurely free domain metadata and create a use-after-free for remaining active devices. Under the required conservative scoring rule, that memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The same refcount corruption/use-after-free in IOMMU domain metadata can plausibly be exploited for kernel memory corruption or DMA isolation manipulation. Under the required conservative scoring rule, this supports high integrity impact.\nA:H - If the domain was never attached to the IOMMU, `domain_detach_iommu()` can immediately dereference NULL and crash the kernel. The refcount corruption path can also lead to use-after-free crashes, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:23.877Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1a677f9c5e02c4ae49614044ac21296660d1391"
},
{
"url": "https://git.kernel.org/stable/c/9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153"
},
{
"url": "https://git.kernel.org/stable/c/cdfe3c9f2c9e28a8651ee463c88ad191ced2f840"
},
{
"url": "https://git.kernel.org/stable/c/79ea2feb917b05366b49d85573c9c5331f043b2c"
}
],
"title": "iommu/vt-d: Avoid NULL pointer dereference or refcount corruption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53281",
"datePublished": "2026-06-26T19:40:43.040Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-10-21T12:42:23.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90289 (GCVE-0-2026-90289)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Resize MST HDCP per-connector arrays to 32
AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of
32 connectors. But the way it's used is like MAX_DISPLAY_COUNT.
Hence we're off by one with DRM core, which supports a max of 32
connectors.
Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT
to match its actual use, and increase the size to 32 to match the
originally intended size.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d90f97cb3821c47bdf773dcf6cade143773ec764 Version: 82986fd631fa04bcedaefe11a6b3767601cbe84f Version: 82986fd631fa04bcedaefe11a6b3767601cbe84f Version: 82986fd631fa04bcedaefe11a6b3767601cbe84f Version: 82986fd631fa04bcedaefe11a6b3767601cbe84f Version: 82986fd631fa04bcedaefe11a6b3767601cbe84f Version: 99c444d3c3c43db354b253d9bfac081073dcb484 Version: 6.1.47 ≤ Version: 5.15.128 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c",
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1c22294c7d9b3b1c26a18ca4eca8c863a5a0d907",
"status": "affected",
"version": "d90f97cb3821c47bdf773dcf6cade143773ec764",
"versionType": "git"
},
{
"lessThan": "decea8279bec5a35413b2cb8e36951cca308fac0",
"status": "affected",
"version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
"versionType": "git"
},
{
"lessThan": "ac490fea9fe74f9d9975c5d8250c8719750589cd",
"status": "affected",
"version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
"versionType": "git"
},
{
"lessThan": "562d24ac214ba9530d88841088eb6adce5c537b5",
"status": "affected",
"version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
"versionType": "git"
},
{
"lessThan": "0fa116a17b69a28712cdf209318e345b676d7f6c",
"status": "affected",
"version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
"versionType": "git"
},
{
"lessThan": "261e0fe4e2c99f687114b64b10b98db964b475f4",
"status": "affected",
"version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
"versionType": "git"
},
{
"status": "affected",
"version": "99c444d3c3c43db354b253d9bfac081073dcb484",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.47",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.128",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c",
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.128",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Resize MST HDCP per-connector arrays to 32\n\nAMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of\n32 connectors. But the way it\u0027s used is like MAX_DISPLAY_COUNT.\nHence we\u0027re off by one with DRM core, which supports a max of 32\nconnectors.\n\nRename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT\nto match its actual use, and increase the size to 32 to match the\noriginally intended size."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - hdcp_update_display() and update_config() index hdcp_workqueue.aconnector[] with aconnector-\u003ebase.index from drm_connector_init_only()\u0027s ida_alloc_max(..., 31). The path is DRM_IOCTL_MODE_ATOMIC \u2192 drm_mode_atomic_ioctl \u2192 amdgpu_dm_atomic_commit_tail \u2192 amdgpu_dm_update_hdcp()/update_psp_stream_config(); dm_dp_mst_get_modes() is reached from DRM_IOCTL_MODE_GETCONNECTOR. The index is kernel-assigned, not a protocol field.\nAC:L - No race or layout lottery: drm_connector_init_only() can assign index 31, and dm_dp_add_mst_connector() creates MST connectors until that id is used. A DRM-master atomic commit that enables that connector calls update_config(), which does hdcp_w-\u003eaconnector[conn_index] with no bounds check. hdcp_create_workqueue() is created by default on Raven-and-later GPUs.\nPR:L - drm_mode_atomic_ioctl and drm_mode_obj_set_property_ioctl are DRM_MASTER in drm_ioctl.c; drm_mode_getconnector() only calls fill_modes when drm_is_current_master(). logind grants DRM master to the seated unprivileged video/render-group user on typical AMDGPU desktops, laptops, and cloud GPU instances, so init-namespace root is not required.\nUI:N - The DRM-master attacker triggers the OOB with their own DRM_IOCTL_MODE_ATOMIC (stream enable through update_psp_stream_config(), or Content Protection via amdgpu_dm_update_hdcp()) on the index-31 connector; no other user must mount media, open a file, or attach a display on the attacker\u0027s behalf.\nS:U - aconnector[31] overwrites the following hdcp_workqueue.mutex in the same host-kernel AMDGPU HDCP object; the corruption and any oops stay inside that kernel authority and do not cross a KVM/Xen, IOMMU, or sandbox boundary.\nC:H - hdcp_update_display() holds hdcp_w-\u003emutex then reads aconnector[31], which overlays mutex.owner (the locked task_struct *). A non-NULL owner is treated as amdgpu_dm_connector * and drm_connector_put(\u0026...-\u003ebase) follows it. dm_dp_mst_get_modes() also copies hdcp_content_type[31]/content_protection[31] into connector state readable via GETCONNECTOR.\nI:H - hdcp_update_display() and update_config() write aconnector[31]=aconnector, storing an amdgpu_dm_connector * over mutex.owner while the lock is held. amdgpu_dm_update_hdcp() also writes hdcp_content_type[connector-\u003eindex] and content_protection[connector-\u003eindex] on MST. That is an out-of-bounds write into adjacent hdcp_workqueue fields.\nA:H - drm_connector_put() on mutex.owner type-confused as amdgpu_dm_connector, and later lock operations on a mutex whose owner was replaced by a connector pointer, oops or panic the kernel in amdgpu_dm_atomic_commit_tail/HDCP workqueue paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:03.620Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c22294c7d9b3b1c26a18ca4eca8c863a5a0d907"
},
{
"url": "https://git.kernel.org/stable/c/decea8279bec5a35413b2cb8e36951cca308fac0"
},
{
"url": "https://git.kernel.org/stable/c/ac490fea9fe74f9d9975c5d8250c8719750589cd"
},
{
"url": "https://git.kernel.org/stable/c/562d24ac214ba9530d88841088eb6adce5c537b5"
},
{
"url": "https://git.kernel.org/stable/c/0fa116a17b69a28712cdf209318e345b676d7f6c"
},
{
"url": "https://git.kernel.org/stable/c/261e0fe4e2c99f687114b64b10b98db964b475f4"
}
],
"title": "drm/amd/display: Resize MST HDCP per-connector arrays to 32",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90289",
"datePublished": "2026-09-17T16:08:17.368Z",
"dateReserved": "2026-09-11T19:38:34.798Z",
"dateUpdated": "2026-10-30T12:35:03.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90333 (GCVE-0-2026-90333)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: replace forgeable discard filler with a keyed sector marker
The discard-block check in dm_integrity_rw_tag() treats a stored tag
of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and
skips HMAC verification. allow_discards is only accepted in
dm-integrity's standalone mode. An attacker with raw write access to
the backing device, but without the integrity key, can stamp any block
with an all-0xf6 tag and have it served as authentic.
Add a new "allow_discards_keyed" target argument that marks discarded
blocks with a keyed checksum of (salt || sector) instead, computed by
integrity_discard_checksum().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/admin-guide/device-mapper/dm-ima.rst",
"Documentation/admin-guide/device-mapper/dm-integrity.rst",
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "388c3f6496bb8083576d989e6d249ba9807c6b0b",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "6228722c27304e4682cddc1fede03898f87e4414",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "68c5c42567bc462139128968ebbfadd0aefff519",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/admin-guide/device-mapper/dm-ima.rst",
"Documentation/admin-guide/device-mapper/dm-integrity.rst",
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: replace forgeable discard filler with a keyed sector marker\n\nThe discard-block check in dm_integrity_rw_tag() treats a stored tag\nof all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and\nskips HMAC verification. allow_discards is only accepted in\ndm-integrity\u0027s standalone mode. An attacker with raw write access to\nthe backing device, but without the integrity key, can stamp any block\nwith an all-0xf6 tag and have it served as authentic.\n\nAdd a new \"allow_discards_keyed\" target argument that marks discarded\nblocks with a keyed checksum of (salt || sector) instead, computed by\nintegrity_discard_checksum()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:03.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/388c3f6496bb8083576d989e6d249ba9807c6b0b"
},
{
"url": "https://git.kernel.org/stable/c/5c58ea19a909ef6bed4f0f824e9cd7e30d7e4775"
},
{
"url": "https://git.kernel.org/stable/c/6228722c27304e4682cddc1fede03898f87e4414"
},
{
"url": "https://git.kernel.org/stable/c/68c5c42567bc462139128968ebbfadd0aefff519"
}
],
"title": "dm-integrity: replace forgeable discard filler with a keyed sector marker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90333",
"datePublished": "2026-09-17T16:08:46.805Z",
"dateReserved": "2026-09-11T19:38:34.803Z",
"dateUpdated": "2026-10-21T12:51:03.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40136 (GCVE-0-2025-40136)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: hisilicon/qm - request reserved interrupt for virtual function
The device interrupt vector 3 is an error interrupt for
physical function and a reserved interrupt for virtual function.
However, the driver has not registered the reserved interrupt for
virtual function. When allocating interrupts, the number of interrupts
is allocated based on powers of two, which includes this interrupt.
When the system enables GICv4 and the virtual function passthrough
to the virtual machine, releasing the interrupt in the driver
triggers a warning.
The WARNING report is:
WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4
Therefore, register a reserved interrupt for VF and set the
IRQF_NO_AUTOEN flag to avoid that warning.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/hisilicon/qm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0a82361cef20380b1c0f342c7e92f8ddabeefc2",
"status": "affected",
"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe",
"versionType": "git"
},
{
"lessThan": "5f75857ed634d04266301d7a4f695a7deeb9bfdc",
"status": "affected",
"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe",
"versionType": "git"
},
{
"lessThan": "24315474ca913c0693939ab74b389ee04c7d3020",
"status": "affected",
"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe",
"versionType": "git"
},
{
"lessThan": "854da2b0df1654d63963d587b12fec6068d89643",
"status": "affected",
"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe",
"versionType": "git"
},
{
"lessThan": "9228facb308157ac0bdd264b873187896f7a9c7a",
"status": "affected",
"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/hisilicon/qm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:51.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0a82361cef20380b1c0f342c7e92f8ddabeefc2"
},
{
"url": "https://git.kernel.org/stable/c/5f75857ed634d04266301d7a4f695a7deeb9bfdc"
},
{
"url": "https://git.kernel.org/stable/c/24315474ca913c0693939ab74b389ee04c7d3020"
},
{
"url": "https://git.kernel.org/stable/c/854da2b0df1654d63963d587b12fec6068d89643"
},
{
"url": "https://git.kernel.org/stable/c/9228facb308157ac0bdd264b873187896f7a9c7a"
}
],
"title": "crypto: hisilicon/qm - request reserved interrupt for virtual function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40136",
"datePublished": "2025-11-12T10:23:23.330Z",
"dateReserved": "2025-04-16T07:20:57.171Z",
"dateUpdated": "2026-10-30T12:22:51.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74687 (GCVE-0-2026-74687)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
watchdog: at91sam9_wdt: prevent timer rearm during teardown
at91_ping() rearms the watchdog timer from its callback. timer_delete()
neither waits for a running callback nor prevents it from rearming the
timer, so probe failure or driver removal can leave the timer accessing the
devm-allocated at91wdt after it has been freed.
Use timer_shutdown_sync() on both teardown paths. It waits for a running
callback and rejects any attempt by the callback to rearm the timer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5161b31dc39a6d6dadc95f298de48a725b73ada8 Version: 5161b31dc39a6d6dadc95f298de48a725b73ada8 Version: 5161b31dc39a6d6dadc95f298de48a725b73ada8 Version: 5161b31dc39a6d6dadc95f298de48a725b73ada8 Version: 5161b31dc39a6d6dadc95f298de48a725b73ada8 Version: 5161b31dc39a6d6dadc95f298de48a725b73ada8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/at91sam9_wdt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f96c18a766477e5f33d51697963a5c8aed260dae",
"status": "affected",
"version": "5161b31dc39a6d6dadc95f298de48a725b73ada8",
"versionType": "git"
},
{
"lessThan": "a9e0efcb1125e6b452c648671f15920c4955b681",
"status": "affected",
"version": "5161b31dc39a6d6dadc95f298de48a725b73ada8",
"versionType": "git"
},
{
"lessThan": "1beb4dd6a30dea699e98990dd61f892ed1c0985e",
"status": "affected",
"version": "5161b31dc39a6d6dadc95f298de48a725b73ada8",
"versionType": "git"
},
{
"lessThan": "29fe74c9aa69d78c1c6a3930f1d9fc5db71a6eed",
"status": "affected",
"version": "5161b31dc39a6d6dadc95f298de48a725b73ada8",
"versionType": "git"
},
{
"lessThan": "b7949b0a7d998013b7ec8617a0ef5b07cca80be4",
"status": "affected",
"version": "5161b31dc39a6d6dadc95f298de48a725b73ada8",
"versionType": "git"
},
{
"lessThan": "8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783",
"status": "affected",
"version": "5161b31dc39a6d6dadc95f298de48a725b73ada8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/at91sam9_wdt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: at91sam9_wdt: prevent timer rearm during teardown\n\nat91_ping() rearms the watchdog timer from its callback. timer_delete()\nneither waits for a running callback nor prevents it from rearming the\ntimer, so probe failure or driver removal can leave the timer accessing the\ndevm-allocated at91wdt after it has been freed.\n\nUse timer_shutdown_sync() on both teardown paths. It waits for a running\ncallback and rejects any attempt by the callback to rearm the timer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the AT91SAM9 platform watchdog driver during probe-failure cleanup or driver removal; it is reached only via local kernel/platform actions (boot probe, module load/unload, sysfs bind/unbind), not from network, Bluetooth, or physical USB/serial input paths.\nAC:L - at91_ping() unconditionally re-arms with mod_timer() while timer_delete() neither waits for the callback nor blocks rearm; an attacker who can time teardown or trigger the automatic probe-failure path can reliably race the periodic jiffies callback without uncontrollable layout or victim state.\nPR:L - Per CNA driver timer-teardown UAF precedent, once mod_timer() arms at91_ping() the callback runs autonomously; the UAF is reachable from local probe-failure cleanup or driver-removal activity on AT91 embedded/industrial targets without requiring init-namespace root privileges.\nUI:N - No victim interaction is required; the kernel timer fires on its own schedule and the use-after-free occurs during automatic init-failure teardown or driver removal, independent of opening /dev/watchdog or other user actions.\nS:U - Impact is a kernel heap/timer use-after-free within the host kernel on an embedded AT91 SoC; it does not cross VM, container, or IOMMU security boundaries.\nC:H - The at91_ping() timer callback dereferences freed at91wdt fields (next_heartbeat, wdd, heartbeat, base) after devm release, providing sprayable arbitrary kernel memory disclosure per UAF guidance.\nI:H - Reuse of the freed at91wdt lets at91_wdt_reset() issue MMIO writes through a controlled base pointer and mod_timer() corrupt timer/heap metadata, enabling arbitrary write and control-flow hijack primitives.\nA:H - Use-after-free access from the timer softirq path to freed at91wdt memory causes kernel oops or panic even without deliberate exploitation, and can be repeated by cycling probe/removal against the still-rearming timer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:17.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f96c18a766477e5f33d51697963a5c8aed260dae"
},
{
"url": "https://git.kernel.org/stable/c/a9e0efcb1125e6b452c648671f15920c4955b681"
},
{
"url": "https://git.kernel.org/stable/c/1beb4dd6a30dea699e98990dd61f892ed1c0985e"
},
{
"url": "https://git.kernel.org/stable/c/29fe74c9aa69d78c1c6a3930f1d9fc5db71a6eed"
},
{
"url": "https://git.kernel.org/stable/c/b7949b0a7d998013b7ec8617a0ef5b07cca80be4"
},
{
"url": "https://git.kernel.org/stable/c/8444d66aa6b6e7fe0a26fa1a00a11cb4d0523783"
}
],
"title": "watchdog: at91sam9_wdt: prevent timer rearm during teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74687",
"datePublished": "2026-08-22T15:32:52.792Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-10-30T12:30:17.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23217 (GCVE-0-2026-23217)
Vulnerability from cvelistv5
Published
2026-02-18 14:21
Modified
2026-10-21 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: trace: fix snapshot deadlock with sbi ecall
If sbi_ecall.c's functions are traceable,
echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter
may get the kernel into a deadlock.
(Functions in sbi_ecall.c are excluded from tracing if
CONFIG_RISCV_ALTERNATIVE_EARLY is set.)
__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code
raises an IPI interrupt, which results in another call to __sbi_ecall
and another snapshot...
All it takes to get into this endless loop is one initial __sbi_ecall.
On RISC-V systems without SSTC extension, the clock events in
timer-riscv.c issue periodic sbi ecalls, making the problem easy to
trigger.
Always exclude the sbi_ecall.c functions from tracing to fix the
potential deadlock.
sbi ecalls can easiliy be logged via trace events, excluding ecall
functions from function tracing is not a big limitation.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/Makefile"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8b8ec0ddde74066d4452a7a961da544f193e00f",
"status": "affected",
"version": "1ff95eb2bebda50c4c5406caaf201e0fcb24cc8f",
"versionType": "git"
},
{
"lessThan": "b1f8285bc8e3508c1fde23b5205f1270215d4984",
"status": "affected",
"version": "1ff95eb2bebda50c4c5406caaf201e0fcb24cc8f",
"versionType": "git"
},
{
"lessThan": "b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0",
"status": "affected",
"version": "1ff95eb2bebda50c4c5406caaf201e0fcb24cc8f",
"versionType": "git"
},
{
"status": "affected",
"version": "82f134ddd4f5da11c277bd1aa02e2a733179725a",
"versionType": "git"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/Makefile"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: trace: fix snapshot deadlock with sbi ecall\n\nIf sbi_ecall.c\u0027s functions are traceable,\n\necho \"__sbi_ecall:snapshot\" \u003e /sys/kernel/tracing/set_ftrace_filter\n\nmay get the kernel into a deadlock.\n\n(Functions in sbi_ecall.c are excluded from tracing if\nCONFIG_RISCV_ALTERNATIVE_EARLY is set.)\n\n__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code\nraises an IPI interrupt, which results in another call to __sbi_ecall\nand another snapshot...\n\nAll it takes to get into this endless loop is one initial __sbi_ecall.\nOn RISC-V systems without SSTC extension, the clock events in\ntimer-riscv.c issue periodic sbi ecalls, making the problem easy to\ntrigger.\n\nAlways exclude the sbi_ecall.c functions from tracing to fix the\npotential deadlock.\n\nsbi ecalls can easiliy be logged via trace events, excluding ecall\nfunctions from function tracing is not a big limitation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:00.498Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8b8ec0ddde74066d4452a7a961da544f193e00f"
},
{
"url": "https://git.kernel.org/stable/c/b1f8285bc8e3508c1fde23b5205f1270215d4984"
},
{
"url": "https://git.kernel.org/stable/c/b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0"
}
],
"title": "riscv: trace: fix snapshot deadlock with sbi ecall",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23217",
"datePublished": "2026-02-18T14:21:54.878Z",
"dateReserved": "2026-01-13T15:37:45.987Z",
"dateUpdated": "2026-10-21T12:39:00.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90084 (GCVE-0-2026-90084)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-vf: fix workqueue and netdev race in probe/remove
Initialize the VF workqueue before register_netdev() so ndo_set_rx_mode
does not queue work on a NULL workqueue. Unregister the netdev before
destroying the workqueue, and add proper probe error cleanup.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cbc100aa220556d056272f07dc735c9758089da9 Version: cbc100aa220556d056272f07dc735c9758089da9 Version: cbc100aa220556d056272f07dc735c9758089da9 Version: cbc100aa220556d056272f07dc735c9758089da9 Version: cbc100aa220556d056272f07dc735c9758089da9 Version: cbc100aa220556d056272f07dc735c9758089da9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a4b53231b77986ce55b38122174222c86416de7",
"status": "affected",
"version": "cbc100aa220556d056272f07dc735c9758089da9",
"versionType": "git"
},
{
"lessThan": "bdc530baf079eee104f9ea5d83815e798ea155df",
"status": "affected",
"version": "cbc100aa220556d056272f07dc735c9758089da9",
"versionType": "git"
},
{
"lessThan": "00dda563f4963f28fab46d09b912d68268b8e7a5",
"status": "affected",
"version": "cbc100aa220556d056272f07dc735c9758089da9",
"versionType": "git"
},
{
"lessThan": "42a139332ce81a907dac987f1494d30e0a8ab149",
"status": "affected",
"version": "cbc100aa220556d056272f07dc735c9758089da9",
"versionType": "git"
},
{
"lessThan": "ef42c9e922dfa806576d9d82867da2f3cd76b3ca",
"status": "affected",
"version": "cbc100aa220556d056272f07dc735c9758089da9",
"versionType": "git"
},
{
"lessThan": "3ba97ff4f873481d370bee7f7dfb87f8296af9be",
"status": "affected",
"version": "cbc100aa220556d056272f07dc735c9758089da9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-vf: fix workqueue and netdev race in probe/remove\n\nInitialize the VF workqueue before register_netdev() so ndo_set_rx_mode\ndoes not queue work on a NULL workqueue. Unregister the netdev before\ndestroying the workqueue, and add proper probe error cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:03.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a4b53231b77986ce55b38122174222c86416de7"
},
{
"url": "https://git.kernel.org/stable/c/bdc530baf079eee104f9ea5d83815e798ea155df"
},
{
"url": "https://git.kernel.org/stable/c/00dda563f4963f28fab46d09b912d68268b8e7a5"
},
{
"url": "https://git.kernel.org/stable/c/42a139332ce81a907dac987f1494d30e0a8ab149"
},
{
"url": "https://git.kernel.org/stable/c/ef42c9e922dfa806576d9d82867da2f3cd76b3ca"
},
{
"url": "https://git.kernel.org/stable/c/3ba97ff4f873481d370bee7f7dfb87f8296af9be"
}
],
"title": "octeontx2-vf: fix workqueue and netdev race in probe/remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90084",
"datePublished": "2026-09-17T16:06:00.839Z",
"dateReserved": "2026-09-11T19:38:34.785Z",
"dateUpdated": "2026-10-30T12:34:03.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46324 (GCVE-0-2026-46324)
Vulnerability from cvelistv5
Published
2026-06-09 12:11
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: use list_del_rcu for netlink hooks
nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need
to use list_del_rcu(), this list can be walked by concurrent dumpers.
Add a new helper and use it consistently.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Version: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Version: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Version: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Version: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Version: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 Version: c73955a09408e7374d9abfd0e78ce3de9cda0635 Version: b09e6ccf0d12f9356e8e3508d3e3dce126298538 Version: 3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82 Version: 9c413a8c8bb49cc16796371805ecb260e885bb2b Version: a3940dcf552f2393d1e8f263b386593f98abe829 Version: 86c0154f4c3a56c5db8b9dd09e3ce885382c2c19 Version: 4.19.316 ≤ Version: 5.4.262 ≤ Version: 5.10.198 ≤ Version: 5.15.45 ≤ Version: 5.17.13 ≤ Version: 5.18.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46324",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:09.898894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:58.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6480ea533cedfbf79ea5a1f12c5f71d41484dd8a",
"status": "affected",
"version": "f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"versionType": "git"
},
{
"lessThan": "2405730fde96f7fa483a5862e323b681e0e09f54",
"status": "affected",
"version": "f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"versionType": "git"
},
{
"lessThan": "fe45e203527af8a2c0dc4c8a7b56c09c74b796c8",
"status": "affected",
"version": "f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"versionType": "git"
},
{
"lessThan": "0bd93ce4f3c35e845532184331d7917d7e562c80",
"status": "affected",
"version": "f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"versionType": "git"
},
{
"lessThan": "0f33e8ad6ac563ae2233dd7f75884e0ee010521d",
"status": "affected",
"version": "f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"versionType": "git"
},
{
"lessThan": "f3224ee463f8f6f6ced7dcdf6081add4f8128527",
"status": "affected",
"version": "f9a43007d3f7ba76d5e7f9421094f00f2ef202f8",
"versionType": "git"
},
{
"status": "affected",
"version": "c73955a09408e7374d9abfd0e78ce3de9cda0635",
"versionType": "git"
},
{
"status": "affected",
"version": "b09e6ccf0d12f9356e8e3508d3e3dce126298538",
"versionType": "git"
},
{
"status": "affected",
"version": "3fac8ce48fa9fd61ee9056d3ed48b2edefca8b82",
"versionType": "git"
},
{
"status": "affected",
"version": "9c413a8c8bb49cc16796371805ecb260e885bb2b",
"versionType": "git"
},
{
"status": "affected",
"version": "a3940dcf552f2393d1e8f263b386593f98abe829",
"versionType": "git"
},
{
"status": "affected",
"version": "86c0154f4c3a56c5db8b9dd09e3ce885382c2c19",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.316",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.262",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.198",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.45",
"versionType": "semver"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.13",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.316",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.262",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.198",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: use list_del_rcu for netlink hooks\n\nnft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need\nto use list_del_rcu(), this list can be walked by concurrent dumpers.\n\nAdd a new helper and use it consistently."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls\u2014chain/flowtable updates, dumps, netns teardown, and netlink socket release\u2014not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:17.369Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6480ea533cedfbf79ea5a1f12c5f71d41484dd8a"
},
{
"url": "https://git.kernel.org/stable/c/2405730fde96f7fa483a5862e323b681e0e09f54"
},
{
"url": "https://git.kernel.org/stable/c/fe45e203527af8a2c0dc4c8a7b56c09c74b796c8"
},
{
"url": "https://git.kernel.org/stable/c/0bd93ce4f3c35e845532184331d7917d7e562c80"
},
{
"url": "https://git.kernel.org/stable/c/0f33e8ad6ac563ae2233dd7f75884e0ee010521d"
},
{
"url": "https://git.kernel.org/stable/c/f3224ee463f8f6f6ced7dcdf6081add4f8128527"
}
],
"title": "netfilter: nf_tables: use list_del_rcu for netlink hooks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46324",
"datePublished": "2026-06-09T12:11:16.602Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-10-30T12:26:17.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53025 (GCVE-0-2026-53025)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
greybus: raw: fix use-after-free on cdev close
This addresses a use-after-free bug when a raw bundle is disconnected
but its chardev is still opened by an application. When the application
releases the cdev, it causes the following panic when init on free is
enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130
...
Call Trace:
<TASK>
cdev_put+0x18/0x30
__fput+0x255/0x2a0
__x64_sys_close+0x3d/0x80
do_syscall_64+0xa4/0x290
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The cdev is contained in the "gb_raw" structure, which is freed in the
disconnect operation. When the cdev is released at a later time,
cdev_put gets an address that points to freed memory.
To fix this use-after-free, convert the struct device from a pointer to
being embedded, that makes the lifetime of the cdev and of this device
the same. Then, use cdev_device_add, which guarantees that the device
won't be released until all references to the cdev have been released.
Finally, delegate the freeing of the structure to the device release
function, instead of freeing immediately in the disconnect callback.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 Version: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 Version: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 Version: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 Version: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 Version: e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/greybus/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0597908256173da5256ef8e6db17ccc8d5c40ee3",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "e4d07fd4e30024a4a15094ef2c404197667c857e",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "3abf97a03f4abce1dc3639eea2fcd4bd747b3308",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "e72ffe59e48a74a8d9220f5ca1d03f2194d882f0",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "ef2d97c15b19b3489de01695bce478601e236c3e",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "983cc2c7efbce04ecbf6328448d895044dd6ab31",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/greybus/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free on cdev close\n\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n ...\n Call Trace:\n \u003cTASK\u003e\n cdev_put+0x18/0x30\n __fput+0x255/0x2a0\n __x64_sys_close+0x3d/0x80\n do_syscall_64+0xa4/0x290\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\n\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon\u0027t be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through a local Greybus raw character-device file descriptor, with close(2) eventually calling cdev_put on a cdev embedded in freed gb_raw memory. It is not an IP-network reachable path; Greybus disconnect/removal is the teardown condition.\nAC:L - Once a raw Greybus device exists, the sequence of opening the chardev, having the bundle disconnected, and then closing the fd deterministically triggers the stale cdev access. No narrow race win or attacker-uncontrolled memory layout condition is required to trigger the bug.\nPR:L - The raw driver performs no capability or authentication checks in its chardev operations; access is governed by the device node. Although devtmpfs defaults to root-owned 0600 absent userspace policy, the higher-severity reasonable deployment is an application-facing raw device accessible to a basic local user.\nUI:N - No separate victim action is needed when the attacker controls the local process holding and closing the file descriptor and can arrange or wait for Greybus teardown. The vulnerable access occurs during the attacker-triggered close path.\nS:U - The impact is within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary. A kernel crash or local kernel memory corruption is standard unchanged-scope impact.\nC:H - This is a kernel heap use-after-free of a struct cdev embedded in the freed gb_raw object. Under the required kernel guidance, UAF is treated as capable of enabling high confidentiality impact through heap reuse and memory disclosure primitives.\nI:H - The stale cdev pointer is dereferenced after the containing kernel object has been freed, allowing plausible heap-spray/control-flow or object-corruption exploitation beyond a simple warning. Under the required kernel guidance, UAF maps to high integrity impact.\nA:H - The reported failure is a kernel refcount underflow/use-after-free warning and panic path during close when init-on-free is enabled. A repeatable kernel crash or oops is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:32.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0597908256173da5256ef8e6db17ccc8d5c40ee3"
},
{
"url": "https://git.kernel.org/stable/c/e4d07fd4e30024a4a15094ef2c404197667c857e"
},
{
"url": "https://git.kernel.org/stable/c/3abf97a03f4abce1dc3639eea2fcd4bd747b3308"
},
{
"url": "https://git.kernel.org/stable/c/e72ffe59e48a74a8d9220f5ca1d03f2194d882f0"
},
{
"url": "https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e"
},
{
"url": "https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31"
}
],
"title": "greybus: raw: fix use-after-free on cdev close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53025",
"datePublished": "2026-06-24T16:29:33.971Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-10-30T12:26:32.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68236 (GCVE-0-2025-68236)
Vulnerability from cvelistv5
Published
2025-12-16 14:08
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
According to UFS specifications, the power-off sequence for a UFS device
includes:
- Sending an SSU command with Power_Condition=3 and await a response.
- Asserting RST_N low.
- Turning off REF_CLK.
- Turning off VCC.
- Turning off VCCQ/VCCQ2.
As part of ufs shutdown, after the SSU command completion, asserting
hardware reset (HWRST) triggers the device firmware to wake up and
execute its reset routine. This routine initializes hardware blocks and
takes a few milliseconds to complete. During this time, the ICCQ draws a
large current.
This large ICCQ current may cause issues for the regulator which is
supplying power to UFS, because the turn off request from UFS driver to
the regulator framework will be immediately followed by low power
mode(LPM) request by regulator framework. This is done by framework
because UFS which is the only client is requesting for disable. So if
the rail is still in the process of shutting down while ICCQ exceeds LPM
current thresholds, and LPM mode is activated in hardware during this
state, it may trigger an overcurrent protection (OCP) fault in the
regulator.
To prevent this, a 10ms delay is added after asserting HWRST. This
allows the reset operation to complete while power rails remain active
and in high-power mode.
Currently there is no way for Host to query whether the reset is
completed or not and hence this the delay is based on experiments with
Qualcomm UFS controllers across multiple UFS vendors.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b61d0414136853fc38898829cde837ce5d691a9a Version: b61d0414136853fc38898829cde837ce5d691a9a Version: b61d0414136853fc38898829cde837ce5d691a9a Version: b61d0414136853fc38898829cde837ce5d691a9a Version: b61d0414136853fc38898829cde837ce5d691a9a Version: 82783759e88beee69b710806e45acbb2fc589801 Version: 5.10.219 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/host/ufs-qcom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd52d72f2bd727ca60c1bc9820a307b70e2154ec",
"status": "affected",
"version": "b61d0414136853fc38898829cde837ce5d691a9a",
"versionType": "git"
},
{
"lessThan": "1c963811b0824d0f51aabd394986589a2126f341",
"status": "affected",
"version": "b61d0414136853fc38898829cde837ce5d691a9a",
"versionType": "git"
},
{
"lessThan": "0c2619d1da8bd3d18524d69f12571a8cd7362833",
"status": "affected",
"version": "b61d0414136853fc38898829cde837ce5d691a9a",
"versionType": "git"
},
{
"lessThan": "b712f234a74c1f5ce70b5d7aec3fc2499c258141",
"status": "affected",
"version": "b61d0414136853fc38898829cde837ce5d691a9a",
"versionType": "git"
},
{
"lessThan": "5127be409c6c3815c4a7d8f6d88043e44f9b9543",
"status": "affected",
"version": "b61d0414136853fc38898829cde837ce5d691a9a",
"versionType": "git"
},
{
"status": "affected",
"version": "82783759e88beee69b710806e45acbb2fc589801",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.219",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/host/ufs-qcom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.10",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.219",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:10.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd52d72f2bd727ca60c1bc9820a307b70e2154ec"
},
{
"url": "https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341"
},
{
"url": "https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833"
},
{
"url": "https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141"
},
{
"url": "https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543"
}
],
"title": "scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68236",
"datePublished": "2025-12-16T14:08:30.224Z",
"dateReserved": "2025-12-16T13:41:40.258Z",
"dateUpdated": "2026-10-30T12:23:10.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97493 (GCVE-0-2026-97493)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-30 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
Reject undersized tables and cap the derived entry count
to AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[]
or walk an absurd number of entries on corrupt size fields.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b12abff6a52d96c4114d7668f790b18f9201c17c",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "0786b38af822fcd153d565cc85be7dbd9fed4d25",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "6db45123306c7167c6867ca3d24924bd7960d947",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "f8f0985375c3b977757fd73e2b691ff1bf1ea7b9",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "a99cd231cd924b7160fecb9fb3a94b801522323b",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Bound GPIO I2C table entry count from VBIOS\n\nReject undersized tables and cap the derived entry count\nto AMDGPU_MAX_I2C_BUS so we do not overrun adev-\u003ei2c_bus[]\nor walk an absurd number of entries on corrupt size fields."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:37:02.957Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b12abff6a52d96c4114d7668f790b18f9201c17c"
},
{
"url": "https://git.kernel.org/stable/c/0786b38af822fcd153d565cc85be7dbd9fed4d25"
},
{
"url": "https://git.kernel.org/stable/c/6db45123306c7167c6867ca3d24924bd7960d947"
},
{
"url": "https://git.kernel.org/stable/c/f8f0985375c3b977757fd73e2b691ff1bf1ea7b9"
},
{
"url": "https://git.kernel.org/stable/c/a99cd231cd924b7160fecb9fb3a94b801522323b"
}
],
"title": "drm/amdgpu: Bound GPIO I2C table entry count from VBIOS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97493",
"datePublished": "2026-09-24T16:04:41.120Z",
"dateReserved": "2026-09-24T16:01:01.150Z",
"dateUpdated": "2026-10-30T12:37:02.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99028 (GCVE-0-2026-99028)
Vulnerability from cvelistv5
Published
2026-10-23 12:21
Modified
2026-10-23 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
In the dmaengine path the driver pre-submits RX buffers and holds
in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed
only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()
aborts these descriptors without running their callbacks, and the driver
then frees only the ring shells, leaking every SKB still owned by the
engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted
per channel, the mapping leak can eventually exhaust a limited IOMMU
aperture.
Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a
slot that still owns a live, DMA-mapped buffer, and on stop unmap and free
every such buffer.
axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on
each completion, so it can race axienet_stop(): a completion may submit a
fresh buffer after dmaengine_terminate_sync() has returned, leaving the
channel armed with a buffer the teardown then frees while the engine may
still write into it (dma_release_channel() does not stop it either). Add a
lock that axienet_dma_rx_cb() holds across the @stopping check and the
resubmit, and axienet_stop() holds to set @stopping before terminating.
Once @stopping is set no callback can arm a new buffer, and any armed just
before is aborted by the terminate, so teardown only frees buffers the
engine no longer owns.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/xilinx/xilinx_axienet.h",
"drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "079396129da5e7cb40ca0920aa1b9525bef6097c",
"status": "affected",
"version": "6a91b846af85a24241decd686269e8e038eb13d1",
"versionType": "git"
},
{
"lessThan": "eececf7c3a679d9c08175ad6bacbc8c31848f5af",
"status": "affected",
"version": "6a91b846af85a24241decd686269e8e038eb13d1",
"versionType": "git"
},
{
"lessThan": "5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58",
"status": "affected",
"version": "6a91b846af85a24241decd686269e8e038eb13d1",
"versionType": "git"
},
{
"lessThan": "bcf2573a68a808a5b54cadafa72b6672e662c2bf",
"status": "affected",
"version": "6a91b846af85a24241decd686269e8e038eb13d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/xilinx/xilinx_axienet.h",
"drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:21:20.294Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/079396129da5e7cb40ca0920aa1b9525bef6097c"
},
{
"url": "https://git.kernel.org/stable/c/eececf7c3a679d9c08175ad6bacbc8c31848f5af"
},
{
"url": "https://git.kernel.org/stable/c/5e5cf3ad7c099ff86ea9e422cddb25a2e5317b58"
},
{
"url": "https://git.kernel.org/stable/c/bcf2573a68a808a5b54cadafa72b6672e662c2bf"
}
],
"title": "net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99028",
"datePublished": "2026-10-23T12:21:20.294Z",
"dateReserved": "2026-09-25T10:25:14.386Z",
"dateUpdated": "2026-10-23T12:21:20.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53258 (GCVE-0-2026-53258)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: fix leak if split 6 GHz scanning fails
rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's
supposed to be released at ___cfg80211_scan_done() but this doesn't happen
as rdev->scan_req is NULL at that point, too, leading to the early return
from the freeing function.
unreferenced object 0xffff8881161d0800 (size 512):
comm "wpa_supplicant", pid 379, jiffies 4294749765
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................
backtrace (crc c867fdb6):
kmemleak_alloc+0x89/0x90
__kmalloc_noprof+0x2fd/0x410
cfg80211_scan+0x133/0x730
nl80211_trigger_scan+0xc69/0x1cc0
genl_family_rcv_msg_doit+0x204/0x2f0
genl_rcv_msg+0x431/0x6b0
netlink_rcv_skb+0x143/0x3f0
genl_rcv+0x27/0x40
netlink_unicast+0x4f6/0x820
netlink_sendmsg+0x797/0xce0
__sock_sendmsg+0xc4/0x160
____sys_sendmsg+0x5e4/0x890
___sys_sendmsg+0xf8/0x180
__sys_sendmsg+0x136/0x1e0
__x64_sys_sendmsg+0x76/0xc0
x64_sys_call+0x13f0/0x17d0
Found by Linux Verification Center (linuxtesting.org).
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8cb5b854b40f2ce52ccd032fa19750f4181d5fc Version: c8cb5b854b40f2ce52ccd032fa19750f4181d5fc Version: c8cb5b854b40f2ce52ccd032fa19750f4181d5fc Version: c8cb5b854b40f2ce52ccd032fa19750f4181d5fc Version: c8cb5b854b40f2ce52ccd032fa19750f4181d5fc Version: c8cb5b854b40f2ce52ccd032fa19750f4181d5fc |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53258",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:24:25.358613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:16.303Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c3d30daf03130cf35c0e70185719ce16fc3ea6c4",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "87484866cae9130b97c2b356eeaea4f47b292f75",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "df44397bbd8f3a38115c9590b686787e4aaf6327",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "fb8db813eba2e56ee001c9fb5c2ce2cb78c42642",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "a24134ddc18b4d440714365637d440b7121447b9",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "e8694f7cc29287e843648d1075177b9a2000d957",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: fix leak if split 6 GHz scanning fails\n\nrdev-\u003eint_scan_req is leaked if cfg80211_scan() fails. Note that it\u0027s\nsupposed to be released at ___cfg80211_scan_done() but this doesn\u0027t happen\nas rdev-\u003escan_req is NULL at that point, too, leading to the early return\nfrom the freeing function.\n\nunreferenced object 0xffff8881161d0800 (size 512):\n comm \"wpa_supplicant\", pid 379, jiffies 4294749765\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................\n backtrace (crc c867fdb6):\n kmemleak_alloc+0x89/0x90\n __kmalloc_noprof+0x2fd/0x410\n cfg80211_scan+0x133/0x730\n nl80211_trigger_scan+0xc69/0x1cc0\n genl_family_rcv_msg_doit+0x204/0x2f0\n genl_rcv_msg+0x431/0x6b0\n netlink_rcv_skb+0x143/0x3f0\n genl_rcv+0x27/0x40\n netlink_unicast+0x4f6/0x820\n netlink_sendmsg+0x797/0xce0\n __sock_sendmsg+0xc4/0x160\n ____sys_sendmsg+0x5e4/0x890\n ___sys_sendmsg+0xf8/0x180\n __sys_sendmsg+0x136/0x1e0\n __x64_sys_sendmsg+0x76/0xc0\n x64_sys_call+0x13f0/0x17d0\n\nFound by Linux Verification Center (linuxtesting.org)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:50.461Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c3d30daf03130cf35c0e70185719ce16fc3ea6c4"
},
{
"url": "https://git.kernel.org/stable/c/87484866cae9130b97c2b356eeaea4f47b292f75"
},
{
"url": "https://git.kernel.org/stable/c/df44397bbd8f3a38115c9590b686787e4aaf6327"
},
{
"url": "https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642"
},
{
"url": "https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9"
},
{
"url": "https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957"
}
],
"title": "wifi: fix leak if split 6 GHz scanning fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53258",
"datePublished": "2026-06-25T08:39:47.917Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-11-06T16:34:16.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74272 (GCVE-0-2026-74272)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Resolve region deletion races
Sungwoo noticed that the sysfs trigger to delete a region may try to delete
a region multiple times. It also has no exclusion relative to the kernel
releasing the region via CXL root device teardown.
Instead of installing new cxl root devres actions per region, use the
existing root decoder unregistration event to remove all remaining regions.
An xarray of regions replaces a devres list of regions.
This handles 3 separate issues with the old approach:
1/ sysfs users racing to delete the same region: no longer possible now
that the regions_lock is held over the lookup and deletion.
2/ multiple actions triggering deletion of the same region: solved by
erasing regions while holding @regions_lock, and only proceeding on
successful erasure.
3/ userspace racing devres_release_all() to trigger the devres not found
warning: solved by sysfs unregistration not requiring a release action
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/core.h",
"drivers/cxl/core/port.c",
"drivers/cxl/core/region.c",
"drivers/cxl/cxl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "441250eea84608c6c2dbd7f00c61df32836ac97d",
"status": "affected",
"version": "779dd20cfb56c510f89877cca45529fa9f8bc450",
"versionType": "git"
},
{
"lessThan": "c478810c4ce7216261fc1b6ca5180adcda26b1a1",
"status": "affected",
"version": "779dd20cfb56c510f89877cca45529fa9f8bc450",
"versionType": "git"
},
{
"lessThan": "be44c1c04f85d7b7ac1c597a30b443bbd346acbd",
"status": "affected",
"version": "779dd20cfb56c510f89877cca45529fa9f8bc450",
"versionType": "git"
},
{
"lessThan": "4dd86ca99ffcc413cbf79063fd9956ef54e0ca91",
"status": "affected",
"version": "779dd20cfb56c510f89877cca45529fa9f8bc450",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/core.h",
"drivers/cxl/core/port.c",
"drivers/cxl/core/region.c",
"drivers/cxl/cxl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Resolve region deletion races\n\nSungwoo noticed that the sysfs trigger to delete a region may try to delete\na region multiple times. It also has no exclusion relative to the kernel\nreleasing the region via CXL root device teardown.\n\nInstead of installing new cxl root devres actions per region, use the\nexisting root decoder unregistration event to remove all remaining regions.\nAn xarray of regions replaces a devres list of regions.\n\nThis handles 3 separate issues with the old approach:\n\n1/ sysfs users racing to delete the same region: no longer possible now\n that the regions_lock is held over the lookup and deletion.\n\n2/ multiple actions triggering deletion of the same region: solved by\n erasing regions while holding @regions_lock, and only proceeding on\n successful erasure.\n\n3/ userspace racing devres_release_all() to trigger the devres not found\n warning: solved by sysfs unregistration not requiring a release action"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:14.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/441250eea84608c6c2dbd7f00c61df32836ac97d"
},
{
"url": "https://git.kernel.org/stable/c/c478810c4ce7216261fc1b6ca5180adcda26b1a1"
},
{
"url": "https://git.kernel.org/stable/c/be44c1c04f85d7b7ac1c597a30b443bbd346acbd"
},
{
"url": "https://git.kernel.org/stable/c/4dd86ca99ffcc413cbf79063fd9956ef54e0ca91"
}
],
"title": "cxl/region: Resolve region deletion races",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74272",
"datePublished": "2026-08-15T05:57:45.494Z",
"dateReserved": "2026-08-15T05:44:03.879Z",
"dateUpdated": "2026-10-21T12:45:14.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43042 (GCVE-0-2026-43042)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mpls: add seqcount to protect the platform_label{,s} pair
The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have
an inconsistent view of platform_labels vs platform_label in case of a
concurrent resize (resize_platform_label_table, under
platform_mutex). This can lead to OOB accesses.
This patch adds a seqcount, so that we get a consistent snapshot.
Note that mpls_label_ok is also susceptible to this, so the check
against RTA_DST in rtm_to_route_config, done outside platform_mutex,
is not sufficient. This value gets passed to mpls_label_ok once more
in both mpls_route_add and mpls_route_del, so there is no issue, but
that additional check must not be removed.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:13:53.309258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:10.994Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netns/mpls.h",
"net/mpls/af_mpls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b9184ebc936f791631e51e783ab30320b3770e4",
"status": "affected",
"version": "7720c01f3f590116882e251f13c7e1d5602f8643",
"versionType": "git"
},
{
"lessThan": "0d377825548fe598595b5a5fa4a309fb593d8fb4",
"status": "affected",
"version": "7720c01f3f590116882e251f13c7e1d5602f8643",
"versionType": "git"
},
{
"lessThan": "8adc5b6fc876928d8c95555d30b66fa50b07421e",
"status": "affected",
"version": "7720c01f3f590116882e251f13c7e1d5602f8643",
"versionType": "git"
},
{
"lessThan": "5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef",
"status": "affected",
"version": "7720c01f3f590116882e251f13c7e1d5602f8643",
"versionType": "git"
},
{
"lessThan": "629ec78ef8608d955ce217880cdc3e1873af3a15",
"status": "affected",
"version": "7720c01f3f590116882e251f13c7e1d5602f8643",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netns/mpls.h",
"net/mpls/af_mpls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: add seqcount to protect the platform_label{,s} pair\n\nThe RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have\nan inconsistent view of platform_labels vs platform_label in case of a\nconcurrent resize (resize_platform_label_table, under\nplatform_mutex). This can lead to OOB accesses.\n\nThis patch adds a seqcount, so that we get a consistent snapshot.\n\nNote that mpls_label_ok is also susceptible to this, so the check\nagainst RTA_DST in rtm_to_route_config, done outside platform_mutex,\nis not sufficient. This value gets passed to mpls_label_ok once more\nin both mpls_route_add and mpls_route_del, so there is no issue, but\nthat additional check must not be removed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The self-contained exploit path is local: the attacker races writes to /proc/sys/net/mpls/platform_labels with rtnetlink RTM_GETROUTE dumps in the same network namespace. Remote MPLS packets can reach one reader path, but a remote-only attacker cannot perform the required table resize.\nAC:L - The vulnerable condition is a race, but a local attacker can control both sides by repeatedly resizing platform_labels and issuing concurrent route dumps or packet processing. No external timing or victim state is required beyond retrying the race.\nPR:L - Writing the MPLS platform_labels sysctl requires CAP_NET_ADMIN over the target network namespace. That capability is reachable by an unprivileged user through a user namespace plus network namespace, so this is low privilege rather than high privilege.\nUI:N - No victim user action is required. The attacker can trigger the resize and reader paths directly.\nS:U - The bug is within the kernel networking/MPLS subsystem and impacts the same kernel security authority. It is not a VM escape or cross-authority boundary bypass.\nC:H - The inconsistent platform_labels/platform_label snapshot can cause out-of-bounds reads of the route pointer table and dereference attacker-influenced or adjacent kernel memory as mpls_route data. Through the route dump path this can disclose kernel memory, so confidentiality is high.\nI:N - The bug is an out-of-bounds read/dereference of the route table pointer array, not an out-of-bounds write or direct memory corruption primitive. The investigated paths do not provide a defensible arbitrary kernel data modification primitive.\nA:H - The race can make readers index a NULL, stale, or too-small platform_label array and dereference invalid pointers. This can reliably lead to kernel oops/panic or other high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:50.878Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b9184ebc936f791631e51e783ab30320b3770e4"
},
{
"url": "https://git.kernel.org/stable/c/0d377825548fe598595b5a5fa4a309fb593d8fb4"
},
{
"url": "https://git.kernel.org/stable/c/8adc5b6fc876928d8c95555d30b66fa50b07421e"
},
{
"url": "https://git.kernel.org/stable/c/5bb3caf0bbfb56f1a00d2af072ac3d8395a3b9ef"
},
{
"url": "https://git.kernel.org/stable/c/629ec78ef8608d955ce217880cdc3e1873af3a15"
}
],
"title": "mpls: add seqcount to protect the platform_label{,s} pair",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43042",
"datePublished": "2026-05-01T14:15:38.882Z",
"dateReserved": "2026-05-01T14:12:55.978Z",
"dateUpdated": "2026-10-30T12:24:50.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99113 (GCVE-0-2026-99113)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
smb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,
that is the whole of struct object_id_info, but writes only 46 of them:
- objid[] is 16 bytes, and when the volume UUID is not available only
sizeof(stfs.f_fsid) (8) bytes are copied into it;
- extended_info.version_string[] is STRING_LENGTH (28) bytes, and only
strlen("1.1.0") (5) bytes are copied into it.
The response buffer is zeroed on allocation (kvzalloc() in
smb2_allocate_rsp_buf()), so for a standalone request the remaining 31
bytes are zero. In a compound request they need not be. The offset of
the next response is advanced by the length pinned for the previous one,
so if a preceding command wrote its reply into the buffer and then
failed, smb2_set_err_rsp() pins only the short error response and the
next reply lands inside the area that has already been written. Only
the header is cleared there:
memset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
The client then receives up to 31 bytes of a response it was not meant
to see, including one that failed with an access denied error.
Clear the structure before filling it in. As a side effect
version_string is now NUL terminated.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dbd0f13de153d7094b85034daffa7533d7c2b17a",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "90898571fb2c6813c007a62833dd65c00481d44e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "1a35a81c302b36fe4acd35b47b51d5d73e89ba0a",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "3fc33ac2125b60f103592b83821f69f3f9aa23ba",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "898cb4f2e12a5ddea1b2d821cc642c3100f46da7",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "015fffa48e96ca8d73a627445341ccff86b02251",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "399aa12450a61a5c73dc77e73f069ece9687c95d",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n\n - objid[] is 16 bytes, and when the volume UUID is not available only\n sizeof(stfs.f_fsid) (8) bytes are copied into it;\n - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\n strlen(\"1.1.0\") (5) bytes are copied into it.\n\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero. In a compound request they need not be. The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written. Only\nthe header is cleared there:\n\n\tmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\n\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\n\nClear the structure before filling it in. As a side effect\nversion_string is now NUL terminated."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:51.384Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dbd0f13de153d7094b85034daffa7533d7c2b17a"
},
{
"url": "https://git.kernel.org/stable/c/90898571fb2c6813c007a62833dd65c00481d44e"
},
{
"url": "https://git.kernel.org/stable/c/1a35a81c302b36fe4acd35b47b51d5d73e89ba0a"
},
{
"url": "https://git.kernel.org/stable/c/3fc33ac2125b60f103592b83821f69f3f9aa23ba"
},
{
"url": "https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7"
},
{
"url": "https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251"
},
{
"url": "https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d"
}
],
"title": "ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99113",
"datePublished": "2026-10-28T10:34:30.767Z",
"dateReserved": "2026-09-25T10:25:14.392Z",
"dateUpdated": "2026-10-30T12:41:51.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38421 (GCVE-0-2025-38421)
Vulnerability from cvelistv5
Published
2025-07-25 14:16
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86/amd: pmf: Use device managed allocations
If setting up smart PC fails for any reason then this can lead to
a double free when unloading amd-pmf. This is because dev->buf was
freed but never set to NULL and is again freed in amd_pmf_remove().
To avoid subtle allocation bugs in failures leading to a double free
change all allocations into device managed allocations.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/amd/pmf/core.c",
"drivers/platform/x86/amd/pmf/tee-if.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6a38e1a82d2f9abd0bae84a354654bccb8389f6",
"status": "affected",
"version": "e70b4b8f93d7fcf8ee063a1d1f18782c4da3d335",
"versionType": "git"
},
{
"lessThan": "0d10b532f861253c283863522d59d099fcb0796d",
"status": "affected",
"version": "5b1122fc4995f308b21d7cfc64ef9880ac834d20",
"versionType": "git"
},
{
"lessThan": "d9db3a941270d92bbd1a6a6b54a10324484f2f2d",
"status": "affected",
"version": "5b1122fc4995f308b21d7cfc64ef9880ac834d20",
"versionType": "git"
},
{
"status": "affected",
"version": "3ed60e51ffdbfef14169bd967e21a6ba5e5ff42b",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.23",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/amd/pmf/core.c",
"drivers/platform/x86/amd/pmf/tee-if.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: pmf: Use device managed allocations\n\nIf setting up smart PC fails for any reason then this can lead to\na double free when unloading amd-pmf. This is because dev-\u003ebuf was\nfreed but never set to NULL and is again freed in amd_pmf_remove().\n\nTo avoid subtle allocation bugs in failures leading to a double free\nchange all allocations into device managed allocations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The amd-pmf platform driver is reachable only from the local machine \u2014 via driver unbind/module unload, the suspend/resume PM path, or the debugfs `update_policy` handler. There is no network or adjacent-network exposure.\nAC:L - On an affected system (AMD laptop whose BIOS advertises Smart PC while the PMF TA/policy is unavailable) `amd_pmf_init_smart_pc()` fails deterministically at every boot, leaving `dev-\u003ebuf`, `dev-\u003epolicy_buf` and `dev-\u003eprev_data` dangling, so the attacker simply triggers unbind or a suspend/resume cycle to hit the double free/UAF with 100% reliability.\nPR:L - The dangling `pdev-\u003ebuf` is dereferenced from `amd_pmf_resume_handler()`/`amd_pmf_restore_handler()` and from the re-armed `pb_work` handler, and an unprivileged local user in an active session can initiate suspend/resume through logind; heap grooming to control the reused slab object also needs only unprivileged allocations.\nUI:N - The attacker performs the triggering action themselves (driver unbind/module unload or a suspend/resume cycle); no separate victim needs to be induced into any action.\nS:U - The corrupted memory and the resulting privilege escalation are entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `dev-\u003ebuf`/`dev-\u003eprev_data` pointers are read after free (`memcpy(\u0026dev-\u003em_table, dev-\u003ebuf, dev-\u003emtable_size)` in `amd_pmf_get_smu_info()`), leaking reallocated kernel slab contents, and the double free gives the attacker a slab object shared with another subsystem, which is a general kernel-memory read primitive.\nI:H - The double free of `dev-\u003ebuf` (and of `policy_buf`/`prev_data`) lets the same slab object be handed to two owners, and the UAF write paths (`memset(dev-\u003ebuf, 0, dev-\u003emtable_size)`, `dev-\u003eprev_data-\u003espl = val`, plus SMU DMA into the freed page programmed by `amd_pmf_set_dram_addr()`) provide a controlled write into live kernel objects, which is exploitable for control-flow hijack.\nA:H - A double free triggers immediate slab freelist corruption \u2014 a BUG/panic under freelist hardening or CONFIG_SLUB_DEBUG, and unbounded heap corruption leading to a crash otherwise; the UAF accesses from the PM resume path can be repeated to reliably crash the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:04.677Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6a38e1a82d2f9abd0bae84a354654bccb8389f6"
},
{
"url": "https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d"
},
{
"url": "https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d"
}
],
"title": "platform/x86/amd: pmf: Use device managed allocations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38421",
"datePublished": "2025-07-25T14:16:42.409Z",
"dateReserved": "2025-04-16T04:51:24.014Z",
"dateUpdated": "2026-10-21T12:37:04.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89808 (GCVE-0-2026-89808)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set +
MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no
dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart()
will return an uninitialized r. That can trigger out_free_vram_pages to drop
all VRAM just set up.
Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0.
Current code postponed the last page to the final copy. This patch flushes on
the last page when reach to the end of current drm_buddy_block; avoids another
svm_migrate_copy_memory_gart.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 Version: 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 Version: 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 Version: 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 Version: 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 Version: 50ea50cf6f6d31d3235ad1853c5dbea766a3ed11 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_migrate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d5872c81c70163a3ba9eb4da9a94c92b03067576",
"status": "affected",
"version": "50ea50cf6f6d31d3235ad1853c5dbea766a3ed11",
"versionType": "git"
},
{
"lessThan": "6e1a6f3ddb87d7f89a775c55fb399680c02bdcc2",
"status": "affected",
"version": "50ea50cf6f6d31d3235ad1853c5dbea766a3ed11",
"versionType": "git"
},
{
"lessThan": "bd1adb2e5101db649121b59e601c92773a302a70",
"status": "affected",
"version": "50ea50cf6f6d31d3235ad1853c5dbea766a3ed11",
"versionType": "git"
},
{
"lessThan": "ae806a95b28fcecb913430cfa45a252e91a945d6",
"status": "affected",
"version": "50ea50cf6f6d31d3235ad1853c5dbea766a3ed11",
"versionType": "git"
},
{
"lessThan": "0a9a0e8a97da70a0336c9115178aaf1be29bcfb1",
"status": "affected",
"version": "50ea50cf6f6d31d3235ad1853c5dbea766a3ed11",
"versionType": "git"
},
{
"lessThan": "520e345ffe05aabef1db82beda4288afb1757ff2",
"status": "affected",
"version": "50ea50cf6f6d31d3235ad1853c5dbea766a3ed11",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_migrate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram\n\nWhen migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set +\nMIGRATE_PFN_VALID unset) driver still allocates device pages. There is no\ndma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart()\nwill return an uninitialized r. That can trigger out_free_vram_pages to drop\nall VRAM just set up.\n\nInitialize r and only call the last svm_migrate_copy_memory_gart if j \u003e 0.\n\nCurrent code postponed the last page to the final copy. This patch flushes on\nthe last page when reach to the end of current drm_buddy_block; avoids another\nsvm_migrate_copy_memory_gart."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local /dev/kfd AMDKFD_IOC_SVM (SET_ATTR prefetch) or the process\u0027s own GPU page-fault SVM restore into svm_migrate_copy_to_vram; it is not reachable from network packets, adjacent wireless, or a physical bus.\nAC:L - An attacker creates anonymous VMA holes (untouched mmap or zero pages) and triggers migration with AMDKFD_IOC_SVM PREFETCH_LOC; migrate_vma records MIGRATE_PFN_MIGRATE without VALID so j stays 0 and the uninitialized-r path runs with no race, victim state, or rare config (HSA_AMD_SVM defaults y).\nPR:L - kfd_open() and AMDKFD_IOC_SVM perform no capable() checks (ioctl flag 0, unlike CRIU); /dev/kfd and the DRM render node are available to unprivileged render-group users on typical ROCm, desktop, and Android AMD GPU systems, which is Low privilege not init-namespace root.\nUI:N - Exploitation uses only the attacker\u0027s own /dev/kfd file descriptor, anonymous mappings, and SVM ioctls; no separate victim must mount a filesystem, open a file, or take any other action.\nS:U - Impact is confined to amdkfd SVM/GPUVM state and ZONE_DEVICE pages in the host kernel; it does not cross a VM, hypervisor, IOMMU device-isolation, or sandbox security authority.\nC:H - Spurious out_free_vram_pages unlocks and puts destination ZONE_DEVICE pages (page_free \u2192 svm_range_bo_unref_async) while SDMA may still copy into that VRAM and a non-zero leftover r can still mark the range GPU-resident; that device-page UAF enables kernel/VRAM disclosure.\nI:H - The same premature free of migrate destination pages, while actual_loc/vram_pages may still record a successful GPU migration, lets later HMM/GPUVM/SDMA operate on put ZONE_DEVICE pages and svm_bo refs, a kernel UAF write/control-flow primitive scored High per UAF guidance.\nA:H - Putting still-in-use ZONE_DEVICE pages and leaving SVM actual_loc/vram_pages inconsistent reliably causes kernel oops/WARN (bad page lock, folio_put on freed pages, VRAM BO validation) or GPU hang/reset, which is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:06.729Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d5872c81c70163a3ba9eb4da9a94c92b03067576"
},
{
"url": "https://git.kernel.org/stable/c/6e1a6f3ddb87d7f89a775c55fb399680c02bdcc2"
},
{
"url": "https://git.kernel.org/stable/c/bd1adb2e5101db649121b59e601c92773a302a70"
},
{
"url": "https://git.kernel.org/stable/c/ae806a95b28fcecb913430cfa45a252e91a945d6"
},
{
"url": "https://git.kernel.org/stable/c/0a9a0e8a97da70a0336c9115178aaf1be29bcfb1"
},
{
"url": "https://git.kernel.org/stable/c/520e345ffe05aabef1db82beda4288afb1757ff2"
}
],
"title": "drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89808",
"datePublished": "2026-09-16T10:30:41.508Z",
"dateReserved": "2026-09-11T19:38:34.767Z",
"dateUpdated": "2026-10-30T12:33:06.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90149 (GCVE-0-2026-90149)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume
the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client
has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so
I/O to a v4.0 flexfiles DS oopses:
- nfs4_init_ds_session() dereferences clp->cl_session->session_state
while seeding the DS lease. It also only seeds cl_lease_time when
NFS4_SESSION_INITING is set; without a session that never happens, so
cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing
every 5 seconds. Seed the lease whenever there is no session and
return before touching session state.
- ff_layout_async_handle_error_v4() dereferences
clp->cl_session->fc_slot_table on every DS I/O error. Fall back to the
v4.0 transport slot table (clp->cl_slot_tbl) when there is no session.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a7878ca140084ec267ede48fce64d7e60f6d873e Version: a7878ca140084ec267ede48fce64d7e60f6d873e Version: a7878ca140084ec267ede48fce64d7e60f6d873e Version: a7878ca140084ec267ede48fce64d7e60f6d873e Version: a7878ca140084ec267ede48fce64d7e60f6d873e Version: a7878ca140084ec267ede48fce64d7e60f6d873e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/flexfilelayout/flexfilelayout.c",
"fs/nfs/nfs4session.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e55d7fec8a9290f73032ee34c35dd68532809633",
"status": "affected",
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
"versionType": "git"
},
{
"lessThan": "336b6da10021c69a8f273bbacdf7432fdc89a06f",
"status": "affected",
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
"versionType": "git"
},
{
"lessThan": "5527af72b0100c94287bfec901b6313eeac567ca",
"status": "affected",
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
"versionType": "git"
},
{
"lessThan": "163c16e01f53fc8eb8d0f3484ae6c382265ecbbd",
"status": "affected",
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
"versionType": "git"
},
{
"lessThan": "436a214514e24103159aea455147d58b44a8a585",
"status": "affected",
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
"versionType": "git"
},
{
"lessThan": "2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc",
"status": "affected",
"version": "a7878ca140084ec267ede48fce64d7e60f6d873e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/flexfilelayout/flexfilelayout.c",
"fs/nfs/nfs4session.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers\n\nflexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume\nthe data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client\nhas no session (clp-\u003ecl_session is NULL; it uses clp-\u003ecl_slot_tbl), so\nI/O to a v4.0 flexfiles DS oopses:\n\n - nfs4_init_ds_session() dereferences clp-\u003ecl_session-\u003esession_state\n while seeding the DS lease. It also only seeds cl_lease_time when\n NFS4_SESSION_INITING is set; without a session that never happens, so\n cl_lease_time stays 0 and nfs4_renew_state() busy-loops, requeuing\n every 5 seconds. Seed the lease whenever there is no session and\n return before touching session state.\n\n - ff_layout_async_handle_error_v4() dereferences\n clp-\u003ecl_session-\u003efc_slot_table on every DS I/O error. Fall back to the\n v4.0 transport slot table (clp-\u003ecl_slot_tbl) when there is no session."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious NFSv4.1 MDS sets version=4 and minor_version=0 in the flexfiles GETDEVICEINFO device-addr body; nfs4_ff_alloc_deviceid_node() accepts that pair, nfs4_set_ds_client() builds a session-less v4.0 nfs_client, and nfs4_init_ds_session() then crashes on DS connect. GETDEVICEINFO is NFS/RPC over TCP.\nAC:L - nfs4_ff_alloc_deviceid_node() explicitly allows an NFSv4.0 DS (version==4 \u0026\u0026 minor_version\u003c3). The MDS sets those two GETDEVICEINFO XDR words, and the next read/write that reaches nfs4_ff_layout_prepare_ds() \u2192 nfs4_init_ds_session() dereferences the NULL cl_session with no race.\nPR:N - The attacker is the remote MDS (or an on-path injector of GETDEVICEINFO replies) and needs no account or capability on the victim client; the client authenticates to the server, not the reverse.\nUI:N - On an already-mounted pNFS flexfiles share, ordinary file I/O drives LAYOUTGET then GETDEVICEINFO; the MDS can return a v4.0 DS in that GETDEVICEINFO and nfs4_init_ds_session() oopses with no further victim action such as mounting a new image.\nS:U - The NULL dereference oopses the NFS client kernel itself and does not cross a VM, IOMMU, or other security-authority boundary.\nC:N - nfs4_init_ds_session() loads clp-\u003ecl_session-\u003esession_state when cl_session is NULL, a pure NULL-pointer fault at a low offset of struct nfs4_session, with no out-of-bounds read or other disclosure.\nI:N - The same NULL load of cl_session (and cl_session-\u003efc_slot_table in ff_layout_async_handle_error_v4) faults before any store; this is not a UAF, overflow, or type confusion that could yield a write primitive.\nA:H - Dereferencing the NULL cl_session in nfs4_init_ds_session() on DS connect, or cl_session-\u003efc_slot_table in ff_layout_async_handle_error_v4 on a DS I/O error, produces a kernel oops that takes down the client."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:23.855Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e55d7fec8a9290f73032ee34c35dd68532809633"
},
{
"url": "https://git.kernel.org/stable/c/336b6da10021c69a8f273bbacdf7432fdc89a06f"
},
{
"url": "https://git.kernel.org/stable/c/5527af72b0100c94287bfec901b6313eeac567ca"
},
{
"url": "https://git.kernel.org/stable/c/163c16e01f53fc8eb8d0f3484ae6c382265ecbbd"
},
{
"url": "https://git.kernel.org/stable/c/436a214514e24103159aea455147d58b44a8a585"
},
{
"url": "https://git.kernel.org/stable/c/2b03ebbf8d5e8f6af4ecd6c65375232dd1ec32cc"
}
],
"title": "NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90149",
"datePublished": "2026-09-17T16:06:43.671Z",
"dateReserved": "2026-09-11T19:38:34.789Z",
"dateUpdated": "2026-10-30T12:34:23.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64400 (GCVE-0-2026-64400)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prevent path traversal bypass by restricting caseless retry
ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path
resolution within the share root. When a crafted path attempts to
escape the share boundary using parent-directory components ('..'),
vfs_path_parent_lookup() detects this and immediately fails,
returning -EXDEV.
However, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.
The function fails to intercept the -EXDEV error and erroneously
falls through to the caseless retry logic, which is intended only
for genuinely missing files. During this retry process, the path
is reconstructed, leading to an unintended LOOKUP_BENEATH bypass
that allows write-capable users to create zero-length files or
directories outside the exported share.
Fix this by ensuring that the execution only proceeds to the caseless
lookup retry when the error is specifically -ENOENT. Any other errors,
such as -EXDEV from a path traversal attempt, must be returned immediately.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6927ffe7479c72e7ebf885507227266a75f7c97d Version: 74d7970febf7e9005375aeda0df821d2edffc9f7 Version: 74d7970febf7e9005375aeda0df821d2edffc9f7 Version: 74d7970febf7e9005375aeda0df821d2edffc9f7 Version: 74d7970febf7e9005375aeda0df821d2edffc9f7 Version: 74d7970febf7e9005375aeda0df821d2edffc9f7 Version: 019aae488dbc67c97a33db03652e20e2c9e3afa7 Version: ef6cc1c465786b3e4e735d1ab8b616b3e94402df Version: 6.1.71 ≤ Version: 5.15.145 ≤ Version: 6.3.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/vfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21f050439db157f2afcc19885dec14549ca6ffc0",
"status": "affected",
"version": "6927ffe7479c72e7ebf885507227266a75f7c97d",
"versionType": "git"
},
{
"lessThan": "eec1dd2586c4016b7555a5d047db2b3756459fb2",
"status": "affected",
"version": "74d7970febf7e9005375aeda0df821d2edffc9f7",
"versionType": "git"
},
{
"lessThan": "a1c331d98313380c38f616c8b28b890ec8ef9c28",
"status": "affected",
"version": "74d7970febf7e9005375aeda0df821d2edffc9f7",
"versionType": "git"
},
{
"lessThan": "cfb5a56c218888f9d74165dff0c282cd0be97983",
"status": "affected",
"version": "74d7970febf7e9005375aeda0df821d2edffc9f7",
"versionType": "git"
},
{
"lessThan": "8c9a4f1327eb71efbf14842e7b8a6d965077eb67",
"status": "affected",
"version": "74d7970febf7e9005375aeda0df821d2edffc9f7",
"versionType": "git"
},
{
"lessThan": "54bab9ba5a9f156ffa9324fcbe5a356fd0242f95",
"status": "affected",
"version": "74d7970febf7e9005375aeda0df821d2edffc9f7",
"versionType": "git"
},
{
"status": "affected",
"version": "019aae488dbc67c97a33db03652e20e2c9e3afa7",
"versionType": "git"
},
{
"status": "affected",
"version": "ef6cc1c465786b3e4e735d1ab8b616b3e94402df",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/vfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. When a crafted path attempts to\nescape the share boundary using parent-directory components (\u0027..\u0027),\nvfs_path_parent_lookup() detects this and immediately fails,\nreturning -EXDEV.\n\nHowever, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.\nThe function fails to intercept the -EXDEV error and erroneously\nfalls through to the caseless retry logic, which is intended only\nfor genuinely missing files. During this retry process, the path\nis reconstructed, leading to an unintended LOOKUP_BENEATH bypass\nthat allows write-capable users to create zero-length files or\ndirectories outside the exported share.\n\nFix this by ensuring that the execution only proceeds to the caseless\nlookup retry when the error is specifically -ENOENT. Any other errors,\nsuch as -EXDEV from a path traversal attempt, must be returned immediately."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable lookup is reached remotely through SMB2 CREATE requests handled by ksmbd over TCP/445.\nAC:L - The attacker controls the crafted parent-directory path and can issue repeated or concurrent requests; any required lookup/create race is attacker-driven.\nPR:N - Although a valid SMB session and writable tree connection are required, ksmbd supports anonymous guest sessions on writable shares, requiring no prior privileges in a reasonable deployment.\nUI:N - Exploitation requires only attacker-generated SMB requests and no action by a victim.\nS:U - The bypass affects filesystems managed by the same host kernel and does not cross a virtualization or comparable security authority boundary.\nC:L - File contents are not exposed, but the out-of-share caseless directory walk and distinguishable errors can disclose limited pathname-existence metadata.\nI:L - The attacker can create chosen zero-length files or directories outside the export, but cannot supply file contents or overwrite arbitrary existing data through this flaw.\nA:H - Repeated creation in an escaped world-writable location can exhaust root-filesystem inodes, storage, or tmpfs memory and cause system-wide service unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:53.511Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21f050439db157f2afcc19885dec14549ca6ffc0"
},
{
"url": "https://git.kernel.org/stable/c/eec1dd2586c4016b7555a5d047db2b3756459fb2"
},
{
"url": "https://git.kernel.org/stable/c/a1c331d98313380c38f616c8b28b890ec8ef9c28"
},
{
"url": "https://git.kernel.org/stable/c/cfb5a56c218888f9d74165dff0c282cd0be97983"
},
{
"url": "https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67"
},
{
"url": "https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95"
}
],
"title": "ksmbd: prevent path traversal bypass by restricting caseless retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64400",
"datePublished": "2026-07-25T08:50:43.655Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-10-30T12:27:53.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68418 (GCVE-0-2026-68418)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Prevent user-triggered null deref on QP create
Previously, the user QP creation path would only attempt to
populate iwqp->iwpbl if the user-provided req.user_wqe_bufs
field was non-zero. The problem is that iwqp->iwpbl is
unconditionally dereferenced later on in irdma_setup_virt_qp.
While there was a check for iwqp->iwpbl != NULL, this check
would only occur if req.user_wqe_bufs was non-zero. The end
result is that a user could send a zero user_wqe_bufs value
and trigger a null ptr deref.
Fix this by unconditionally calling irdma_get_pbl and bailing
if it fails, similar to the CQ and SRQ paths.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e75028c000e9560a7ff66a23d7cd872a967ab7e",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "d52ff592abfcd56234f266aa245c489f70b1c554",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "ad68e0b759f9569f0dfea84f035c91eadb979802",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "ec675b4cdfd378d8c9dd8c93126c024f2469bd79",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "728211c815f6eef28dd3df2a5b6297483185aa20",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "b9b0889071569d43623c260074e159cd8f26adb1",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Prevent user-triggered null deref on QP create\n\nPreviously, the user QP creation path would only attempt to\npopulate iwqp-\u003eiwpbl if the user-provided req.user_wqe_bufs\nfield was non-zero. The problem is that iwqp-\u003eiwpbl is\nunconditionally dereferenced later on in irdma_setup_virt_qp.\n\nWhile there was a check for iwqp-\u003eiwpbl != NULL, this check\nwould only occur if req.user_wqe_bufs was non-zero. The end\nresult is that a user could send a zero user_wqe_bufs value\nand trigger a null ptr deref.\n\nFix this by unconditionally calling irdma_get_pbl and bailing\nif it fails, similar to the CQ and SRQ paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:34.156Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e75028c000e9560a7ff66a23d7cd872a967ab7e"
},
{
"url": "https://git.kernel.org/stable/c/d52ff592abfcd56234f266aa245c489f70b1c554"
},
{
"url": "https://git.kernel.org/stable/c/ad68e0b759f9569f0dfea84f035c91eadb979802"
},
{
"url": "https://git.kernel.org/stable/c/ec675b4cdfd378d8c9dd8c93126c024f2469bd79"
},
{
"url": "https://git.kernel.org/stable/c/728211c815f6eef28dd3df2a5b6297483185aa20"
},
{
"url": "https://git.kernel.org/stable/c/b9b0889071569d43623c260074e159cd8f26adb1"
}
],
"title": "RDMA/irdma: Prevent user-triggered null deref on QP create",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68418",
"datePublished": "2026-08-10T12:04:38.930Z",
"dateReserved": "2026-07-30T09:28:09.391Z",
"dateUpdated": "2026-10-30T12:28:34.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74713 (GCVE-0-2026-74713)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost_iotlb: bound map allocation in add_range
vhost_iotlb_add_range_ctx() only retires an old entry when the table
has a non-zero limit, has exactly reached that limit and has
VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating
entries after reaching their configured limit.
Existing vhost devices allocate their IOTLB with max_iotlb_entries from
vhost.c, which defaults to 2048 and is tunable by module parameter. Use
the caller-provided limit at the allocation point instead of adding a
separate default in the common IOTLB helper, and reject non-positive
values in vhost paths that can report an error.
Other vhost IOTLB users should not create zero-limit tables when entries
can be populated from userspace or guest-controlled requests. Add
caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and
vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require
at least two entries for vdpa_sim and mlx5 vDPA paths that install
full-range mappings, since those mappings are split into two IOTLB
entries.
Handle full-range mappings in the common helper by checking that the
IOTLB can hold both split entries before inserting the first half. This
avoids returning an error after leaving a half mapping behind.
When the table is full, keep the existing retire behavior for retiring
tables and return -ENOSPC for non-retiring tables. Reuse the retired map
node instead of freeing it and allocating a replacement, so a stream of
IOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table
has reached its limit. If a zero-limit IOTLB still reaches the common
helper, treat it as a configuration error and return -EINVAL.
I found this bug myself, though the patch was written with AI assistance.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c Version: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c Version: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c Version: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c Version: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c Version: 0bbe30668d89ec8a309f28ced6d092c90fb23e8c |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:21.643384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:11.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/core/mlx5_vdpa.h",
"drivers/vdpa/mlx5/core/mr.c",
"drivers/vdpa/mlx5/core/resources.c",
"drivers/vdpa/vdpa_sim/vdpa_sim.c",
"drivers/vdpa/vdpa_user/iova_domain.c",
"drivers/vhost/iotlb.c",
"drivers/vhost/vdpa.c",
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91d3f1fcb8f7109f18d46a7366bb8202ac4b4456",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
},
{
"lessThan": "96da3e1439e7d689eea09fc9b6227fbab5b88ac3",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
},
{
"lessThan": "eb70200e34772572ad08e99291b08afea6522111",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
},
{
"lessThan": "b57164cdddb46924ff9fa191b727ca097744de88",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
},
{
"lessThan": "ae128dd19040ee06a4f8143c7ced4d18080d7a9a",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
},
{
"lessThan": "1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94",
"status": "affected",
"version": "0bbe30668d89ec8a309f28ced6d092c90fb23e8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/core/mlx5_vdpa.h",
"drivers/vdpa/mlx5/core/mr.c",
"drivers/vdpa/mlx5/core/resources.c",
"drivers/vdpa/vdpa_sim/vdpa_sim.c",
"drivers/vdpa/vdpa_user/iova_domain.c",
"drivers/vhost/iotlb.c",
"drivers/vhost/vdpa.c",
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost_iotlb: bound map allocation in add_range\n\nvhost_iotlb_add_range_ctx() only retires an old entry when the table\nhas a non-zero limit, has exactly reached that limit and has\nVHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating\nentries after reaching their configured limit.\n\nExisting vhost devices allocate their IOTLB with max_iotlb_entries from\nvhost.c, which defaults to 2048 and is tunable by module parameter. Use\nthe caller-provided limit at the allocation point instead of adding a\nseparate default in the common IOTLB helper, and reject non-positive\nvalues in vhost paths that can report an error.\n\nOther vhost IOTLB users should not create zero-limit tables when entries\ncan be populated from userspace or guest-controlled requests. Add\ncaller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and\nvhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require\nat least two entries for vdpa_sim and mlx5 vDPA paths that install\nfull-range mappings, since those mappings are split into two IOTLB\nentries.\n\nHandle full-range mappings in the common helper by checking that the\nIOTLB can hold both split entries before inserting the first half. This\navoids returning an error after leaving a half mapping behind.\n\nWhen the table is full, keep the existing retire behavior for retiring\ntables and return -ENOSPC for non-retiring tables. Reuse the retired map\nnode instead of freeing it and allocating a replacement, so a stream of\nIOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table\nhas reached its limit. If a zero-limit IOTLB still reaches the common\nhelper, treat it as a configuration error and return -EINVAL.\n\nI found this bug myself, though the patch was written with AI assistance."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached via local VHOST_IOTLB_UPDATE writes on /dev/vhost-* or /dev/vhost-vdpa char devices, or when a KVM guest drives virtio IOTLB misses that the VMM resolves through vhost; it is not triggered by remote network packets.\nAC:L - An attacker reliably floods distinct IOTLB mappings by repeatedly issuing VHOST_IOTLB_UPDATE messages or provoking guest IOTLB misses; no race, rare configuration, or attacker-uncontrollable memory layout is required once vhost IOTLB is active.\nPR:N - A malicious KVM guest can provoke unbounded IOTLB growth through normal virtio IOTLB-miss handling without any host credentials; a host attacker holding the vhost-vdpa/vhost device node also needs no capabilities beyond device access.\nUI:N - Exploitation requires no victim interaction beyond the VM or vhost device already being in use; the attacker programmatically drives the IOTLB update stream in a tight loop.\nS:C - In cloud/KVM deployments, an unprivileged guest VM causes unbounded host-kernel GFP_ATOMIC allocations in vhost_iotlb_add_range_ctx(), crossing the VM/host security boundary to deny service on the hypervisor.\nC:N - The bug causes only unbounded kmalloc of vhost_iotlb_map structures without out-of-bounds access, use-after-free, or information disclosure; successful exploitation does not read kernel memory.\nI:N - No memory corruption or arbitrary write occurs; impact is limited to kernel memory consumption and does not modify data or enable code execution through the allocation flaw itself.\nA:H - Unbounded IOTLB entry allocation or perpetual GFP_ATOMIC kmalloc when tables are at capacity exhausts kernel memory/atomic reserves, causing host OOM, kernel panics, or complete hypervisor denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:21.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91d3f1fcb8f7109f18d46a7366bb8202ac4b4456"
},
{
"url": "https://git.kernel.org/stable/c/96da3e1439e7d689eea09fc9b6227fbab5b88ac3"
},
{
"url": "https://git.kernel.org/stable/c/eb70200e34772572ad08e99291b08afea6522111"
},
{
"url": "https://git.kernel.org/stable/c/b57164cdddb46924ff9fa191b727ca097744de88"
},
{
"url": "https://git.kernel.org/stable/c/ae128dd19040ee06a4f8143c7ced4d18080d7a9a"
},
{
"url": "https://git.kernel.org/stable/c/1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94"
}
],
"title": "vhost_iotlb: bound map allocation in add_range",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74713",
"datePublished": "2026-08-22T15:33:09.028Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-10-30T12:30:21.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74747 (GCVE-0-2026-74747)
Vulnerability from cvelistv5
Published
2026-08-26 14:36
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: revalidate ihl to prevent out-of-bounds access
While the outer IP header is already pulled into the skb head,
we must be careful and revalidate the embedded headers after
reading them from the skb frags to prevent out-of-bounds
access.
One such place reported by Sashiko is ip_vs_nat_icmp() where
local process can change the ihl field and after
skb_ensure_writable() we can see larger value which is a
problem for the ip_send_check(cih) calls.
Add check to drop the packet if the ihl field is changed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:16:17.710947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:23.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f55bb94946fb8ee6304590a731c39c1fbc3b28bc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2512289cbf58706fd558e8fccea4e28003a2af54",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "041b2303c8019394735c1f76c5138657bf660a7d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eb81c8e758f49e04391f77d9470a6232bb5f1c7a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5365f012451fce2453f13a568dcb72ea534c1e4d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d93660df4dd1d116f608ada4a29a80a5d6f0a6ed",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_core.c",
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: revalidate ihl to prevent out-of-bounds access\n\nWhile the outer IP header is already pulled into the skb head,\nwe must be careful and revalidate the embedded headers after\nreading them from the skb frags to prevent out-of-bounds\naccess.\n\nOne such place reported by Sashiko is ip_vs_nat_icmp() where\nlocal process can change the ihl field and after\nskb_ensure_writable() we can see larger value which is a\nproblem for the ip_send_check(cih) calls.\n\nAdd check to drop the packet if the ihl field is changed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local process to TOCTOU-modify the embedded IPv4 ihl in skb frags between ip_vs_fill_iph_skb_icmp() and skb_ensure_writable(); remote ICMP to IPVS NAT hooks reaches ip_vs_nat_icmp() but cannot change skb backing memory without local access to the packet buffer.\nAC:L - A local attacker controls both sides of the race by concurrently injecting ICMP errors matching an IPVS NAT connection and mutating the embedded header ihl in userspace-backed skb frags during softirq processing; no uncontrollable victim state or heap layout is required.\nPR:L - Only a local account able to race skb frag modification (e.g., via raw/packet sockets with CAP_NET_RAW obtainable in user namespaces) against IPVS ICMP NAT handling on a host where IPVS is already configured is needed; init-namespace root is not required.\nUI:N - No victim user interaction is required; exploitation is driven entirely by attacker-controlled local packet injection and concurrent frag modification while IPVS processes ICMP errors on NAT-mode connections through LOCAL_IN, LOCAL_OUT, or FORWARD hooks.\nS:U - The out-of-bounds access corrupts kernel skb memory on the IPVS load-balancer host within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - After skb_ensure_writable(), ip_send_check(cih) re-reads an attacker-inflated cih-\u003eihl and ip_fast_csum() reads far beyond the validated skb region, enabling out-of-bounds kernel memory disclosure on internet-facing IPVS NAT nodes and kube-proxy IPVS clusters.\nI:H - The inflated ihl causes out-of-bounds access during ICMP NAT mangling in ip_vs_nat_icmp(), corrupting skb data beyond skb_ensure_writable()\u0027s bound; such kernel memory corruption is exploitable for control-flow hijacking and privilege escalation on load balancers.\nA:H - Out-of-bounds access in ip_send_check(cih) during ICMP NAT handling can trigger kernel oops or panic; a local attacker can repeatedly race the TOCTOU on IPVS NAT nodes, causing sustained denial of service on critical infrastructure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:30.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f55bb94946fb8ee6304590a731c39c1fbc3b28bc"
},
{
"url": "https://git.kernel.org/stable/c/2512289cbf58706fd558e8fccea4e28003a2af54"
},
{
"url": "https://git.kernel.org/stable/c/041b2303c8019394735c1f76c5138657bf660a7d"
},
{
"url": "https://git.kernel.org/stable/c/eb81c8e758f49e04391f77d9470a6232bb5f1c7a"
},
{
"url": "https://git.kernel.org/stable/c/5365f012451fce2453f13a568dcb72ea534c1e4d"
},
{
"url": "https://git.kernel.org/stable/c/d93660df4dd1d116f608ada4a29a80a5d6f0a6ed"
}
],
"title": "ipvs: revalidate ihl to prevent out-of-bounds access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74747",
"datePublished": "2026-08-26T14:36:56.563Z",
"dateReserved": "2026-08-15T05:44:03.931Z",
"dateUpdated": "2026-10-30T12:30:30.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89528 (GCVE-0-2026-89528)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject Read lists that exceed the page budget
Individual Read segment lengths are validated at decode time, but
nothing prevents a requester from sending multiple segments whose
cumulative length exceeds the rq_pages array budget. When one
segment fills the page array exactly, the runtime guard in
svc_rdma_build_read_segment() is bypassed because len reaches zero.
A subsequent segment then accesses the NULL sentinel slot at
rq_pages[rq_maxpages], resulting in a NULL pointer dereference during
DMA mapping.
Accumulate pages across all Read segments and reject the message at
decode time when the total would overflow the page budget.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 026d958b38c628a1b4ced534808945365e2747a5 Version: 026d958b38c628a1b4ced534808945365e2747a5 Version: 026d958b38c628a1b4ced534808945365e2747a5 Version: 026d958b38c628a1b4ced534808945365e2747a5 Version: 026d958b38c628a1b4ced534808945365e2747a5 Version: 026d958b38c628a1b4ced534808945365e2747a5 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89528",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:23:02.453234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:41.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08aa4162df91880a79be744aaa9570b04d4875c4",
"status": "affected",
"version": "026d958b38c628a1b4ced534808945365e2747a5",
"versionType": "git"
},
{
"lessThan": "beb4e9801f6362436102acc4cc5304b7324f9365",
"status": "affected",
"version": "026d958b38c628a1b4ced534808945365e2747a5",
"versionType": "git"
},
{
"lessThan": "e70fdb121171c3eb0ac34eb545721828cd737717",
"status": "affected",
"version": "026d958b38c628a1b4ced534808945365e2747a5",
"versionType": "git"
},
{
"lessThan": "1a3af2262cb384112ef38632de4690682be528b4",
"status": "affected",
"version": "026d958b38c628a1b4ced534808945365e2747a5",
"versionType": "git"
},
{
"lessThan": "465f511f59a0fa7a80d5d1073c4b24f28ea38f58",
"status": "affected",
"version": "026d958b38c628a1b4ced534808945365e2747a5",
"versionType": "git"
},
{
"lessThan": "0ca487abb3bdf581851664b5db21f364caf57682",
"status": "affected",
"version": "026d958b38c628a1b4ced534808945365e2747a5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Read lists that exceed the page budget\n\nIndividual Read segment lengths are validated at decode time, but\nnothing prevents a requester from sending multiple segments whose\ncumulative length exceeds the rq_pages array budget. When one\nsegment fills the page array exactly, the runtime guard in\nsvc_rdma_build_read_segment() is bypassed because len reaches zero.\nA subsequent segment then accesses the NULL sentinel slot at\nrq_pages[rq_maxpages], resulting in a NULL pointer dereference during\nDMA mapping.\n\nAccumulate pages across all Read segments and reject the message at\ndecode time when the total would overflow the page budget."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote peer reaches svc_rdma_recvfrom() by sending a Call with a Read list on an enabled NFS/RDMA listener over routable RoCEv2 or iWARP.\nAC:L - The attacker fully controls Read-segment lengths in the transport header and can deterministically fill rq_pages exactly, then send a further segment so the len==0 overrun guard is skipped and the NULL sentinel is DMA-mapped, with no race or uncontrollable layout.\nPR:N - xdr_count_read_segments() and svc_rdma_build_read_segment() run in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.\nUI:N - Sending a crafted RPC-over-RDMA message with an over-budget Read list is sufficient; no victim mount, click, or other user action is required.\nS:U - The NULL dereference oops stays in the host kernel that owns nfsd/svcrdma; this is not a VM, IOMMU, or sandbox escape.\nC:N - The fault is a NULL pointer dereference of the rq_pages[rq_maxpages] sentinel during DMA mapping; the access faults immediately and does not disclose kernel memory.\nI:N - The sentinel slot is a guaranteed NULL page pointer, not an out-of-bounds page used as a write destination; DMA mapping aborts on the NULL page without an arbitrary-write or control-flow hijack primitive.\nA:H - DMA mapping the NULL sentinel produces a kernel oops or panic that an unauthenticated NFS/RDMA peer can trigger repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:00.323Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08aa4162df91880a79be744aaa9570b04d4875c4"
},
{
"url": "https://git.kernel.org/stable/c/beb4e9801f6362436102acc4cc5304b7324f9365"
},
{
"url": "https://git.kernel.org/stable/c/e70fdb121171c3eb0ac34eb545721828cd737717"
},
{
"url": "https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4"
},
{
"url": "https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58"
},
{
"url": "https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682"
}
],
"title": "svcrdma: Reject Read lists that exceed the page budget",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89528",
"datePublished": "2026-09-11T19:44:08.514Z",
"dateReserved": "2026-09-11T19:38:34.719Z",
"dateUpdated": "2026-10-30T12:32:00.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98044 (GCVE-0-2026-98044)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject legacy packet loads from callbacks
check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a
subprogram as an implicit return with R0 set to zero. It calls
prepare_func_exit() to explore this synthesized path.
When the load is reached directly from a synchronous callback,
prepare_func_exit() enforces the callback return contract and marks R0
precise. R0 is not derived from a real instruction on this path, so
precision backtracking reaches the callback call with R0 still requested
and triggers the "callback unexpected regs" verifier bug. A privileged
program loader can therefore cause a verifier warning and an -EFAULT
BPF_PROG_LOAD.
These legacy packet-load instructions are deprecated. Reject them from
callbacks rather than complicating their implicit-return model. Check all
active frames before constructing the implicit return so nested static
subprograms cannot hide the callback context.
Global functions are verified independently with a fresh frame zero, so
an active-frame check cannot identify a global function called from a
callback. Also check the complete subprogram call graph during stack-depth
validation and reject a function containing a legacy load when any caller
is a callback. This covers global and static descendants without making
has_ld_abs transitive, preserving its per-function BTF return-type check.
Ordinary uses outside callbacks remain supported.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8674e2db06cff6b50f2216eed9a761d15425bb34 Version: ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 Version: ee861486e377edc55361c08dcbceab3f6b6577bd Version: ee861486e377edc55361c08dcbceab3f6b6577bd Version: 928d354ae3557e8f755a227e67be88034eb3cd7f Version: 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe Version: de1055e7f9e67af32b1f3376066272b04e5223c0 Version: 37ad2bb11e9de92cb7b94548705eeedd87f7d392 Version: d846d83bdacbd8f14fc45c63b8c1d22608452e1c Version: 6.12.101 ≤ Version: 6.18.42 ≤ Version: 5.10.265 ≤ Version: 5.15.216 ≤ Version: 6.1.183 ≤ Version: 6.6.148 ≤ Version: 7.0.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cebda2a2bb4183550eae9dcf888c16407b4fffda",
"status": "affected",
"version": "8674e2db06cff6b50f2216eed9a761d15425bb34",
"versionType": "git"
},
{
"lessThan": "3484a99303912db62428494a9061212049027e57",
"status": "affected",
"version": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
"versionType": "git"
},
{
"lessThan": "bc489c0c9b8c86bd7fac42cfd1bb152f042fca56",
"status": "affected",
"version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
"versionType": "git"
},
{
"lessThan": "e7d28823c662128caae63f14e16bd394916c139b",
"status": "affected",
"version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
"versionType": "git"
},
{
"status": "affected",
"version": "928d354ae3557e8f755a227e67be88034eb3cd7f",
"versionType": "git"
},
{
"status": "affected",
"version": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
"versionType": "git"
},
{
"status": "affected",
"version": "de1055e7f9e67af32b1f3376066272b04e5223c0",
"versionType": "git"
},
{
"status": "affected",
"version": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
"versionType": "git"
},
{
"status": "affected",
"version": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThan": "6.18.53",
"status": "affected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.18.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.265",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject legacy packet loads from callbacks\n\ncheck_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a\nsubprogram as an implicit return with R0 set to zero. It calls\nprepare_func_exit() to explore this synthesized path.\n\nWhen the load is reached directly from a synchronous callback,\nprepare_func_exit() enforces the callback return contract and marks R0\nprecise. R0 is not derived from a real instruction on this path, so\nprecision backtracking reaches the callback call with R0 still requested\nand triggers the \"callback unexpected regs\" verifier bug. A privileged\nprogram loader can therefore cause a verifier warning and an -EFAULT\nBPF_PROG_LOAD.\n\nThese legacy packet-load instructions are deprecated. Reject them from\ncallbacks rather than complicating their implicit-return model. Check all\nactive frames before constructing the implicit return so nested static\nsubprograms cannot hide the callback context.\n\nGlobal functions are verified independently with a fresh frame zero, so\nan active-frame check cannot identify a global function called from a\ncallback. Also check the complete subprogram call graph during stack-depth\nvalidation and reject a function containing a legacy load when any caller\nis a callback. This covers global and static descendants without making\nhas_ld_abs transitive, preserving its per-function BTF return-type check.\nOrdinary uses outside callbacks remain supported."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:12.833Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cebda2a2bb4183550eae9dcf888c16407b4fffda"
},
{
"url": "https://git.kernel.org/stable/c/3484a99303912db62428494a9061212049027e57"
},
{
"url": "https://git.kernel.org/stable/c/bc489c0c9b8c86bd7fac42cfd1bb152f042fca56"
},
{
"url": "https://git.kernel.org/stable/c/e7d28823c662128caae63f14e16bd394916c139b"
}
],
"title": "bpf: Reject legacy packet loads from callbacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98044",
"datePublished": "2026-09-25T10:23:55.454Z",
"dateReserved": "2026-09-25T10:19:56.071Z",
"dateUpdated": "2026-10-21T12:54:12.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53103 (GCVE-0-2026-53103)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-11-06 16:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
roc_abort_sync() can deadlock with roc_work(). roc_work() holds
dev->mt76.mutex, while cancel_work_sync() waits for roc_work()
to finish. If the caller already owns the same mutex, both
sides block and no progress is possible.
This deadlock can occur during station removal when
mt76_sta_state() -> mt76_sta_remove() ->
mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() ->
mt7925_roc_abort_sync() invokes cancel_work_sync() while
roc_work() is still running and holding dev->mt76.mutex.
This avoids the mutex deadlock and preserves exactly-once
work ownership.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 45064d19fd3af6aeb0887b35b5564927980cf150 Version: 45064d19fd3af6aeb0887b35b5564927980cf150 Version: 45064d19fd3af6aeb0887b35b5564927980cf150 Version: 45064d19fd3af6aeb0887b35b5564927980cf150 Version: 978d1756b3ae1b857826eb7ed8181f3c5180dce9 Version: 6.11.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:18:39.366043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:23:59.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "253cfc33d95ce4a30fd2eca0ff0138603c6c2fcc",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"lessThan": "153bcba36c87a1ba555b57b6c49028d5812f895b",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"lessThan": "2d8e0053bca29143ace51e08c980ff076844a4b0",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"lessThan": "dd08ca3f092f4185ece69ce2a835c23198b1628a",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"status": "affected",
"version": "978d1756b3ae1b857826eb7ed8181f3c5180dce9",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync\n\nroc_abort_sync() can deadlock with roc_work(). roc_work() holds\ndev-\u003emt76.mutex, while cancel_work_sync() waits for roc_work()\nto finish. If the caller already owns the same mutex, both\nsides block and no progress is possible.\n\nThis deadlock can occur during station removal when\nmt76_sta_state() -\u003e mt76_sta_remove() -\u003e\nmt7925_mac_sta_remove_link() -\u003e mt7925_mac_link_sta_remove() -\u003e\nmt7925_roc_abort_sync() invokes cancel_work_sync() while\nroc_work() is still running and holding dev-\u003emt76.mutex.\n\nThis avoids the mutex deadlock and preserves exactly-once\nwork ownership."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:59.799Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/253cfc33d95ce4a30fd2eca0ff0138603c6c2fcc"
},
{
"url": "https://git.kernel.org/stable/c/153bcba36c87a1ba555b57b6c49028d5812f895b"
},
{
"url": "https://git.kernel.org/stable/c/2d8e0053bca29143ace51e08c980ff076844a4b0"
},
{
"url": "https://git.kernel.org/stable/c/dd08ca3f092f4185ece69ce2a835c23198b1628a"
}
],
"title": "wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53103",
"datePublished": "2026-06-24T16:30:39.184Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-11-06T16:23:59.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100077 (GCVE-0-2026-100077)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we
recover the GPU. Retiring the submit triggers BO free and that can
result in GPU pagefaults since the GPU may be actively accessing those
BOs.
To fix this, retire the submits after gpu recovery is complete in
recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 Version: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 Version: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 Version: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 Version: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 Version: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9cf623ae29876788adfddd6ca01e2b8545594c14",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "d4bee74b7cb93e40c60b43dc9dc0c3aab444649f",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "2f021d93f15829ba052ff22bc40df0ec3ae7c7ab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:39.810Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9cf623ae29876788adfddd6ca01e2b8545594c14"
},
{
"url": "https://git.kernel.org/stable/c/d4bee74b7cb93e40c60b43dc9dc0c3aab444649f"
},
{
"url": "https://git.kernel.org/stable/c/2f021d93f15829ba052ff22bc40df0ec3ae7c7ab"
},
{
"url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794"
},
{
"url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab"
},
{
"url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c"
}
],
"title": "drm/msm: Recover HW before retire hung submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100077",
"datePublished": "2026-09-25T13:06:48.707Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-10-30T12:23:39.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46181 (GCVE-0-2026-46181)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
Sashiko points out the radix_tree itself is RCU safe, but nothing ever
frees the mlx4_srq struct with RCU, and it isn't even accessed within the
RCU critical section. It also will crash if an event is delivered before
the srq object is finished initializing.
Use the spinlock since it isn't easy to make RCU work, use
refcount_inc_not_zero() to protect against partially initialized objects,
and order the refcount_set() to be after the srq is fully initialized.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 30353bfc43a1602c020f31d95cf27182ffd23824 Version: 30353bfc43a1602c020f31d95cf27182ffd23824 Version: 30353bfc43a1602c020f31d95cf27182ffd23824 Version: 30353bfc43a1602c020f31d95cf27182ffd23824 Version: 30353bfc43a1602c020f31d95cf27182ffd23824 Version: 30353bfc43a1602c020f31d95cf27182ffd23824 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.rt56.1307.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.rt7.473.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.197.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.197.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.199.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.199.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.15.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.rt14.463.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.135.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update (RCU) in the `mlx4_srq_event()` function. An attacker could potentially trigger an event before the `srq` object is fully initialized, leading to a system crash. This could result in a Denial of Service (DoS) for the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-366",
"description": "Race Condition within a Thread",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T12:04:28.058Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46181"
},
{
"name": "RHBZ#2482532",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482532"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46181.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36216"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41236"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34095"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34443"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25217"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25121"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35896"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35894"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35863"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25120"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33900"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:36216: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:34095: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:34443: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25121: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:35896: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:35894: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:25120: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:20:51.759084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-366",
"description": "CWE-366 Race Condition within a Thread",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:54.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx4/srq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "654aeddbc6e0f6e56531985bb12328ab4230c6c1",
"status": "affected",
"version": "30353bfc43a1602c020f31d95cf27182ffd23824",
"versionType": "git"
},
{
"lessThan": "2d8b30b496bc53e961ba7415fd629fc27813017c",
"status": "affected",
"version": "30353bfc43a1602c020f31d95cf27182ffd23824",
"versionType": "git"
},
{
"lessThan": "f0dbd9355ce1e93808541260c7ffab7956df9233",
"status": "affected",
"version": "30353bfc43a1602c020f31d95cf27182ffd23824",
"versionType": "git"
},
{
"lessThan": "1e2a44875b6afb4add1115f7f3351dcbeb6f273d",
"status": "affected",
"version": "30353bfc43a1602c020f31d95cf27182ffd23824",
"versionType": "git"
},
{
"lessThan": "8b7833f3bce35cb0d01c1503781523c099c675f0",
"status": "affected",
"version": "30353bfc43a1602c020f31d95cf27182ffd23824",
"versionType": "git"
},
{
"lessThan": "c9341307ea16b9395c2e4c9c94d8499d91fe31d0",
"status": "affected",
"version": "30353bfc43a1602c020f31d95cf27182ffd23824",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx4/srq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()\n\nSashiko points out the radix_tree itself is RCU safe, but nothing ever\nfrees the mlx4_srq struct with RCU, and it isn\u0027t even accessed within the\nRCU critical section. It also will crash if an event is delivered before\nthe srq object is finished initializing.\n\nUse the spinlock since it isn\u0027t easy to make RCU work, use\nrefcount_inc_not_zero() to protect against partially initialized objects,\nand order the refcount_set() to be after the srq is fully initialized."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The race\u0027s controllable side (SRQ create/destroy) is driven by local user space through the RDMA verbs interface (/dev/infiniband/uverbsN); a purely remote RDMA peer can generate events but cannot control SRQ lifecycle on the target, so exploitation requires local device access.\nAC:L - The attacker drives both sides \u2014 repeatedly creating/arming/destroying SRQs while keeping them at their limit watermark to make events fire \u2014 so the UAF/partial-init race is winnable through repetition rather than depending on conditions outside the attacker\u0027s control.\nPR:L - Creating/destroying SRQs requires access to the RDMA device node but not root or CAP_SYS_ADMIN; unprivileged users routinely have such access under the user-space RDMA model, so low privileges suffice.\nUI:N - The attacker performs all SRQ allocation, arming, and teardown themselves; no action by another user is required.\nS:U - The use-after-free and any resulting corruption stay within the kernel\u0027s own security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - A use-after-free lets the attacker reallocate the freed mlx4_srq with controlled contents that are then read (refcount, srq-\u003eevent pointer), enabling kernel memory disclosure.\nI:H - The handler performs refcount manipulation and an indirect call through srq-\u003eevent on freed/reallocated memory, giving a control-flow-hijack / arbitrary-write primitive typical of UAF.\nA:H - Triggering the bug reliably causes a kernel crash \u2014 NULL/garbage function-pointer dereference for the partially-initialized case and oops/panic for the use-after-free."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:04.829Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/654aeddbc6e0f6e56531985bb12328ab4230c6c1"
},
{
"url": "https://git.kernel.org/stable/c/2d8b30b496bc53e961ba7415fd629fc27813017c"
},
{
"url": "https://git.kernel.org/stable/c/f0dbd9355ce1e93808541260c7ffab7956df9233"
},
{
"url": "https://git.kernel.org/stable/c/1e2a44875b6afb4add1115f7f3351dcbeb6f273d"
},
{
"url": "https://git.kernel.org/stable/c/8b7833f3bce35cb0d01c1503781523c099c675f0"
},
{
"url": "https://git.kernel.org/stable/c/c9341307ea16b9395c2e4c9c94d8499d91fe31d0"
}
],
"title": "RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46181",
"datePublished": "2026-05-28T09:36:34.706Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-10-30T12:26:04.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72501 (GCVE-0-2026-72501)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Initialize dpi variable to zero
dpi is initialized only for BNXT_RE_ALLOC_WC_PAGE, but copied
for all the cases. So initialize the dpi to 0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/uapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "88baaa8ca3731b9d1184a0772ac44d5738d294e8",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "31ba386230e6093991b4800a59c42ed1766627df",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "b87cbd4d198ae377be4815d8102fa9dfefb91dcc",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "3d00b375853fbbf4157ad092884b4ed9a49429c1",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
},
{
"lessThan": "978b27d6ce538bb832ccd69e45802824e4301c4b",
"status": "affected",
"version": "360da60d6c6edb9740de7a8e6d8969d62ceff956",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/uapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Initialize dpi variable to zero\n\ndpi is initialized only for BNXT_RE_ALLOC_WC_PAGE, but copied\nfor all the cases. So initialize the dpi to 0."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:08.545Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/88baaa8ca3731b9d1184a0772ac44d5738d294e8"
},
{
"url": "https://git.kernel.org/stable/c/31ba386230e6093991b4800a59c42ed1766627df"
},
{
"url": "https://git.kernel.org/stable/c/b87cbd4d198ae377be4815d8102fa9dfefb91dcc"
},
{
"url": "https://git.kernel.org/stable/c/3d00b375853fbbf4157ad092884b4ed9a49429c1"
},
{
"url": "https://git.kernel.org/stable/c/978b27d6ce538bb832ccd69e45802824e4301c4b"
}
],
"title": "RDMA/bnxt_re: Initialize dpi variable to zero",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72501",
"datePublished": "2026-08-15T05:57:32.990Z",
"dateReserved": "2026-08-09T03:40:39.938Z",
"dateUpdated": "2026-10-21T12:45:08.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43465 (GCVE-0-2026-43465)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The
referenced commit in the fixes tag corrected the assumption in the mlx5
driver that the XDP buffer layout doesn't change during a program
execution. However, this fix introduced another issue: the dropped
fragments still need to be counted on the driver side to avoid page
fragment reference counting issues.
The issue was discovered by the drivers/net/xdp.py selftest,
more specifically the test_xdp_native_tx_mb:
- The mlx5 driver allocates a page_pool page and initializes it with
a frag counter of 64 (pp_ref_count=64) and the internal frag counter
to 0.
- The test sends one packet with no payload.
- On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP
buffer with the packet data starting in the first fragment which is the
page mentioned above.
- The XDP program runs and calls bpf_xdp_pull_data() which moves the
header into the linear part of the XDP buffer. As the packet doesn't
contain more data, the program drops the tail fragment since it no
longer contains any payload (pp_ref_count=63).
- mlx5 device skips counting this fragment. Internal frag counter
remains 0.
- mlx5 releases all 64 fragments of the page but page pp_ref_count is
63 => negative reference counting error.
Resulting splat during the test:
WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]
Modules linked in: [...]
CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]
[...]
Call Trace:
<TASK>
mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core]
mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core]
mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core]
mlx5e_close_rq+0x78/0xa0 [mlx5_core]
mlx5e_close_queues+0x46/0x2a0 [mlx5_core]
mlx5e_close_channel+0x24/0x90 [mlx5_core]
mlx5e_close_channels+0x5d/0xf0 [mlx5_core]
mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core]
mlx5e_change_mtu+0x11d/0x490 [mlx5_core]
mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core]
netif_set_mtu_ext+0xfc/0x240
do_setlink.isra.0+0x226/0x1100
rtnl_newlink+0x7a9/0xba0
rtnetlink_rcv_msg+0x220/0x3c0
netlink_rcv_skb+0x4b/0xf0
netlink_unicast+0x255/0x380
netlink_sendmsg+0x1f3/0x420
__sock_sendmsg+0x38/0x60
____sys_sendmsg+0x1e8/0x240
___sys_sendmsg+0x7c/0xb0
[...]
__sys_sendmsg+0x5f/0xb0
do_syscall_64+0x55/0xc70
The problem applies for XDP_PASS as well which is handled in a different
code path in the driver.
This patch fixes the issue by doing page frag counting on all the
original XDP buffer fragments for all relevant XDP actions (XDP_TX ,
XDP_REDIRECT and XDP_PASS). This is basically reverting to the original
counting before the commit in the fixes tag.
As frag_page is still pointing to the original tail, the nr_frags
parameter to xdp_update_skb_frags_info() needs to be calculated
in a different way to reflect the new nr_frags.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b051d7f530e8a5237da242fbeafef02fec6b813 Version: cb9edd583e23979ee546981be963ad5f217e8b18 Version: 87bcef158ac1faca1bd7e0104588e8e2956d10be Version: 87bcef158ac1faca1bd7e0104588e8e2956d10be Version: 87bcef158ac1faca1bd7e0104588e8e2956d10be Version: f2557d7fa38e9475b38588f5c124476091480f53 Version: 6.6.115 ≤ Version: 6.12.56 ≤ Version: 6.17.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6451ea47d60a8ca3524dfe370c013cd01063c7d3",
"status": "affected",
"version": "8b051d7f530e8a5237da242fbeafef02fec6b813",
"versionType": "git"
},
{
"lessThan": "f0a850677a7b7589208ce11480e6958f516c8386",
"status": "affected",
"version": "cb9edd583e23979ee546981be963ad5f217e8b18",
"versionType": "git"
},
{
"lessThan": "7d7342a18fadcdb70a63b3c930dc63528ce51832",
"status": "affected",
"version": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"versionType": "git"
},
{
"lessThan": "043bd62f748bc9fd98154037aa598cffbd3c667c",
"status": "affected",
"version": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"versionType": "git"
},
{
"lessThan": "db25c42c2e1f9c0d136420fff5e5700f7e771a6f",
"status": "affected",
"version": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"versionType": "git"
},
{
"status": "affected",
"version": "f2557d7fa38e9475b38588f5c124476091480f53",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ\n\nXDP multi-buf programs can modify the layout of the XDP buffer when the\nprogram calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The\nreferenced commit in the fixes tag corrected the assumption in the mlx5\ndriver that the XDP buffer layout doesn\u0027t change during a program\nexecution. However, this fix introduced another issue: the dropped\nfragments still need to be counted on the driver side to avoid page\nfragment reference counting issues.\n\nThe issue was discovered by the drivers/net/xdp.py selftest,\nmore specifically the test_xdp_native_tx_mb:\n- The mlx5 driver allocates a page_pool page and initializes it with\n a frag counter of 64 (pp_ref_count=64) and the internal frag counter\n to 0.\n- The test sends one packet with no payload.\n- On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP\n buffer with the packet data starting in the first fragment which is the\n page mentioned above.\n- The XDP program runs and calls bpf_xdp_pull_data() which moves the\n header into the linear part of the XDP buffer. As the packet doesn\u0027t\n contain more data, the program drops the tail fragment since it no\n longer contains any payload (pp_ref_count=63).\n- mlx5 device skips counting this fragment. Internal frag counter\n remains 0.\n- mlx5 releases all 64 fragments of the page but page pp_ref_count is\n 63 =\u003e negative reference counting error.\n\nResulting splat during the test:\n\n WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]\n Modules linked in: [...]\n CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]\n [...]\n Call Trace:\n \u003cTASK\u003e\n mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core]\n mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core]\n mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core]\n mlx5e_close_rq+0x78/0xa0 [mlx5_core]\n mlx5e_close_queues+0x46/0x2a0 [mlx5_core]\n mlx5e_close_channel+0x24/0x90 [mlx5_core]\n mlx5e_close_channels+0x5d/0xf0 [mlx5_core]\n mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core]\n mlx5e_change_mtu+0x11d/0x490 [mlx5_core]\n mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core]\n netif_set_mtu_ext+0xfc/0x240\n do_setlink.isra.0+0x226/0x1100\n rtnl_newlink+0x7a9/0xba0\n rtnetlink_rcv_msg+0x220/0x3c0\n netlink_rcv_skb+0x4b/0xf0\n netlink_unicast+0x255/0x380\n netlink_sendmsg+0x1f3/0x420\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x1e8/0x240\n ___sys_sendmsg+0x7c/0xb0\n [...]\n __sys_sendmsg+0x5f/0xb0\n do_syscall_64+0x55/0xc70\n\nThe problem applies for XDP_PASS as well which is handled in a different\ncode path in the driver.\n\nThis patch fixes the issue by doing page frag counting on all the\noriginal XDP buffer fragments for all relevant XDP actions (XDP_TX ,\nXDP_REDIRECT and XDP_PASS). This is basically reverting to the original\ncounting before the commit in the fixes tag.\n\nAs frag_page is still pointing to the original tail, the nr_frags\nparameter to xdp_update_skb_frags_info() needs to be calculated\nin a different way to reflect the new nr_frags."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable mlx5e RX path is reached by received packets on an affected Mellanox interface in a deployment running an XDP multi-buffer program. A remote peer can trigger the fragment-accounting path by sending packets processed by that XDP program.\nAC:L - Once the affected striding RQ and XDP multi-buffer program are in use, triggering only requires packets that cause bpf_xdp_pull_data() or bpf_xdp_adjust_tail() to drop fragments. There is no race or probabilistic condition in the vulnerable path.\nPR:N - The attacker does not need privileges to send the triggering network traffic to a configured affected interface. Loading the XDP program is an environmental precondition for the vulnerable deployment, not an action required from the attacker.\nUI:N - No victim user action is required after the affected interface and XDP program are configured. Packet reception drives the vulnerable path automatically in NAPI RX processing.\nS:U - The impact remains within the same kernel and host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug corrupts page-pool fragment lifetime accounting, which can leave pages recycled or referenced incorrectly while packet buffers still point to them. Under the required higher-severity assumption, this memory lifetime corruption can expose kernel or packet memory.\nI:H - Incorrect page-pool reference accounting can cause stale or prematurely recycled packet pages to be reused while still referenced, creating a kernel memory corruption condition. Such lifetime corruption is defensibly treated as high integrity impact.\nA:H - The observed failure is a page_pool refcount underflow warning, and repeated triggering can corrupt RX page accounting, exhaust resources, or panic systems configured with panic_on_warn. This provides high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:50.278Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6451ea47d60a8ca3524dfe370c013cd01063c7d3"
},
{
"url": "https://git.kernel.org/stable/c/f0a850677a7b7589208ce11480e6958f516c8386"
},
{
"url": "https://git.kernel.org/stable/c/7d7342a18fadcdb70a63b3c930dc63528ce51832"
},
{
"url": "https://git.kernel.org/stable/c/043bd62f748bc9fd98154037aa598cffbd3c667c"
},
{
"url": "https://git.kernel.org/stable/c/db25c42c2e1f9c0d136420fff5e5700f7e771a6f"
}
],
"title": "net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43465",
"datePublished": "2026-05-08T14:22:26.822Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-10-21T12:40:50.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53401 (GCVE-0-2026-53401)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: omap2: fix use-after-free in omapfb_mmap
omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that
can lead to use-after-free:
The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),
while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.
This allows concurrent execution.
In omapfb_mmap():
1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref
2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region
3. len = fix->smem_len; // Read from NEW region
4. vm_iomap_memory(vma, start, len); // Map NEW region memory
5. atomic_inc(&rg->map_count); // Increment OLD region!
Concurrently, OMAPFB_SETUP_PLANE can:
- Reassign ofbi->region = new_rg
- Update fix->smem_len
- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it
This leaves userspace with a mapping to freed physical memory.
The fix is to read all required values (start, len) from the same
region reference (rg) that will have its map_count incremented,
preventing the region from being freed while still mapped.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 078ff546a806b2c2ab74c25c8edd4c6d4680656a Version: 078ff546a806b2c2ab74c25c8edd4c6d4680656a Version: 078ff546a806b2c2ab74c25c8edd4c6d4680656a Version: 078ff546a806b2c2ab74c25c8edd4c6d4680656a Version: 078ff546a806b2c2ab74c25c8edd4c6d4680656a Version: 078ff546a806b2c2ab74c25c8edd4c6d4680656a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/omap2/omapfb/omapfb-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1a00f664a409b3412f9e1408c12890cffe50362",
"status": "affected",
"version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
"versionType": "git"
},
{
"lessThan": "5e10b1747547c3815e90d28166e92144835e065f",
"status": "affected",
"version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
"versionType": "git"
},
{
"lessThan": "986d5fafb73b8b866651399934b66d690f49135a",
"status": "affected",
"version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
"versionType": "git"
},
{
"lessThan": "8363c219d88e78daaee5665117a0380442989338",
"status": "affected",
"version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
"versionType": "git"
},
{
"lessThan": "6eb6ebcc8590007ad59ddccc8b5f9201655b33f8",
"status": "affected",
"version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
"versionType": "git"
},
{
"lessThan": "7958e67375aa111522086286bba13cfc0816ce8d",
"status": "affected",
"version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/omap2/omapfb/omapfb-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap2: fix use-after-free in omapfb_mmap\n\nomapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that\ncan lead to use-after-free:\n\nThe fb_mmap() entry point holds mm_lock but not lock (fb_info-\u003elock),\nwhile ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.\nThis allows concurrent execution.\n\nIn omapfb_mmap():\n1. rg = omapfb_get_mem_region(ofbi-\u003eregion); // Get old region ref\n2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region\n3. len = fix-\u003esmem_len; // Read from NEW region\n4. vm_iomap_memory(vma, start, len); // Map NEW region memory\n5. atomic_inc(\u0026rg-\u003emap_count); // Increment OLD region!\n\nConcurrently, OMAPFB_SETUP_PLANE can:\n- Reassign ofbi-\u003eregion = new_rg\n- Update fix-\u003esmem_len\n- OMAPFB_SETUP_MEM then checks NEW region\u0027s map_count (0!) and frees it\n\nThis leaves userspace with a mapping to freed physical memory.\n\nThe fix is to read all required values (start, len) from the same\nregion reference (rg) that will have its map_count incremented,\npreventing the region from being freed while still mapped."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (mmap and OMAPFB ioctls) against /dev/fb*; there is no network, adjacent-wireless, or physical-device insertion path to this driver code.\nAC:L - The attacker fully controls both sides of the race by opening /dev/fb and running concurrent mmap and OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctl threads, with no conditions outside attacker influence required for success.\nPR:L - Exploitation requires only the ability to open the framebuffer character device and issue its ioctls, which on OMAP embedded/kiosk deployments is typically granted to a local application user (video group or equivalent), not real root.\nUI:N - No victim interaction is required; the attacker triggers the race entirely through their own threads operating on a framebuffer device they can already open.\nS:U - Impact is confined to escalating within the same OS security boundary (userspace gaining read/write access to freed kernel/DMA physical memory), not a VM escape or cross-guest boundary crossing.\nC:H - The use-after-free leaves userspace mapped to freed physical pages that can be reallocated with sensitive kernel or DMA data, enabling arbitrary memory disclosure.\nI:H - The stale userspace mapping provides writable access to freed physical memory, enabling corruption of subsequently allocated kernel or DMA buffers and potential control-flow hijacking.\nA:H - Use-after-free of DMA framebuffer memory can cause kernel oopses or panics when freed pages are reused, and the UAF itself constitutes a high availability impact even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:07.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1a00f664a409b3412f9e1408c12890cffe50362"
},
{
"url": "https://git.kernel.org/stable/c/5e10b1747547c3815e90d28166e92144835e065f"
},
{
"url": "https://git.kernel.org/stable/c/986d5fafb73b8b866651399934b66d690f49135a"
},
{
"url": "https://git.kernel.org/stable/c/8363c219d88e78daaee5665117a0380442989338"
},
{
"url": "https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8"
},
{
"url": "https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d"
}
],
"title": "fbdev: omap2: fix use-after-free in omapfb_mmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53401",
"datePublished": "2026-07-19T12:02:01.209Z",
"dateReserved": "2026-06-09T07:44:35.403Z",
"dateUpdated": "2026-10-30T12:27:07.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23007 (GCVE-0-2026-23007)
Vulnerability from cvelistv5
Published
2026-01-25 14:36
Modified
2026-11-05 21:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: zero non-PI portion of auto integrity buffer
The auto-generated integrity buffer for writes needs to be fully
initialized before being passed to the underlying block device,
otherwise the uninitialized memory can be read back by userspace or
anyone with physical access to the storage device. If protection
information is generated, that portion of the integrity buffer is
already initialized. The integrity data is also zeroed if PI generation
is disabled via sysfs or the PI tuple size is 0. However, this misses
the case where PI is generated and the PI tuple size is nonzero, but the
metadata size is larger than the PI tuple. In this case, the remainder
("opaque") of the metadata is left uninitialized.
Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the
metadata is larger than just the PI tuple.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23007",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:18:24.643184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:15.079Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bio-integrity-auto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "765bf0a5880777c04ae98fc2a9f3b995737b3a64",
"status": "affected",
"version": "c546d6f438338017480d105ab597292da67f6f6a",
"versionType": "git"
},
{
"lessThan": "d6072557b90e0c557df319a56f4a9dc482706d2c",
"status": "affected",
"version": "c546d6f438338017480d105ab597292da67f6f6a",
"versionType": "git"
},
{
"lessThan": "ca22c566b89164f6e670af56ecc45f47ef3df819",
"status": "affected",
"version": "c546d6f438338017480d105ab597292da67f6f6a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bio-integrity-auto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.7",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: zero non-PI portion of auto integrity buffer\n\nThe auto-generated integrity buffer for writes needs to be fully\ninitialized before being passed to the underlying block device,\notherwise the uninitialized memory can be read back by userspace or\nanyone with physical access to the storage device. If protection\ninformation is generated, that portion of the integrity buffer is\nalready initialized. The integrity data is also zeroed if PI generation\nis disabled via sysfs or the PI tuple size is 0. However, this misses\nthe case where PI is generated and the PI tuple size is nonzero, but the\nmetadata size is larger than the PI tuple. In this case, the remainder\n(\"opaque\") of the metadata is left uninitialized.\nGeneralize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the\nmetadata is larger than just the PI tuple."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:50.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/765bf0a5880777c04ae98fc2a9f3b995737b3a64"
},
{
"url": "https://git.kernel.org/stable/c/d6072557b90e0c557df319a56f4a9dc482706d2c"
},
{
"url": "https://git.kernel.org/stable/c/ca22c566b89164f6e670af56ecc45f47ef3df819"
}
],
"title": "block: zero non-PI portion of auto integrity buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23007",
"datePublished": "2026-01-25T14:36:20.731Z",
"dateReserved": "2026-01-13T15:37:45.939Z",
"dateUpdated": "2026-11-05T21:23:15.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43083 (GCVE-0-2026-43083)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ioam6: fix OOB and missing lock
When trace->type.bit6 is set:
if (trace->type.bit6) {
...
queue = skb_get_tx_queue(dev, skb);
qdisc = rcu_dereference(queue->qdisc);
This code can lead to an out-of-bounds access of the dev->_tx[] array
when is_input is true. In such a case, the packet is on the RX path and
skb->queue_mapping contains the RX queue index of the ingress device. If
the ingress device has more RX queues than the egress device (dev) has
TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
Add a check to avoid this situation since skb_get_tx_queue() does not
clamp the index. This issue has also revealed that per queue visibility
cannot be accurate and will be replaced later as a new feature.
While at it, add missing lock around qdisc_qstats_qlen_backlog(). The
function __ioam6_fill_trace_data() is called from both softirq and
process contexts, hence the use of spin_lock_bh() here.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b63c5478e9cb1d1504eb02d9dac827ad24612b32 Version: b63c5478e9cb1d1504eb02d9dac827ad24612b32 Version: b63c5478e9cb1d1504eb02d9dac827ad24612b32 Version: b63c5478e9cb1d1504eb02d9dac827ad24612b32 Version: b63c5478e9cb1d1504eb02d9dac827ad24612b32 Version: b63c5478e9cb1d1504eb02d9dac827ad24612b32 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:14:26.779582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:13.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "a05a85779c2574b6534abb8cdc6d65fbc2e91208",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "f1af9d19503b73011dae5051c354fd39b03e240d",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "6d1d9ed9b409e0662241e3d245d574a18f643494",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "95a1334748c95dd15546056280ade0c4b8dd7b78",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "b30b1675aa2bcf0491fd3830b051df4e08a7c8ca",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ioam6: fix OOB and missing lock\n\nWhen trace-\u003etype.bit6 is set:\n\n if (trace-\u003etype.bit6) {\n ...\n queue = skb_get_tx_queue(dev, skb);\n qdisc = rcu_dereference(queue-\u003eqdisc);\n\nThis code can lead to an out-of-bounds access of the dev-\u003e_tx[] array\nwhen is_input is true. In such a case, the packet is on the RX path and\nskb-\u003equeue_mapping contains the RX queue index of the ingress device. If\nthe ingress device has more RX queues than the egress device (dev) has\nTX queues, skb_get_queue_mapping(skb) will exceed dev-\u003enum_tx_queues.\nAdd a check to avoid this situation since skb_get_tx_queue() does not\nclamp the index. This issue has also revealed that per queue visibility\ncannot be accurate and will be replaced later as a new feature.\n\nWhile at it, add missing lock around qdisc_qstats_qlen_backlog(). The\nfunction __ioam6_fill_trace_data() is called from both softirq and\nprocess contexts, hence the use of spin_lock_bh() here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable input path is reached by received IPv6 packets carrying a Hop-by-Hop IOAM Pre-allocated Trace option with queue-depth bit 6 set. In a reasonable IOAM-enabled routing deployment, an unauthenticated network peer can send such packets to the ingress interface.\nAC:L - The attacker controls the packet contents, including the IOAM trace type, and can repeatedly send packets; the RX-queue-to-TX-queue mismatch is a plausible target configuration rather than a race or condition the attacker must win. The OOB access occurs deterministically once the packet is processed with an out-of-range queue mapping.\nPR:N - Although enabling IOAM and creating namespaces are administrative configuration steps, the actual vulnerable code path processes unauthenticated network packets after IOAM is enabled. The packet sender needs no local account or kernel privileges.\nUI:N - No victim user action is required. Packet reception and IPv6 hop-by-hop IOAM processing trigger the vulnerable function automatically.\nS:U - The impact remains within the kernel/networking security authority of the affected system. This is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The bug is an out-of-bounds read of the egress device\u0027s `dev-\u003e_tx[]` array followed by dereferencing data as a `Qdisc`, and the resulting value can be copied into IOAM trace data. Under the required overestimation rule, this is treated as high confidentiality impact because it is not a strictly bounded, harmless read.\nI:N - The vulnerable operation reads an out-of-bounds queue entry and qdisc statistics; it does not provide an out-of-bounds write or an apparent primitive to modify kernel memory. Any packet trace update is part of normal processing of the attacker\u0027s packet.\nA:H - An out-of-bounds queue pointer dereference can fault or otherwise oops/panic the kernel, especially when the computed `Qdisc` pointer is invalid. The same crafted packet pattern can be sent repeatedly, making denial of service high impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:54.065Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d8fa972c543e6a41f9a0873a725fd1d8d4d9dbfc"
},
{
"url": "https://git.kernel.org/stable/c/a05a85779c2574b6534abb8cdc6d65fbc2e91208"
},
{
"url": "https://git.kernel.org/stable/c/f1af9d19503b73011dae5051c354fd39b03e240d"
},
{
"url": "https://git.kernel.org/stable/c/6d1d9ed9b409e0662241e3d245d574a18f643494"
},
{
"url": "https://git.kernel.org/stable/c/95a1334748c95dd15546056280ade0c4b8dd7b78"
},
{
"url": "https://git.kernel.org/stable/c/b30b1675aa2bcf0491fd3830b051df4e08a7c8ca"
}
],
"title": "net: ioam6: fix OOB and missing lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43083",
"datePublished": "2026-05-06T07:40:18.504Z",
"dateReserved": "2026-05-01T14:12:55.983Z",
"dateUpdated": "2026-10-30T12:24:54.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90174 (GCVE-0-2026-90174)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC
login response with
user->passkey_sz = resp->hash_sz;
user->passkey = kmalloc(resp->hash_sz, KSMBD_DEFAULT_GFP);
if (user->passkey)
memcpy(user->passkey, resp->hash, resp->hash_sz);
resp->hash_sz is a __u16 supplied by the response, but resp->hash[] is
only KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login
response can set hash_sz well beyond that (up to 65535), so the memcpy()
reads past the end of the response object. ipc_validate_msg() does not
bound hash_sz, so reject any response whose hash_sz exceeds the on-stack
hash[] buffer before allocating and copying.
[ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278/0x680
[ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611
[ 2030.242296]
[ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy)
[ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 2030.242743] Workqueue: ksmbd-io handle_ksmbd_work
[ 2030.242763] Call Trace:
[ 2030.242769] <TASK>
[ 2030.242776] dump_stack_lvl+0xa2/0xd0
[ 2030.242794] print_address_description+0x77/0x200
[ 2030.242815] ? ksmbd_alloc_user+0x278/0x680
[ 2030.242831] print_report+0x58/0x70
[ 2030.242848] kasan_report+0x117/0x150
[ 2030.242869] ? ksmbd_alloc_user+0x278/0x680
[ 2030.242888] kasan_check_range+0x3c7/0x3f0
[ 2030.242908] ? ksmbd_alloc_user+0x278/0x680
[ 2030.242925] __asan_memcpy+0x29/0x70
[ 2030.242942] ksmbd_alloc_user+0x278/0x680
[ 2030.242960] ksmbd_login_user+0xc3/0x120
[ 2030.242978] ntlm_authenticate+0x5e6/0x1b00
[ 2030.243017] ? __pfx_ntlm_authenticate+0x10/0x10
[ 2030.243035] ? ksmbd_session_lookup+0x188/0x1d0
[ 2030.243054] ? __pfx_ksmbd_session_lookup+0x10/0x10
[ 2030.243090] ? __sanitizer_cov_trace_switch+0x7b/0x140
[ 2030.243108] smb2_sess_setup+0x1e4a/0x27b0
[ 2030.243126] ? copy_from_kernel_nofault+0x199/0x300
[ 2030.243156] ? __pfx_smb2_sess_setup+0x10/0x10
[ 2030.243173] ? get_smb2_cmd_val+0xe3/0x1c0
[ 2030.243208] handle_ksmbd_work+0x954/0x1280
[ 2030.243230] ? __pfx_handle_ksmbd_work+0x10/0x10
[ 2030.243249] ? process_scheduled_works+0xa07/0x1490
[ 2030.243270] ? process_scheduled_works+0xa07/0x1490
[ 2030.243291] process_scheduled_works+0xa70/0x1490
[ 2030.243320] ? __pfx_process_scheduled_works+0x10/0x10
[ 2030.243340] ? do_raw_spin_lock+0x130/0x300
[ 2030.243358] ? lock_is_held_type+0x7b/0x110
[ 2030.243388] worker_thread+0x932/0xe20
[ 2030.243415] kthread+0x38a/0x470
[ 2030.243431] ? __pfx_worker_thread+0x10/0x10
[ 2030.243451] ? __pfx_kthread+0x10/0x10
[ 2030.243467] ret_from_fork+0x484/0x910
[ 2030.243485] ? __pfx_ret_from_fork+0x10/0x10
[ 2030.243501] ? __switch_to+0xc77/0x12c0
[ 2030.243523] ? __pfx_kthread+0x10/0x10
[ 2030.243540] ret_from_fork_asm+0x1a/0x30
[ 2030.243564] </TASK>
[ 2030.243570]
[ 2030.290164] Allocated by task 19279:
[ 2030.290911] kasan_save_track+0x3e/0x80
[ 2030.292179] __kasan_kmalloc+0x72/0x90
[ 2030.293217] __kvmalloc_node_noprof+0x3ff/0x6b0
[ 2030.294467] handle_generic_event+0x59b/0x750
[ 2030.295345] genl_family_rcv_msg_doit+0x238/0x340
[ 2030.296553] genl_rcv_msg+0x606/0x7b0
[ 2030.297129] netlink_rcv_skb+0x22b/0x4a0
[ 2030.298500] genl_rcv+0x2d/0x40
[ 2030.299273] netlink_unicast+0x7ba/0x930
[ 2030.300019] netlink_sendmsg+0x8c3/0xb00
[ 2030.301073] __sock_sendmsg+0xec/0x140
[ 2030.301579] __sys_sendto+0x357/0x470
[ 2030.302255] __x64_sys_sendto+0xe3/0x100
[ 2030.303425] do_syscall_64+0x135/0x460
[ 2030.304763] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 2030.305594]
[ 2030.305819] The buggy address belongs to the object at ffff888121bb6640
[ 2030.305819] which belongs to the cache kmalloc-192 of size 192
[ 2030.309595] The buggy address
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_config.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "792dd35013427995e742c7928ef5b564434a4321",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "67223b1150a9edea52350d8cd085ea9081beaa45",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "863f74ad158fef2987b9146f29d4b3149bb95953",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "272c05a51285fe3495ab2f7eb77a48ad831b929f",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "497c221bf6b2f659511719a6acfae84cc1be1caf",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "7405d0ba294306721843bc551611775e6edef516",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/user_config.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()\n\nksmbd_alloc_user() copies resp-\u003ehash_sz bytes out of the mountd IPC\nlogin response with\n\n\tuser-\u003epasskey_sz = resp-\u003ehash_sz;\n\tuser-\u003epasskey = kmalloc(resp-\u003ehash_sz, KSMBD_DEFAULT_GFP);\n\tif (user-\u003epasskey)\n\t\tmemcpy(user-\u003epasskey, resp-\u003ehash, resp-\u003ehash_sz);\n\nresp-\u003ehash_sz is a __u16 supplied by the response, but resp-\u003ehash[] is\nonly KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login\nresponse can set hash_sz well beyond that (up to 65535), so the memcpy()\nreads past the end of the response object. ipc_validate_msg() does not\nbound hash_sz, so reject any response whose hash_sz exceeds the on-stack\nhash[] buffer before allocating and copying.\n\n[ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278/0x680\n[ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611\n[ 2030.242296]\n[ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy)\n[ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n[ 2030.242743] Workqueue: ksmbd-io handle_ksmbd_work\n[ 2030.242763] Call Trace:\n[ 2030.242769] \u003cTASK\u003e\n[ 2030.242776] dump_stack_lvl+0xa2/0xd0\n[ 2030.242794] print_address_description+0x77/0x200\n[ 2030.242815] ? ksmbd_alloc_user+0x278/0x680\n[ 2030.242831] print_report+0x58/0x70\n[ 2030.242848] kasan_report+0x117/0x150\n[ 2030.242869] ? ksmbd_alloc_user+0x278/0x680\n[ 2030.242888] kasan_check_range+0x3c7/0x3f0\n[ 2030.242908] ? ksmbd_alloc_user+0x278/0x680\n[ 2030.242925] __asan_memcpy+0x29/0x70\n[ 2030.242942] ksmbd_alloc_user+0x278/0x680\n[ 2030.242960] ksmbd_login_user+0xc3/0x120\n[ 2030.242978] ntlm_authenticate+0x5e6/0x1b00\n[ 2030.243017] ? __pfx_ntlm_authenticate+0x10/0x10\n[ 2030.243035] ? ksmbd_session_lookup+0x188/0x1d0\n[ 2030.243054] ? __pfx_ksmbd_session_lookup+0x10/0x10\n[ 2030.243090] ? __sanitizer_cov_trace_switch+0x7b/0x140\n[ 2030.243108] smb2_sess_setup+0x1e4a/0x27b0\n[ 2030.243126] ? copy_from_kernel_nofault+0x199/0x300\n[ 2030.243156] ? __pfx_smb2_sess_setup+0x10/0x10\n[ 2030.243173] ? get_smb2_cmd_val+0xe3/0x1c0\n[ 2030.243208] handle_ksmbd_work+0x954/0x1280\n[ 2030.243230] ? __pfx_handle_ksmbd_work+0x10/0x10\n[ 2030.243249] ? process_scheduled_works+0xa07/0x1490\n[ 2030.243270] ? process_scheduled_works+0xa07/0x1490\n[ 2030.243291] process_scheduled_works+0xa70/0x1490\n[ 2030.243320] ? __pfx_process_scheduled_works+0x10/0x10\n[ 2030.243340] ? do_raw_spin_lock+0x130/0x300\n[ 2030.243358] ? lock_is_held_type+0x7b/0x110\n[ 2030.243388] worker_thread+0x932/0xe20\n[ 2030.243415] kthread+0x38a/0x470\n[ 2030.243431] ? __pfx_worker_thread+0x10/0x10\n[ 2030.243451] ? __pfx_kthread+0x10/0x10\n[ 2030.243467] ret_from_fork+0x484/0x910\n[ 2030.243485] ? __pfx_ret_from_fork+0x10/0x10\n[ 2030.243501] ? __switch_to+0xc77/0x12c0\n[ 2030.243523] ? __pfx_kthread+0x10/0x10\n[ 2030.243540] ret_from_fork_asm+0x1a/0x30\n[ 2030.243564] \u003c/TASK\u003e\n[ 2030.243570]\n[ 2030.290164] Allocated by task 19279:\n[ 2030.290911] kasan_save_track+0x3e/0x80\n[ 2030.292179] __kasan_kmalloc+0x72/0x90\n[ 2030.293217] __kvmalloc_node_noprof+0x3ff/0x6b0\n[ 2030.294467] handle_generic_event+0x59b/0x750\n[ 2030.295345] genl_family_rcv_msg_doit+0x238/0x340\n[ 2030.296553] genl_rcv_msg+0x606/0x7b0\n[ 2030.297129] netlink_rcv_skb+0x22b/0x4a0\n[ 2030.298500] genl_rcv+0x2d/0x40\n[ 2030.299273] netlink_unicast+0x7ba/0x930\n[ 2030.300019] netlink_sendmsg+0x8c3/0xb00\n[ 2030.301073] __sock_sendmsg+0xec/0x140\n[ 2030.301579] __sys_sendto+0x357/0x470\n[ 2030.302255] __x64_sys_sendto+0xe3/0x100\n[ 2030.303425] do_syscall_64+0x135/0x460\n[ 2030.304763] entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[ 2030.305594]\n[ 2030.305819] The buggy address belongs to the object at ffff888121bb6640\n[ 2030.305819] which belongs to the cache kmalloc-192 of size 192\n[ 2030.309595] The buggy address \n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - ksmbd_alloc_user() memcpy()s resp-\u003ehash_sz bytes from resp-\u003ehash, and that __u16 is a field of the KSMBD_EVENT_LOGIN_RESPONSE copied in handle_generic_event() from a local SMBD_GENL netlink message. SMB2 SESSION_SETUP (smb2_sess_setup \u2192 ntlm_authenticate \u2192 ksmbd_login_user) only supplies the account name that queues ksmbd_ipc_login_request(); it does not carry hash_sz.\nAC:L - The sender sets hash_sz to any __u16 (up to 65535) in a sizeof(ksmbd_login_response) LOGIN_RESPONSE; ipc_validate_msg() has no KSMBD_EVENT_LOGIN_REQUEST case so it never bounds hash_sz. A matching ipc_ida handle is obtained by sending SESSION_SETUP and answering within the 2s IPC wait, with no uncontrolled race.\nPR:L - handle_generic_event() for KSMBD_EVENT_LOGIN_RESPONSE checks netlink_capable(CAP_NET_ADMIN) only when CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN is set; ksmbd_genl_family is netnsok, the ops lack GENL_ADMIN_PERM, and LOGIN_RESPONSE is not bound to ksmbd_tools_pid. CAP_NET_ADMIN is Low, and builds that disable the check let any local user send it.\nUI:N - The attacker can connect to the local ksmbd TCP listener, send SMB2 SESSION_SETUP so ksmbd_ipc_login_request() waits on the handle, and inject the crafted LOGIN_RESPONSE themselves. No other user must log in or otherwise act once ksmbd is running.\nS:U - The slab over-read in ksmbd_alloc_user() and any oops of the ksmbd-io worker stay inside the host kernel that runs the SMB server. This is not a VM escape, IOMMU/DMA bypass, or other cross-authority impact.\nC:H - memcpy(user-\u003epasskey, resp-\u003ehash, resp-\u003ehash_sz) copies up to 65535 bytes from the 18-byte hash[] (KSMBD_REQ_MAX_HASH_SZ) of a packed ksmbd_login_response into kmalloc(hash_sz), which is an unbounded kernel-heap over-read rather than a few bounded bytes.\nI:N - kmalloc(resp-\u003ehash_sz) sizes the destination to the copy length, so the memcpy is a slab-out-of-bounds read with no OOB write. The LOGIN_RESPONSE sender already supplies uid/gid/account/status without this bug, and NTLM (calc_ntlmv2_hash) only consumes CIFS_ENCPWD_SIZE of passkey.\nA:H - A 65535-byte read from a kmalloc-192 LOGIN_RESPONSE object walks off the slab into unmapped memory and oopses the ksmbd-io worker, matching the KASAN report in ksmbd_alloc_user(). The attacker can repeat SESSION_SETUP plus a crafted LOGIN_RESPONSE to crash the kernel at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:36.698Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/792dd35013427995e742c7928ef5b564434a4321"
},
{
"url": "https://git.kernel.org/stable/c/67223b1150a9edea52350d8cd085ea9081beaa45"
},
{
"url": "https://git.kernel.org/stable/c/863f74ad158fef2987b9146f29d4b3149bb95953"
},
{
"url": "https://git.kernel.org/stable/c/272c05a51285fe3495ab2f7eb77a48ad831b929f"
},
{
"url": "https://git.kernel.org/stable/c/497c221bf6b2f659511719a6acfae84cc1be1caf"
},
{
"url": "https://git.kernel.org/stable/c/7405d0ba294306721843bc551611775e6edef516"
}
],
"title": "ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90174",
"datePublished": "2026-09-17T16:07:01.106Z",
"dateReserved": "2026-09-11T19:38:34.791Z",
"dateUpdated": "2026-10-30T12:34:36.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39958 (GCVE-0-2025-39958)
Vulnerability from cvelistv5
Published
2025-10-09 09:47
Modified
2026-11-05 21:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Make attach succeed when the device was surprise removed
When a PCI device is removed with surprise hotplug, there may still be
attempts to attach the device to the default domain as part of tear down
via (__iommu_release_dma_ownership()), or because the removal happens
during probe (__iommu_probe_device()). In both cases zpci_register_ioat()
fails with a cc value indicating that the device handle is invalid. This
is because the device is no longer part of the instance as far as the
hypervisor is concerned.
Currently this leads to an error return and s390_iommu_attach_device()
fails. This triggers the WARN_ON() in __iommu_group_set_domain_nofail()
because attaching to the default domain must never fail.
With the device fenced by the hypervisor no DMAs to or from memory are
possible and the IOMMU translations have no effect. Proceed as if the
registration was successful and let the hotplug event handling clean up
the device.
This is similar to how devices in the error state are handled since
commit 59bbf596791b ("iommu/s390: Make attach succeed even if the device
is in error state") except that for removal the domain will not be
registered later. This approach was also previously discussed at the
link.
Handle both cases, error state and removal, in a helper which checks if
the error needs to be propagated or ignored. Avoid magic number
condition codes by using the pre-existing, but never used, defines for
PCI load/store condition codes and rename them to reflect that they
apply to all PCI instructions.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39958",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:13:24.454203Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:07.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/include/asm/pci_insn.h",
"drivers/iommu/s390-iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b32cf6e279597d1b6477fb89d46abf65263c139",
"status": "affected",
"version": "59bbf596791b89c7f88fdcac29dfc39c1221d25d",
"versionType": "git"
},
{
"lessThan": "79fa3a19aa6114189b33e2ba1f393b0f635d7544",
"status": "affected",
"version": "59bbf596791b89c7f88fdcac29dfc39c1221d25d",
"versionType": "git"
},
{
"lessThan": "359613f2fa009587154511e4842e8ab9532edd15",
"status": "affected",
"version": "59bbf596791b89c7f88fdcac29dfc39c1221d25d",
"versionType": "git"
},
{
"lessThan": "9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73",
"status": "affected",
"version": "59bbf596791b89c7f88fdcac29dfc39c1221d25d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/include/asm/pci_insn.h",
"drivers/iommu/s390-iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Make attach succeed when the device was surprise removed\n\nWhen a PCI device is removed with surprise hotplug, there may still be\nattempts to attach the device to the default domain as part of tear down\nvia (__iommu_release_dma_ownership()), or because the removal happens\nduring probe (__iommu_probe_device()). In both cases zpci_register_ioat()\nfails with a cc value indicating that the device handle is invalid. This\nis because the device is no longer part of the instance as far as the\nhypervisor is concerned.\n\nCurrently this leads to an error return and s390_iommu_attach_device()\nfails. This triggers the WARN_ON() in __iommu_group_set_domain_nofail()\nbecause attaching to the default domain must never fail.\n\nWith the device fenced by the hypervisor no DMAs to or from memory are\npossible and the IOMMU translations have no effect. Proceed as if the\nregistration was successful and let the hotplug event handling clean up\nthe device.\n\nThis is similar to how devices in the error state are handled since\ncommit 59bbf596791b (\"iommu/s390: Make attach succeed even if the device\nis in error state\") except that for removal the domain will not be\nregistered later. This approach was also previously discussed at the\nlink.\n\nHandle both cases, error state and removal, in a helper which checks if\nthe error needs to be propagated or ignored. Avoid magic number\ncondition codes by using the pre-existing, but never used, defines for\nPCI load/store condition codes and rename them to reflect that they\napply to all PCI instructions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:40.041Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b32cf6e279597d1b6477fb89d46abf65263c139"
},
{
"url": "https://git.kernel.org/stable/c/79fa3a19aa6114189b33e2ba1f393b0f635d7544"
},
{
"url": "https://git.kernel.org/stable/c/359613f2fa009587154511e4842e8ab9532edd15"
},
{
"url": "https://git.kernel.org/stable/c/9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73"
}
],
"title": "iommu/s390: Make attach succeed when the device was surprise removed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39958",
"datePublished": "2025-10-09T09:47:35.601Z",
"dateReserved": "2025-04-16T07:20:57.149Z",
"dateUpdated": "2026-11-05T21:23:07.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46175 (GCVE-0-2026-46175)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix fsck inconsistency caused by FGGC of node block
During FGGC node block migration, fsck may incorrectly treat the
migrated node block as fsync-written data.
The reproduction scenario:
root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync
root@vm:/mnt/f2fs# rm -f 1
root@vm:/mnt/f2fs# sync
root@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP
SPO, "fsck --dry-run" find inode has already checkpointed but still
with DENT_BIT_SHIFT set
The root cause is that GC does not clear the dentry mark and fsync mark
during node block migration, leading fsck to misinterpret them as
user-issued fsync writes.
In BGGC mode, node block migration is handled by f2fs_sync_node_pages(),
which guarantees the dentry and fsync marks are cleared before writing.
This patch move the set/clear of the fsync|dentry marks into
__write_node_folio to make the logic clearer, and ensures the
fsync|dentry mark is cleared in FGGC.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f Version: da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f Version: da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f Version: da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f Version: da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f Version: da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b7a0bbb3444addddb139f42a74ab4492052fa27",
"status": "affected",
"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f",
"versionType": "git"
},
{
"lessThan": "d1820a5814eadb8e63ab6c7c8d04e28ce49836be",
"status": "affected",
"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f",
"versionType": "git"
},
{
"lessThan": "8ac93964658d0649337dcb3f6e38d77f8cdd86f3",
"status": "affected",
"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f",
"versionType": "git"
},
{
"lessThan": "8be551f538dc5b64183e27bd45a7a0795263f760",
"status": "affected",
"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f",
"versionType": "git"
},
{
"lessThan": "e7c6d30169b03307d27c4479563df79c08f3a746",
"status": "affected",
"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f",
"versionType": "git"
},
{
"lessThan": "c3e238bd1f56993f205ef83889d406dfeaf717a8",
"status": "affected",
"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix fsck inconsistency caused by FGGC of node block\n\nDuring FGGC node block migration, fsck may incorrectly treat the\nmigrated node block as fsync-written data.\n\nThe reproduction scenario:\nroot@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync\nroot@vm:/mnt/f2fs# rm -f 1\nroot@vm:/mnt/f2fs# sync\nroot@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP\n SPO, \"fsck --dry-run\" find inode has already checkpointed but still\n with DENT_BIT_SHIFT set\n\nThe root cause is that GC does not clear the dentry mark and fsync mark\nduring node block migration, leading fsck to misinterpret them as\nuser-issued fsync writes.\n\nIn BGGC mode, node block migration is handled by f2fs_sync_node_pages(),\nwhich guarantees the dentry and fsync marks are cleared before writing.\n\nThis patch move the set/clear of the fsync|dentry marks into\n__write_node_folio to make the logic clearer, and ensures the\nfsync|dentry mark is cleared in FGGC."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - f2fs is a local block-device filesystem (default on Android/embedded); the vulnerable FGGC path is reached only by a local actor writing to a mounted f2fs volume, not over any network.\nAC:L - The attacker fully sets up the trigger (write+fsync an inline inode, delete it, exhaust free space to force FGGC of its node block); the corrupt on-disk state then persists until the next checkpoint, and routine power cycles/reboots on the target devices reliably invoke the faulty recovery.\nPR:L - While the GC ioctls require CAP_SYS_ADMIN, automatic foreground GC (f2fs_balance_fs \u2192 f2fs_gc promoting to FG_GC on low free space) runs the exact vulnerable path for any unprivileged user with write access to the filesystem.\nUI:N - Roll-forward recovery runs automatically during the next mount after a crash; no victim action is needed beyond the normal, automatic crash-and-remount cycle.\nS:U - The corruption is confined to the f2fs on-disk structures and the kernel managing them; it does not cross into a different security authority.\nC:N - The bug corrupts filesystem-consistency metadata but provides no read primitive over kernel memory or otherwise-inaccessible data, so there is no information disclosure.\nI:H - The migrated node block is misinterpreted as fsynced data, causing incorrect roll-forward recovery that resurrects deleted/stale inode metadata and leaves the on-disk filesystem inconsistent (fsck-detected) \u2014 a serious integrity compromise of stored data.\nA:H - A bad recovery can return an error, aborting the mount and rendering the filesystem/data unavailable until offline fsck (e.g. /data mount failure), and with CONFIG_F2FS_CHECK_FS the recovery error path hits BUG_ON(), crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:03.732Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b7a0bbb3444addddb139f42a74ab4492052fa27"
},
{
"url": "https://git.kernel.org/stable/c/d1820a5814eadb8e63ab6c7c8d04e28ce49836be"
},
{
"url": "https://git.kernel.org/stable/c/8ac93964658d0649337dcb3f6e38d77f8cdd86f3"
},
{
"url": "https://git.kernel.org/stable/c/8be551f538dc5b64183e27bd45a7a0795263f760"
},
{
"url": "https://git.kernel.org/stable/c/e7c6d30169b03307d27c4479563df79c08f3a746"
},
{
"url": "https://git.kernel.org/stable/c/c3e238bd1f56993f205ef83889d406dfeaf717a8"
}
],
"title": "f2fs: fix fsck inconsistency caused by FGGC of node block",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46175",
"datePublished": "2026-05-28T09:36:29.522Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-10-30T12:26:03.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93116 (GCVE-0-2026-93116)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: fix resource leaks on probe failure
During driver initialization in asus_wmi_add(), various subsystems are
registered sequentially. However, the error path labels are out of order
relative to the registration sequence.
Specifically:
1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to
fail_custom_fan_curve. Because this label is placed below fail_sysfs,
it bypasses the cleanup calls for the input device and sysfs groups,
which were successfully registered before, leaking those resources.
2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.
Because fail_screenpad is placed below fail_backlight, it bypasses the
cleanup calls for backlight and rfkill, leaking those resources.
Fix these resource leaks by reordering the error path labels in
asus_wmi_add() to match the exact reverse order of the resource
allocations.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f Version: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f Version: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f Version: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f Version: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f Version: 0f0ac158d28ff78e75c334e869b1cb8e69372a1f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/asus-wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72d792c8053f238ae541fdaa90e609548509b65f",
"status": "affected",
"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f",
"versionType": "git"
},
{
"lessThan": "959ed35f8c8f07b8dd43c3f917a43ae2f77e4471",
"status": "affected",
"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f",
"versionType": "git"
},
{
"lessThan": "8d5999608da60db45949e5459f74f581cdaacd04",
"status": "affected",
"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f",
"versionType": "git"
},
{
"lessThan": "8410cd2690d463b60527d00ac8cffea2d5a041f6",
"status": "affected",
"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f",
"versionType": "git"
},
{
"lessThan": "3308b8c5f5a28403611a2f5a46f06aabe4f0c661",
"status": "affected",
"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f",
"versionType": "git"
},
{
"lessThan": "ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95",
"status": "affected",
"version": "0f0ac158d28ff78e75c334e869b1cb8e69372a1f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/asus-wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: asus-wmi: fix resource leaks on probe failure\n\nDuring driver initialization in asus_wmi_add(), various subsystems are\nregistered sequentially. However, the error path labels are out of order\nrelative to the registration sequence.\n\nSpecifically:\n1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to\n fail_custom_fan_curve. Because this label is placed below fail_sysfs,\n it bypasses the cleanup calls for the input device and sysfs groups,\n which were successfully registered before, leaking those resources.\n2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad.\n Because fail_screenpad is placed below fail_backlight, it bypasses the\n cleanup calls for backlight and rfkill, leaking those resources.\n\nFix these resource leaks by reordering the error path labels in\nasus_wmi_add() to match the exact reverse order of the resource\nallocations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The leak is created in asus_wmi_add() called from asus_wmi_probe() during asus_wmi_register_driver()\u0027s platform_create_bundle() for asus-nb-wmi/eeepc-wmi module init; leftover rfkill objects are later driven via /dev/rfkill (rfkill_fop_write), not by a network or radio protocol message.\nAC:H - The dangling asus_rfkill exists only when asus_screenpad_init() returns an error other than -ENODEV after asus_wmi_rfkill_init() has registered devices, which requires an ACPI WMI failure from asus_wmi_get_devstate()/asus_wmi_evaluate_method() or backlight_device_register() failure that the attacker cannot induce.\nPR:L - After fail_screenpad skips asus_wmi_rfkill_exit(), the leaked rfkill stays on rfkill_list; rfkill_fop_write() has no capable() check, so a local session user who can open /dev/rfkill (typical laptop rfkill group/uaccess) can send RFKILL_OP_CHANGE and reach asus_rfkill_set() without CAP_SYS_ADMIN.\nUI:N - The attacker themselves writes RFKILL_OP_CHANGE/CHANGE_ALL to /dev/rfkill targeting the leaked asus-wlan/asus-bluetooth rfkill idx; no other user must mount media, plug a device, or confirm a prompt.\nS:U - kfree(asus) on the asus_wmi_add() fail_screenpad path and the later asus_rfkill_query()/asus_rfkill_set() dereference of priv-\u003easus occur in the host kernel; this is not a KVM/Xen guest escape or IOMMU/DMA bypass.\nC:H - fail_screenpad jumps past asus_wmi_rfkill_exit() and then kfree(asus) while rfkill-\u003edata still points at the embedded struct asus_rfkill; rfkill_set_block() calls asus_rfkill_query(), which reads priv-\u003easus and priv-\u003edev_id from that freed object, a kernel UAF read.\nI:H - The same dangling rfkill-\u003edata is passed to asus_rfkill_set()/asus_rfkill_wlan_set(), which use priv-\u003easus-\u003edriver and mutex_lock(\u0026asus-\u003ewmi_lock); the leaked backlight_device also keeps bl_get_data()==asus for update_bl_status(), so reclaiming the freed asus_wmi object is a write/control-flow primitive.\nA:H - asus_rfkill_query() and asus_rfkill_set() dereference the kfree\u0027d struct asus_wmi, and asus_rfkill_wlan_set() takes asus-\u003ewmi_lock in freed memory, which oopses; fail_custom_fan_curve also skips asus_wmi_input_exit(), leaving a registered input_dev until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:01.447Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72d792c8053f238ae541fdaa90e609548509b65f"
},
{
"url": "https://git.kernel.org/stable/c/959ed35f8c8f07b8dd43c3f917a43ae2f77e4471"
},
{
"url": "https://git.kernel.org/stable/c/8d5999608da60db45949e5459f74f581cdaacd04"
},
{
"url": "https://git.kernel.org/stable/c/8410cd2690d463b60527d00ac8cffea2d5a041f6"
},
{
"url": "https://git.kernel.org/stable/c/3308b8c5f5a28403611a2f5a46f06aabe4f0c661"
},
{
"url": "https://git.kernel.org/stable/c/ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95"
}
],
"title": "platform/x86: asus-wmi: fix resource leaks on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93116",
"datePublished": "2026-09-17T16:11:23.852Z",
"dateReserved": "2026-09-17T16:02:15.086Z",
"dateUpdated": "2026-10-30T12:36:01.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31592 (GCVE-0-2026-31592)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
Take and hold kvm->lock for before checking sev_guest() in
sev_mem_enc_register_region(), as sev_guest() isn't stable unless kvm->lock
is held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can't
rollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to
a not-yet-initialized sev->regions_list, e.g. triggering a #GP
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 110 UID: 0 PID: 72717 Comm: syz.15.11462 Tainted: G U W O 6.16.0-smp-DEV #1 NONE
Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024
RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 ../include/linux/list.h:83
Code: <41> 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00
RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256
RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000
RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000
R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000
R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000
FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0
Call Trace:
<TASK>
kvm_arch_vm_ioctl+0xa72/0x1240 ../arch/x86/kvm/x86.c:7371
kvm_vm_ioctl+0x649/0x990 ../virt/kvm/kvm_main.c:5363
__se_sys_ioctl+0x101/0x170 ../fs/ioctl.c:51
do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x6f/0x1f0 ../arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f34e9f7e9a9
Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9
RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007
RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8
</TASK>
with a syzlang reproducer that looks like:
syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=ANY=[], 0x70}) (async)
syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="..."], 0x4f}) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_SET_CLOCK(r3, 0xc008aeba, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x5625e9b0}) (async)
ioctl$KVM_SET_PIT2(r3, 0x8010aebb, &(0x7f0000000280)={[...], 0x5}) (async)
ioctl$KVM_SET_PIT2(r1, 0x4070aea0, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) (async)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)
close(r0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async)
ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x1000]}) (async)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
Opportunistically use guard() to avoid having to define a new error label
and goto usage.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 Version: 1e80fdc09d121d8327cdf62eefbb5abadddca792 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:22:24.681502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:19.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c506405f438b3e739fa43d509d367d1946ad9ffe",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
},
{
"lessThan": "777a8ebd2da3529a455af022ed929408fdbb161f",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
},
{
"lessThan": "25c85d5831201391fb920d51067c6d93cce55348",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
},
{
"lessThan": "35a0963d361f98bba798fd15d229dcb166c04684",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
},
{
"lessThan": "ab725ac3022469ecd4d7aa7d5646712e98b249d8",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
},
{
"lessThan": "0ff93ff0ba82e9511770e175fa50682a1ab14fb6",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
},
{
"lessThan": "b6408b6cec5df76a165575777800ef2aba12b109",
"status": "affected",
"version": "1e80fdc09d121d8327cdf62eefbb5abadddca792",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock\n\nTake and hold kvm-\u003elock for before checking sev_guest() in\nsev_mem_enc_register_region(), as sev_guest() isn\u0027t stable unless kvm-\u003elock\nis held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can\u0027t\nrollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to\na not-yet-initialized sev-\u003eregions_list, e.g. triggering a #GP\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n CPU: 110 UID: 0 PID: 72717 Comm: syz.15.11462 Tainted: G U W O 6.16.0-smp-DEV #1 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 ../include/linux/list.h:83\n Code: \u003c41\u003e 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00\n RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256\n RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000\n RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000\n RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000\n R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000\n R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000\n FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0\n Call Trace:\n \u003cTASK\u003e\n kvm_arch_vm_ioctl+0xa72/0x1240 ../arch/x86/kvm/x86.c:7371\n kvm_vm_ioctl+0x649/0x990 ../virt/kvm/kvm_main.c:5363\n __se_sys_ioctl+0x101/0x170 ../fs/ioctl.c:51\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x6f/0x1f0 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f34e9f7e9a9\n Code: \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9\n RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007\n RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8\n \u003c/TASK\u003e\n\nwith a syzlang reproducer that looks like:\n\n syz_kvm_add_vcpu$x86(0x0, \u0026(0x7f0000000040)={0x0, \u0026(0x7f0000000180)=ANY=[], 0x70}) (async)\n syz_kvm_add_vcpu$x86(0x0, \u0026(0x7f0000000080)={0x0, \u0026(0x7f0000000180)=ANY=[@ANYBLOB=\"...\"], 0x4f}) (async)\n r0 = openat$kvm(0xffffffffffffff9c, \u0026(0x7f0000000200), 0x0, 0x0)\n r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)\n r2 = openat$kvm(0xffffffffffffff9c, \u0026(0x7f0000000240), 0x0, 0x0)\n r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)\n ioctl$KVM_SET_CLOCK(r3, 0xc008aeba, \u0026(0x7f0000000040)={0x1, 0x8, 0x0, 0x5625e9b0}) (async)\n ioctl$KVM_SET_PIT2(r3, 0x8010aebb, \u0026(0x7f0000000280)={[...], 0x5}) (async)\n ioctl$KVM_SET_PIT2(r1, 0x4070aea0, 0x0) (async)\n r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)\n openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)\n ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, \u0026(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, \u0026(0x7f0000001000/0x2000)=nil}) (async)\n r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)\n close(r0) (async)\n openat$kvm(0xffffffffffffff9c, \u0026(0x7f0000000000), 0x8000, 0x0) (async)\n ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, \u0026(0x7f0000000300)={0x4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x1000]}) (async)\n ioctl$KVM_RUN(r5, 0xae80, 0x0)\n\nOpportunistically use guard() to avoid having to define a new error label\nand goto usage."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:24.633Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c506405f438b3e739fa43d509d367d1946ad9ffe"
},
{
"url": "https://git.kernel.org/stable/c/777a8ebd2da3529a455af022ed929408fdbb161f"
},
{
"url": "https://git.kernel.org/stable/c/25c85d5831201391fb920d51067c6d93cce55348"
},
{
"url": "https://git.kernel.org/stable/c/35a0963d361f98bba798fd15d229dcb166c04684"
},
{
"url": "https://git.kernel.org/stable/c/ab725ac3022469ecd4d7aa7d5646712e98b249d8"
},
{
"url": "https://git.kernel.org/stable/c/0ff93ff0ba82e9511770e175fa50682a1ab14fb6"
},
{
"url": "https://git.kernel.org/stable/c/b6408b6cec5df76a165575777800ef2aba12b109"
}
],
"title": "KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31592",
"datePublished": "2026-04-24T14:42:18.921Z",
"dateReserved": "2026-03-09T15:48:24.121Z",
"dateUpdated": "2026-11-06T15:32:19.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99155 (GCVE-0-2026-99155)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
scsifront_do_response() validates the rqid in a backend response against
VSCSIIF_MAX_REQS before using it to index info->shadow[], but then
dereferences the entry to test ->inflight without checking that the slot
is populated. Shadow slots are NULL before a command is submitted (the
host private area is zeroed at allocation) and are reset to NULL in
_scsifront_put_rqid() once a request completes, so an in-range rqid that
does not correspond to an outstanding request makes the frontend
dereference a NULL pointer.
A malicious or buggy backend can thus crash the guest by returning a
response whose rqid is in range but not in flight -- for example a
spurious response before any command has been issued, or a duplicate of
one already completed. The ring has only VSCSIIF_MAX_REQS (16) slots,
so before the first command every in-range rqid selects a NULL slot.
Reject a response whose shadow slot is not populated.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 Version: 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 Version: 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 Version: 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 Version: 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 Version: 6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/xen-scsifront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "448b9a8b530b753d346dab10add09a502fc719a4",
"status": "affected",
"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43",
"versionType": "git"
},
{
"lessThan": "e397d4da76bed72db6ac4a0848fb6217f8394dca",
"status": "affected",
"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43",
"versionType": "git"
},
{
"lessThan": "90186a2354821329a27d92b266c0f05e8f4f637c",
"status": "affected",
"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43",
"versionType": "git"
},
{
"lessThan": "1d91ec793d6c80eca963d426e0da832d40a062df",
"status": "affected",
"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43",
"versionType": "git"
},
{
"lessThan": "15791e57f57f7050014d08cfe239d4aa1e6b94b0",
"status": "affected",
"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43",
"versionType": "git"
},
{
"lessThan": "8c8222c255772713eb36cde695777a1fce224917",
"status": "affected",
"version": "6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/xen-scsifront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info-\u003eshadow[], but then\ndereferences the entry to test -\u003einflight without checking that the slot\nis populated. Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed. The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:21.472Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/448b9a8b530b753d346dab10add09a502fc719a4"
},
{
"url": "https://git.kernel.org/stable/c/e397d4da76bed72db6ac4a0848fb6217f8394dca"
},
{
"url": "https://git.kernel.org/stable/c/90186a2354821329a27d92b266c0f05e8f4f637c"
},
{
"url": "https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df"
},
{
"url": "https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0"
},
{
"url": "https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"
}
],
"title": "scsi: xen/scsifront: Check for a NULL shadow entry on a backend response",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99155",
"datePublished": "2026-10-28T10:35:09.733Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-30T12:42:21.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68448 (GCVE-0-2026-68448)
Vulnerability from cvelistv5
Published
2026-08-12 00:51
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovl: check access to copy_file_range source with src mounter creds
Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices")
allowed filesystems that implement the copy_file_range() f_op to decide
if they want to access cross-sb copy from/to the same fs type.
The same commit added checks to verify same sb copy for filesystems that
implement ->copy_file_range() and do not support cross-sb copy at the
time, namely, to ceph, fuse and nfs.
The two remaining fs which implement ->copy_file_range(), cifs and
overlayfs started to support cross-sb copy from this time.
While overlayfs does support cross-sb copy when the two underlying files
are on the same base fs, the copy operation on the two real files from
two different overalyfs filesystems is performed with the mounter
creds of the destination overlayfs and the read permission access hook
for the source file was called with the wrong creds.
This could cause either deny of access to copy which would otherwise be
allowed (e.g. with splice) or allow read access to file which would
otherwise be denied.
Fix the latter case by explicitly verifying read access to source file
with the source overlayfs mounter creds.
The former case remains a quirk of cross-sb overlayfs copy, but
userspace could fall back to regular copy so no harm done.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5dae222a5ff0c269730393018a5539cc970a4726 Version: 5dae222a5ff0c269730393018a5539cc970a4726 Version: 5dae222a5ff0c269730393018a5539cc970a4726 Version: 5dae222a5ff0c269730393018a5539cc970a4726 Version: 5dae222a5ff0c269730393018a5539cc970a4726 Version: 5dae222a5ff0c269730393018a5539cc970a4726 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/overlayfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "214c292d135ac11d32c766c6c4276092b80b2fbd",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "7e13e5b087375f1aee1e930503d20efa7084c0fa",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "46c296aa678828105842eee29a147508d803d926",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "9ec22c8113d8cf72ed7197bb61037dcad09e50d8",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "1f4a107439d2e43db176e34919933e617cb7f2c5",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
},
{
"lessThan": "a1e0eb8f55cfe09bb31a202a388babc411292656",
"status": "affected",
"version": "5dae222a5ff0c269730393018a5539cc970a4726",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/overlayfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: check access to copy_file_range source with src mounter creds\n\nCommit 5dae222a5ff0c (\"vfs: allow copy_file_range to copy across devices\")\nallowed filesystems that implement the copy_file_range() f_op to decide\nif they want to access cross-sb copy from/to the same fs type.\n\nThe same commit added checks to verify same sb copy for filesystems that\nimplement -\u003ecopy_file_range() and do not support cross-sb copy at the\ntime, namely, to ceph, fuse and nfs.\n\nThe two remaining fs which implement -\u003ecopy_file_range(), cifs and\noverlayfs started to support cross-sb copy from this time.\n\nWhile overlayfs does support cross-sb copy when the two underlying files\nare on the same base fs, the copy operation on the two real files from\ntwo different overalyfs filesystems is performed with the mounter\ncreds of the destination overlayfs and the read permission access hook\nfor the source file was called with the wrong creds.\n\nThis could cause either deny of access to copy which would otherwise be\nallowed (e.g. with splice) or allow read access to file which would\notherwise be denied.\n\nFix the latter case by explicitly verifying read access to source file\nwith the source overlayfs mounter creds.\n\nThe former case remains a quirk of cross-sb overlayfs copy, but\nuserspace could fall back to regular copy so no harm done."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:39.471Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/214c292d135ac11d32c766c6c4276092b80b2fbd"
},
{
"url": "https://git.kernel.org/stable/c/7e13e5b087375f1aee1e930503d20efa7084c0fa"
},
{
"url": "https://git.kernel.org/stable/c/46c296aa678828105842eee29a147508d803d926"
},
{
"url": "https://git.kernel.org/stable/c/9ec22c8113d8cf72ed7197bb61037dcad09e50d8"
},
{
"url": "https://git.kernel.org/stable/c/1f4a107439d2e43db176e34919933e617cb7f2c5"
},
{
"url": "https://git.kernel.org/stable/c/a1e0eb8f55cfe09bb31a202a388babc411292656"
}
],
"title": "ovl: check access to copy_file_range source with src mounter creds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68448",
"datePublished": "2026-08-12T00:51:44.866Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-10-30T12:28:39.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64038 (GCVE-0-2026-64038)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm90) Stop work before releasing hwmon device
Sashiko reports:
In lm90_probe(), the devm action to cancel the alert_work and report_work
(lm90_restore_conf) is registered in lm90_init_client() before
devm_hwmon_device_register_with_info() is called.
Because devm executes cleanup actions in reverse order during module
unbind or probe failure, the hwmon device is unregistered and freed first.
If lm90_alert_work() or lm90_report_alarms() runs in the window between
the hwmon device being freed and the delayed works being cancelled,
lm90_update_alarms() will dereference the freed data->hwmon_dev here.
Fix the problem by canceling the workers separately after registering
the hwmon device and before registering the interrupt handler. This ensures
that the workers are canceled after interrupts are disabled and before
the hwmon device is released. Add "shutdown" flag to indicate that device
shutdown is in progress to prevent workers from being re-armed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6d0775119fb905fb02eafa98d575cf8ee792d46 Version: f6d0775119fb905fb02eafa98d575cf8ee792d46 Version: f6d0775119fb905fb02eafa98d575cf8ee792d46 Version: f6d0775119fb905fb02eafa98d575cf8ee792d46 Version: f6d0775119fb905fb02eafa98d575cf8ee792d46 Version: f6d0775119fb905fb02eafa98d575cf8ee792d46 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/lm90.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1decb2c1762f77910de787fbf9b3afb40cc1d646",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "1fe96176636cb17906680c098688b144bd9c1c45",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "5c116abf208dd97c4ceb76c5c50c9bc34a017796",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "c98107817b0f6cdf51adc5e84e75c39ee25d8b28",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "479e297526aeb19c745eac5c1897f455f83dc5f8",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
},
{
"lessThan": "b09a45601094c7f4ec4db8090b825fa61e169d93",
"status": "affected",
"version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/lm90.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Stop work before releasing hwmon device\n\nSashiko reports:\n\nIn lm90_probe(), the devm action to cancel the alert_work and report_work\n(lm90_restore_conf) is registered in lm90_init_client() before\ndevm_hwmon_device_register_with_info() is called.\n\nBecause devm executes cleanup actions in reverse order during module\nunbind or probe failure, the hwmon device is unregistered and freed first.\n\nIf lm90_alert_work() or lm90_report_alarms() runs in the window between\nthe hwmon device being freed and the delayed works being cancelled,\nlm90_update_alarms() will dereference the freed data-\u003ehwmon_dev here.\n\nFix the problem by canceling the workers separately after registering\nthe hwmon device and before registering the interrupt handler. This ensures\nthat the workers are canceled after interrupts are disabled and before\nthe hwmon device is released. Add \"shutdown\" flag to indicate that device\nshutdown is in progress to prevent workers from being re-armed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:31.998Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1decb2c1762f77910de787fbf9b3afb40cc1d646"
},
{
"url": "https://git.kernel.org/stable/c/1fe96176636cb17906680c098688b144bd9c1c45"
},
{
"url": "https://git.kernel.org/stable/c/5c116abf208dd97c4ceb76c5c50c9bc34a017796"
},
{
"url": "https://git.kernel.org/stable/c/c98107817b0f6cdf51adc5e84e75c39ee25d8b28"
},
{
"url": "https://git.kernel.org/stable/c/479e297526aeb19c745eac5c1897f455f83dc5f8"
},
{
"url": "https://git.kernel.org/stable/c/b09a45601094c7f4ec4db8090b825fa61e169d93"
}
],
"title": "hwmon: (lm90) Stop work before releasing hwmon device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64038",
"datePublished": "2026-07-19T15:39:26.071Z",
"dateReserved": "2026-07-19T07:54:57.028Z",
"dateUpdated": "2026-10-30T12:27:31.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80614 (GCVE-0-2026-80614)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: emac: Fix NULL pointer dereference in emac_probe
Move devm_request_irq() after devm_platform_ioremap_resource() so that
dev->emacp is mapped before the interrupt handler can fire. An early
interrupt hitting emac_irq() would dereference the NULL dev->emacp and
crash.
Also remove redundant error message. devm_platform_ioremap_resource()
already returns an error message with dev_err_probe().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ibm/emac/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "90bb7164878b5e57d447f02c71c238f4f246016a",
"status": "affected",
"version": "dcc34ef7c83473222027f475014a2bf8ab798372",
"versionType": "git"
},
{
"lessThan": "a103cdb0681e7185d1b0a12ce6a7c5416c208ccd",
"status": "affected",
"version": "dcc34ef7c83473222027f475014a2bf8ab798372",
"versionType": "git"
},
{
"lessThan": "44068b6863fbda78fc810921ddf61642c377b3ca",
"status": "affected",
"version": "dcc34ef7c83473222027f475014a2bf8ab798372",
"versionType": "git"
},
{
"lessThan": "f623d38fe6c4e8c40b23f42cc6fe6963fa49997b",
"status": "affected",
"version": "dcc34ef7c83473222027f475014a2bf8ab798372",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ibm/emac/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: emac: Fix NULL pointer dereference in emac_probe\n\nMove devm_request_irq() after devm_platform_ioremap_resource() so that\ndev-\u003eemacp is mapped before the interrupt handler can fire. An early\ninterrupt hitting emac_irq() would dereference the NULL dev-\u003eemacp and\ncrash.\n\nAlso remove redundant error message. devm_platform_ioremap_resource()\nalready returns an error message with dev_err_probe()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - IBM EMAC error IRQs are raised by the on-chip Ethernet controller from wire-side events; a remote attacker on the attached network can send Ethernet traffic during emac_probe to assert interrupts that invoke emac_irq() before dev-\u003eemacp is ioremap\u0027d.\nAC:L - Once devm_request_irq() registers emac_irq(), any EMAC interrupt fires immediately; an attacker can sustain Ethernet flooding throughout boot/probe, and firmware often leaves the controller active with pending IRQs that hit the narrow pre-ioremap window reliably.\nPR:N - Triggering EMAC hardware interrupts requires only the ability to send Ethernet frames on the connected network segment during driver probe, not local shell access, capabilities, or authenticated sessions.\nUI:N - Exploitation occurs during automatic platform-driver probe at kernel boot or module initialization; no discretionary user action is required beyond the device powering on with its Ethernet port connected.\nS:U - A NULL pointer dereference in the EMAC hard-IRQ handler causes a local kernel oops or panic only; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The bug dereferences a NULL dev-\u003eemacp when reading ISR registers via in_be32(), causing an immediate kernel fault with no attacker-controlled memory disclosure or out-of-bounds read.\nI:N - Impact is limited to a NULL pointer fault in hardirq context; there is no heap corruption, arbitrary write, or control-flow hijack primitive beyond the crash itself.\nA:H - A NULL pointer dereference in emac_irq() hard interrupt context causes a kernel oops or panic, rendering the entire system unavailable on affected PowerPC embedded platforms."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:34.944Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/90bb7164878b5e57d447f02c71c238f4f246016a"
},
{
"url": "https://git.kernel.org/stable/c/a103cdb0681e7185d1b0a12ce6a7c5416c208ccd"
},
{
"url": "https://git.kernel.org/stable/c/44068b6863fbda78fc810921ddf61642c377b3ca"
},
{
"url": "https://git.kernel.org/stable/c/f623d38fe6c4e8c40b23f42cc6fe6963fa49997b"
}
],
"title": "net: emac: Fix NULL pointer dereference in emac_probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80614",
"datePublished": "2026-08-28T06:48:35.720Z",
"dateReserved": "2026-08-26T14:34:25.773Z",
"dateUpdated": "2026-10-21T12:46:34.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98974 (GCVE-0-2026-98974)
Vulnerability from cvelistv5
Published
2026-10-23 12:19
Modified
2026-10-24 14:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.
Eventually I got from Norbert a description of what's going wrong:
> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [201] [202]
> donor1 size 4096 -> [300]
> donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [100] [202] reflink flag set
> ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
> file1 size 4096 -> [200] [100] [300] reflink flag set
> ^^^^^^^^^^^ still owned, now past the size
> donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
> file1 size 4096 -> [400] [100] [300] reflink flag CLEARED
> donor2 size 4096 -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
> peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.
So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly. The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:
"Ignore the length parameter. All bytes in file1_fd from file1_offset
to EOF are moved to file2_fd, and file2's size is set to
(file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in
file2 from file2_offset to EOF are moved to file1 and file1's size is
set to (file1_offset+(file2_length-file2_offset))."
In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data. Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.
Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file. Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file. That enables an extending write of the broken file to rewrite the
shared block that's just past EOF. This has become known colloquially
as refluxfs.
Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.
Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:
> The offsets are bounded against the incore i_size but subtracted from
>
---truncated---
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c",
"fs/xfs/xfs_exchrange.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b361d32b884f8ddcb9bad5d99b69eece648f8e43",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "952b5c99a840c2bff1f6645fd5e06e1db6ec2623",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c",
"fs/xfs/xfs_exchrange.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE\u0027s TO_EOF flag. The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what\u0027s going wrong:\n\n\u003e Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n\u003e that gets rewritten and file1 is the one that ends up with the flag\n\u003e cleared.\n\u003e\n\u003e Start, nothing shared:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [201] [202]\n\u003e\tdonor1 size 4096 -\u003e [300]\n\u003e\tdonor2 size 4096 -\u003e [400]\n\u003e\n\u003e 1. FICLONERANGE peer\u0027s block into file1\u0027s middle slot:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [100] [202] reflink flag set\n\u003e ^^^^^ both files own block 100\n\u003e\n\u003e 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n\u003e file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n\u003e are exchanged with it:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [200] [100] [300] reflink flag set\n\u003e ^^^^^^^^^^^ still owned, now past the size\n\u003e\tdonor1 size 12288 -\u003e [202]\n\u003e\n\u003e file1 says it is one block long while it still owns three. Nothing was\n\u003e unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n\u003e\n\u003e 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n\u003e By i_disk_size this is two one-block files exchanging everything, so\n\u003e xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [400] [100] [300] reflink flag CLEARED\n\u003e\tdonor2 size 4096 -\u003e [200]\n\u003e\n\u003e Block 100 is still shared with peer.\n\u003e\n\u003e 4. pwrite(file1, 4096, 4096), which is file1\u0027s second slot, block 100.\n\u003e xfs_is_cow_inode(file1) is false, so no CoW:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100] same block, new contents\n\u003e\n\u003e Block 100 is the only one that matters here. PoC below, it reads a file\n\u003e called peer in the current directory. The filesystem needs reflink and\n\u003e exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it\u0027s actually\nexchanging the data block correctly. The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter. All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2\u0027s size is set to\n (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1\u0027s size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data. Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file. Because the\nfile size is set incorrectly, exchange-range thinks it\u0027s exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile. That enables an extending write of the broken file to rewrite the\nshared block that\u0027s just past EOF. This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it\u0027s doing a full-contents swap, so it won\u0027t clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n\u003e The offsets are bounded against the incore i_size but subtracted from\n\u003e\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled offsets and XFS_EXCHANGE_RANGE_TO_EOF flag enter through ioctl(2), then xfs_file_ioctl -\u003e xfs_ioc_exchange_range -\u003e xfs_exchange_range -\u003e xfs_exchrange_mappings/xfs_exchmaps_init_intent, the two patched functions; no network data reaches this path.\nAC:L - On XFS with reflink and exchange-range enabled, one process can deterministically clone a readable peer block, issue the TO_EOF and full-range exchanges, then pwrite; every transition is attacker-controlled and no race is required.\nPR:L - xfs_exchange_range requires read/write access to the exchanged files, which can be attacker-owned. The protected peer is only the FICLONERANGE source, and vfs_clone_file_range requires MAY_READ on it without any capability check.\nUI:N - The attacker alone invokes FICLONERANGE, two XFS_IOC_EXCHANGE_RANGE operations, and pwrite against an already-mounted XFS filesystem; no victim must open a file or mount attacker-supplied media.\nS:U - The incorrect size exchange in xfs_exchmaps_init_intent and resulting CoW bypass affect files and privileges within the same host kernel security authority; no VM, IOMMU, or other scope boundary is crossed.\nC:H - After xfs_exchmaps_clear_reflink removes XFS_DIFLAG2_REFLINK, xfs_is_cow_inode returns false and pwrite can alter a still-shared block in a readable root-owned setuid executable; its unchanged privileged metadata permits root execution and access to all host data.\nI:H - The non-CoW pwrite supplies controlled full-block contents to a physical extent still owned by a root-owned readable file, allowing arbitrary modification of protected files on the same XFS volume despite DAC.\nA:H - The same controlled shared-block overwrite can corrupt the headers or code of essential readable system binaries, libraries, or boot files on XFS, causing complete service or system failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:09:44.115Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b361d32b884f8ddcb9bad5d99b69eece648f8e43"
},
{
"url": "https://git.kernel.org/stable/c/cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8"
},
{
"url": "https://git.kernel.org/stable/c/952b5c99a840c2bff1f6645fd5e06e1db6ec2623"
},
{
"url": "https://git.kernel.org/stable/c/7dfb218c829c1acb626e0fe92c5fddb9a26a03e9"
}
],
"title": "xfs: fix exchange-range-to-eof file size exchange",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98974",
"datePublished": "2026-10-23T12:19:47.424Z",
"dateReserved": "2026-09-25T10:25:14.383Z",
"dateUpdated": "2026-10-24T14:09:44.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80948 (GCVE-0-2026-80948)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses
the out_free_eeprom_blob label. Consequently, error paths triggered after
successfully parsing the EEPROM free priv->nvm_data but leak
priv->eeprom_blob.
Fix this memory leak by reordering the error handling labels so
that out_free_eeprom falls through to out_free_eeprom_blob.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc6.
An x86_64 allyesconfig build showed no new warnings. As we do not have
supported Intel DVM wireless hardware and firmware to test with, no
runtime testing was able to be performed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 26a7ca9a71a3f7e1826de96b1a1e907123e11b07 Version: 26a7ca9a71a3f7e1826de96b1a1e907123e11b07 Version: 26a7ca9a71a3f7e1826de96b1a1e907123e11b07 Version: 26a7ca9a71a3f7e1826de96b1a1e907123e11b07 Version: 26a7ca9a71a3f7e1826de96b1a1e907123e11b07 Version: 26a7ca9a71a3f7e1826de96b1a1e907123e11b07 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/dvm/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0540361ac82095b25e6eebd70b1df37d2faf45bd",
"status": "affected",
"version": "26a7ca9a71a3f7e1826de96b1a1e907123e11b07",
"versionType": "git"
},
{
"lessThan": "7be73911d979bb0f54485c2292043a5703fdc953",
"status": "affected",
"version": "26a7ca9a71a3f7e1826de96b1a1e907123e11b07",
"versionType": "git"
},
{
"lessThan": "2d593f32efa9ff1c91c508f45eb709c03dfb4945",
"status": "affected",
"version": "26a7ca9a71a3f7e1826de96b1a1e907123e11b07",
"versionType": "git"
},
{
"lessThan": "84ba017a1e1ea7896ed1e3258c947bdbfc5299c5",
"status": "affected",
"version": "26a7ca9a71a3f7e1826de96b1a1e907123e11b07",
"versionType": "git"
},
{
"lessThan": "ad2a9fdca4a7100472be82ee6048c616fc589720",
"status": "affected",
"version": "26a7ca9a71a3f7e1826de96b1a1e907123e11b07",
"versionType": "git"
},
{
"lessThan": "67105abd6195a685a84dcb8a5daf54a1f4bfdb60",
"status": "affected",
"version": "26a7ca9a71a3f7e1826de96b1a1e907123e11b07",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/dvm/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()\n\nIn iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses\nthe out_free_eeprom_blob label. Consequently, error paths triggered after\nsuccessfully parsing the EEPROM free priv-\u003envm_data but leak\npriv-\u003eeeprom_blob.\n\nFix this memory leak by reordering the error handling labels so\nthat out_free_eeprom falls through to out_free_eeprom_blob.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1-rc6.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsupported Intel DVM wireless hardware and firmware to test with, no\nruntime testing was able to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:29.878Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0540361ac82095b25e6eebd70b1df37d2faf45bd"
},
{
"url": "https://git.kernel.org/stable/c/7be73911d979bb0f54485c2292043a5703fdc953"
},
{
"url": "https://git.kernel.org/stable/c/2d593f32efa9ff1c91c508f45eb709c03dfb4945"
},
{
"url": "https://git.kernel.org/stable/c/84ba017a1e1ea7896ed1e3258c947bdbfc5299c5"
},
{
"url": "https://git.kernel.org/stable/c/ad2a9fdca4a7100472be82ee6048c616fc589720"
},
{
"url": "https://git.kernel.org/stable/c/67105abd6195a685a84dcb8a5daf54a1f4bfdb60"
}
],
"title": "wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80948",
"datePublished": "2026-09-11T19:42:19.048Z",
"dateReserved": "2026-08-26T14:34:25.804Z",
"dateUpdated": "2026-10-30T12:31:29.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72383 (GCVE-0-2026-72383)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix addr_wq_timer race in sctp_free_addr_wq()
sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete()
while holding addr_wq_lock. However, timer_delete() does not guarantee that
a currently running timer handler has completed.
This allows a race with sctp_addr_wq_timeout_handler(), where the handler
may still run after addr_waitq has been freed, acquire addr_wq_lock, and
access freed memory, leading to a use-after-free.
Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This
guarantees that any in-flight timer handler has finished and prevents the
timer from being re-armed during teardown, making subsequent cleanup safe.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4db67e808640e3934d82ce61ee8e2e89fd877ba8 Version: 4db67e808640e3934d82ce61ee8e2e89fd877ba8 Version: 4db67e808640e3934d82ce61ee8e2e89fd877ba8 Version: 4db67e808640e3934d82ce61ee8e2e89fd877ba8 Version: 4db67e808640e3934d82ce61ee8e2e89fd877ba8 Version: 4db67e808640e3934d82ce61ee8e2e89fd877ba8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:48:17.297535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:20.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb6117713abef8646fdbf58256532451bcf26c47",
"status": "affected",
"version": "4db67e808640e3934d82ce61ee8e2e89fd877ba8",
"versionType": "git"
},
{
"lessThan": "5098308ad72f83f3b1a48c247dddab1695114bae",
"status": "affected",
"version": "4db67e808640e3934d82ce61ee8e2e89fd877ba8",
"versionType": "git"
},
{
"lessThan": "d49eff15261dd62e4fa3a316c26cb1f537a60464",
"status": "affected",
"version": "4db67e808640e3934d82ce61ee8e2e89fd877ba8",
"versionType": "git"
},
{
"lessThan": "a8323fb2ab6cd6978f359daeed6688e0cadf32ba",
"status": "affected",
"version": "4db67e808640e3934d82ce61ee8e2e89fd877ba8",
"versionType": "git"
},
{
"lessThan": "c3e5cac47519d77ad36b9c03a1df1536aaa0c4a1",
"status": "affected",
"version": "4db67e808640e3934d82ce61ee8e2e89fd877ba8",
"versionType": "git"
},
{
"lessThan": "976c19de0f22a857ba0112f39635f8fd7a257568",
"status": "affected",
"version": "4db67e808640e3934d82ce61ee8e2e89fd877ba8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix addr_wq_timer race in sctp_free_addr_wq()\n\nsctp_free_addr_wq() previously removed addr_wq_timer using timer_delete()\nwhile holding addr_wq_lock. However, timer_delete() does not guarantee that\na currently running timer handler has completed.\n\nThis allows a race with sctp_addr_wq_timeout_handler(), where the handler\nmay still run after addr_waitq has been freed, acquire addr_wq_lock, and\naccess freed memory, leading to a use-after-free.\n\nFix this by calling timer_shutdown_sync() before taking addr_wq_lock. This\nguarantees that any in-flight timer handler has finished and prevents the\ntimer from being re-armed during teardown, making subsequent cleanup safe."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in sctp_free_addr_wq() during per-network-namespace SCTP teardown when a net namespace is destroyed; reaching it requires local syscalls (unshare/exit, SCTP socket/bind/setsockopt, rtnetlink address changes), not remote SCTP packet receive paths.\nAC:L - The attacker controls both sides of the race by creating a netns with SCTP AUTO_ASCONF sockets, queueing address events that arm addr_wq_timer (~500ms), and concurrently destroying that namespace; timer_delete() does not wait for sctp_addr_wq_timeout_handler(), so the UAF is reliably winnable.\nPR:L - An unprivileged local user can obtain CAP_NET_ADMIN in a new user+network namespace via unshare, bind an SCTP socket to INADDR_ANY, enable SCTP_AUTO_ASCONF, churn interface addresses to populate addr_waitq, and destroy the namespace; container tenants can trigger the same netns teardown without init-namespace root.\nUI:N - Exploitation is fully attacker-driven through scripted namespace create/configure/destroy and concurrent threads; no victim must mount filesystems, open files, or take any discretionary action beyond the attacker\u0027s own setup.\nS:U - The bug is kernel heap use-after-free of sctp_sockaddr_entry during netns teardown; impact is host kernel memory corruption and privilege escalation within the same kernel security authority, not a VM/hypervisor or IOMMU boundary crossing.\nC:H - sctp_addr_wq_timeout_handler() may walk addr_waitq and dereference sctp_sockaddr_entry fields after sctp_free_addr_wq() kfree()\u0027s those entries; UAF on freed heap objects enables kernel memory disclosure and supports further exploitation primitives.\nI:H - The timer handler calls sctp_asconf_mgmt() on corrupted addrw pointers (address family, sockaddr, state), driving ASCONF add/delete processing on freed memory; UAF heap corruption is exploitable for arbitrary kernel write and potential code execution.\nA:H - Use-after-free in sctp_addr_wq_timeout_handler() during list iteration, socket locking, and sctp_asconf_mgmt() can cause kernel oops or panic from accesses to freed sctp_sockaddr_entry memory, even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:14.606Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb6117713abef8646fdbf58256532451bcf26c47"
},
{
"url": "https://git.kernel.org/stable/c/5098308ad72f83f3b1a48c247dddab1695114bae"
},
{
"url": "https://git.kernel.org/stable/c/d49eff15261dd62e4fa3a316c26cb1f537a60464"
},
{
"url": "https://git.kernel.org/stable/c/a8323fb2ab6cd6978f359daeed6688e0cadf32ba"
},
{
"url": "https://git.kernel.org/stable/c/c3e5cac47519d77ad36b9c03a1df1536aaa0c4a1"
},
{
"url": "https://git.kernel.org/stable/c/976c19de0f22a857ba0112f39635f8fd7a257568"
}
],
"title": "sctp: fix addr_wq_timer race in sctp_free_addr_wq()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72383",
"datePublished": "2026-08-15T05:56:14.755Z",
"dateReserved": "2026-08-09T03:40:39.923Z",
"dateUpdated": "2026-10-30T12:29:14.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89642 (GCVE-0-2026-89642)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
cifs_setsize() calls truncate_pagecache() but skips
pagecache_isize_extended() on extension. truncate_setsize() shows
the correct pattern:
i_size_write(inode, newsize);
if (newsize > oldsize)
pagecache_isize_extended(inode, oldsize, newsize);
truncate_pagecache(inode, newsize);
pagecache_isize_extended() zeroes the tail of the page straddling old
EOF. Without it, dirty bytes in that region can be written back to
the server, exposing stale data in the newly extended range.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "880e1b5883a5d78d916fa446791c48f28a16719b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5463d96cd2e46064ceefcf861b028745a4f4c373",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "40c16040783abcc240bd1b453e679ea6ca30e19e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e1f692b6da3e632a25d0b3a99f833bb609bae1a3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "12bafe32f09c0d24f5096154b59c347b9c6606e0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c510edb9734af1c274d18f4f31a471a166bbc7e8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: call pagecache_isize_extended() in cifs_setsize() when extending\n\ncifs_setsize() calls truncate_pagecache() but skips\npagecache_isize_extended() on extension. truncate_setsize() shows\nthe correct pattern:\n\n i_size_write(inode, newsize);\n if (newsize \u003e oldsize)\n pagecache_isize_extended(inode, oldsize, newsize);\n truncate_pagecache(inode, newsize);\n\npagecache_isize_extended() zeroes the tail of the page straddling old\nEOF. Without it, dirty bytes in that region can be written back to\nthe server, exposing stale data in the newly extended range."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:25.947Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/880e1b5883a5d78d916fa446791c48f28a16719b"
},
{
"url": "https://git.kernel.org/stable/c/5463d96cd2e46064ceefcf861b028745a4f4c373"
},
{
"url": "https://git.kernel.org/stable/c/40c16040783abcc240bd1b453e679ea6ca30e19e"
},
{
"url": "https://git.kernel.org/stable/c/e1f692b6da3e632a25d0b3a99f833bb609bae1a3"
},
{
"url": "https://git.kernel.org/stable/c/12bafe32f09c0d24f5096154b59c347b9c6606e0"
},
{
"url": "https://git.kernel.org/stable/c/c510edb9734af1c274d18f4f31a471a166bbc7e8"
}
],
"title": "cifs: call pagecache_isize_extended() in cifs_setsize() when extending",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89642",
"datePublished": "2026-09-11T19:45:34.778Z",
"dateReserved": "2026-09-11T19:38:34.741Z",
"dateUpdated": "2026-10-30T12:32:25.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90427 (GCVE-0-2026-90427)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger
tegra241_cmdqv, which frees the original @smmu once it relocates. A failure
after that returned NULL, and the caller then dereferenced the freed @smmu
on its fallback path.
Return an int and take @smmu by reference instead, then update *smmu to the
reallocated pointer after devm_krealloc() succeeds, so the caller and its
fallback path both use the live @smmu rather than the freed original.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
},
{
"lessThan": "268cbe3a36ae57a2ec09601f343b92f6f092d505",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
},
{
"lessThan": "86197679b293f0601c3331d545f99a70a7780aa9",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
},
{
"lessThan": "d4d05f55e9da646ec03adfa77260eb46f4163749",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Don\u0027t fall back to a freed smmu after devm_krealloc()\n\n__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger\ntegra241_cmdqv, which frees the original @smmu once it relocates. A failure\nafter that returned NULL, and the caller then dereferenced the freed @smmu\non its fallback path.\n\nReturn an int and take @smmu by reference instead, then update *smmu to the\nreallocated pointer after devm_krealloc() succeeds, so the caller and its\nfallback path both use the live @smmu rather than the freed original."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached from arm_smmu_device_probe() \u2192 arm_smmu_impl_probe() \u2192 tegra241_cmdqv_probe() \u2192 __tegra241_cmdqv_probe() when ACPI IORT (acpi_iort_init()/iort_add_platform_device(\"arm-smmu-v3\")) or DT nvidia,tegra264-smmu binds the SMMU. No protocol message supplies the stale pointer; it is a local devm_krealloc() lifetime bug.\nAC:H - out_fallback uses the freed @smmu only if a relocating devm_krealloc() is followed by kzalloc_objs(cmdqv-\u003evintfs) or request_threaded_irq() failing. arm_smmu_driver sets suppress_bind_attrs, CONFIG_ARM_SMMU_V3=y, and this probe never returns -EPROBE_DEFER, so a local attacker cannot re-enter it or reliably force those GFP_KERNEL/IRQ failures.\nPR:N - arm_smmu_device_probe() has no capable() check; tegra241_cmdqv_probe() runs from the platform .probe in kernel_init once IORT creates the arm-smmu-v3 device or DT matches nvidia,tegra264-smmu. No OS account or user-namespace capability is required to be on that path.\nUI:N - tegra241_cmdqv_probe()\u2019s out_fallback dereference of the freed @smmu runs inside arm_smmu_device_probe() during automatic platform bind; no victim must mount a filesystem, open a device node, or load a module by hand.\nS:U - The use-after-free is of the host kernel arm_smmu_device that devm_krealloc() freed in __tegra241_cmdqv_probe(); out_fallback\u2019s smmu-\u003eoptions write and the rest of arm_smmu_device_probe() stay in that kernel. This is not leftover SMMU translation tables or a guest/DMA walk of attacker-controlled IOMMU page tables.\nC:H - After a relocating devm_krealloc(), tegra241_cmdqv_probe() returns ERR_PTR(-ENODEV) and arm_smmu_impl_probe() hands the freed @smmu back to arm_smmu_device_probe(). That use-after-free of the SMMU object can be reclaimed and, per kernel UAF guidance, enables arbitrary kernel memory disclosure.\nI:H - out_fallback writes smmu-\u003eoptions through the freed pointer, then arm_smmu_device_probe() continues with arm_smmu_device_hw_probe(), arm_smmu_init_structures(), and iommu_device_register() on the same dangling arm_smmu_device, a write-after-free that yields heap-spray write and control-flow hijack primitives.\nA:H - out_fallback dereferences smmu-\u003eimpl_dev and later SMMU probe/runtime uses the freed arm_smmu_device; that use-after-free oopses or panics the kernel even when not turned into a full exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:38.034Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e"
},
{
"url": "https://git.kernel.org/stable/c/268cbe3a36ae57a2ec09601f343b92f6f092d505"
},
{
"url": "https://git.kernel.org/stable/c/86197679b293f0601c3331d545f99a70a7780aa9"
},
{
"url": "https://git.kernel.org/stable/c/d4d05f55e9da646ec03adfa77260eb46f4163749"
}
],
"title": "iommu/tegra241-cmdqv: Don\u0027t fall back to a freed smmu after devm_krealloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90427",
"datePublished": "2026-09-17T16:09:49.121Z",
"dateReserved": "2026-09-11T19:38:34.814Z",
"dateUpdated": "2026-10-21T12:51:38.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99140 (GCVE-0-2026-99140)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix hist trigger timestamps for buffered events
Syzkaller triggered a WARN_ON_ONCE(!nest) warning:
WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp
Call trace:
ring_buffer_event_time_stamp
hist_field_timestamp
hist_fn_call
event_hist_trigger
event_triggers_call
__event_trigger_test_discard
trace_event_buffer_commit
do_trace_event_raw_event_sched_switch
trace_event_raw_event_sched_switch
The warning is probabilistically reproducible and is related to syzkaller
executing the following commands:
echo 'prev_pid == 999999' > events/sched/sched_switch/filter
echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger
The specific triggering process is as follows:
CPU 0 CPU 1
(context switching) (echo 'hist:keys=common_timestamp' > \
events/sched/sched_switch/trigger)
do_trace_event_raw_event_##call
trace_event_buffer_lock_reserve
if (!tr->no_filter_buffering_ref &&
trace_file->flags & EVENT_FILE_FL_FILTERED)
return entry; // return directly
event_hist_trigger_parse
hist_register_trigger
tracing_set_filter_buffering(file->tr, true);
tr->no_filter_buffering_ref++;
__trace_buffer_lock_reserve
rb_start_commit
local_inc(&cpu_buffer->committing); // skipped and not executed
trace_event_buffer_commit
__event_trigger_test_discard
event_triggers_call
event_hist_trigger
hist_fn_call
hist_field_timestamp
ring_buffer_event_time_stamp
nest = local_read(&cpu_buffer->committing);
WARN_ON_ONCE(!nest) // trigger warning
The root cause is that when an event file has a filter attached and the
hist trigger has not yet been attached, trace_event_buffer_lock_reserve()
writes the event into the per-CPU trace_buffered_event temp buffer instead
of reserving it in the ring buffer, so cpu_buffer->committing is not
incremented. When the event is later processed at commit time by a hist
trigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a
zero committing count, triggering WARN_ON_ONCE(!nest).
tracing_event_time_stamp() was added by commit d8279bfc5e959 ("tracing:
Add tracing_event_time_stamp() API") for exactly this case: if the event
is the per-CPU trace_buffered_event, it returns the current ring buffer
timestamp. But it never gained a caller. Use it in hist_field_timestamp(),
so that a hist trigger that races onto a buffered event records the
current time, which is only marginally later than when the event was
recorded, instead of warning and recording a bogus timestamp.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b94bc80df64823e676b506f8de7dcf6a688d681e Version: b94bc80df64823e676b506f8de7dcf6a688d681e Version: b94bc80df64823e676b506f8de7dcf6a688d681e Version: b94bc80df64823e676b506f8de7dcf6a688d681e Version: b94bc80df64823e676b506f8de7dcf6a688d681e Version: b94bc80df64823e676b506f8de7dcf6a688d681e Version: b94bc80df64823e676b506f8de7dcf6a688d681e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3a94a79047d3fc9385b3709cb2b86f4a26ed0c3",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
},
{
"lessThan": "71c5c7420478d94d6eb0b427f66fa41bbda651e3",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
},
{
"lessThan": "ab320f6aa3769480f735ed0ad026c4a61799b7bc",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
},
{
"lessThan": "af192a356e9830a0df231b590ad6fb1fc28c9315",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
},
{
"lessThan": "09c7cce2e59e6b3b1807520bcb1980c561f15d1e",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
},
{
"lessThan": "89e90b16aadd6e66bd0323bc8dfc76a62e756b57",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
},
{
"lessThan": "9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0",
"status": "affected",
"version": "b94bc80df64823e676b506f8de7dcf6a688d681e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix hist trigger timestamps for buffered events\n\nSyzkaller triggered a WARN_ON_ONCE(!nest) warning:\n\n WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp\n Call trace:\n ring_buffer_event_time_stamp\n hist_field_timestamp\n hist_fn_call\n event_hist_trigger\n event_triggers_call\n __event_trigger_test_discard\n trace_event_buffer_commit\n do_trace_event_raw_event_sched_switch\n trace_event_raw_event_sched_switch\n\nThe warning is probabilistically reproducible and is related to syzkaller\nexecuting the following commands:\n\n echo \u0027prev_pid == 999999\u0027 \u003e events/sched/sched_switch/filter\n echo \u0027hist:keys=common_timestamp\u0027 \u003e events/sched/sched_switch/trigger\n\nThe specific triggering process is as follows:\n\nCPU 0 CPU 1\n(context switching) (echo \u0027hist:keys=common_timestamp\u0027 \u003e \\\n events/sched/sched_switch/trigger)\ndo_trace_event_raw_event_##call\n trace_event_buffer_lock_reserve\n if (!tr-\u003eno_filter_buffering_ref \u0026\u0026\n trace_file-\u003eflags \u0026 EVENT_FILE_FL_FILTERED)\n return entry; // return directly\n event_hist_trigger_parse\n hist_register_trigger\n tracing_set_filter_buffering(file-\u003etr, true);\n tr-\u003eno_filter_buffering_ref++;\n __trace_buffer_lock_reserve\n rb_start_commit\n local_inc(\u0026cpu_buffer-\u003ecommitting); // skipped and not executed\n trace_event_buffer_commit\n __event_trigger_test_discard\n event_triggers_call\n event_hist_trigger\n hist_fn_call\n hist_field_timestamp\n ring_buffer_event_time_stamp\n nest = local_read(\u0026cpu_buffer-\u003ecommitting);\n WARN_ON_ONCE(!nest) // trigger warning\n\nThe root cause is that when an event file has a filter attached and the\nhist trigger has not yet been attached, trace_event_buffer_lock_reserve()\nwrites the event into the per-CPU trace_buffered_event temp buffer instead\nof reserving it in the ring buffer, so cpu_buffer-\u003ecommitting is not\nincremented. When the event is later processed at commit time by a hist\ntrigger, hist_field_timestamp() -\u003e ring_buffer_event_time_stamp() sees a\nzero committing count, triggering WARN_ON_ONCE(!nest).\n\ntracing_event_time_stamp() was added by commit d8279bfc5e959 (\"tracing:\nAdd tracing_event_time_stamp() API\") for exactly this case: if the event\nis the per-CPU trace_buffered_event, it returns the current ring buffer\ntimestamp. But it never gained a caller. Use it in hist_field_timestamp(),\nso that a hist trigger that races onto a buffered event records the\ncurrent time, which is only marginally later than when the event was\nrecorded, instead of warning and recording a bogus timestamp."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:12.896Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3a94a79047d3fc9385b3709cb2b86f4a26ed0c3"
},
{
"url": "https://git.kernel.org/stable/c/71c5c7420478d94d6eb0b427f66fa41bbda651e3"
},
{
"url": "https://git.kernel.org/stable/c/ab320f6aa3769480f735ed0ad026c4a61799b7bc"
},
{
"url": "https://git.kernel.org/stable/c/af192a356e9830a0df231b590ad6fb1fc28c9315"
},
{
"url": "https://git.kernel.org/stable/c/09c7cce2e59e6b3b1807520bcb1980c561f15d1e"
},
{
"url": "https://git.kernel.org/stable/c/89e90b16aadd6e66bd0323bc8dfc76a62e756b57"
},
{
"url": "https://git.kernel.org/stable/c/9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0"
}
],
"title": "tracing: Fix hist trigger timestamps for buffered events",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99140",
"datePublished": "2026-10-28T10:34:51.421Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-30T12:42:12.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90093 (GCVE-0-2026-90093)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
l2cap_chan::conn has held reference and remains non-NULL also after the
corresponding hci_conn is deleted. In this state accessing various
fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in
l2cap_sock_setsockopt() access of conn->hcon->hdev.
Check l2cap_chan::conn.hcon corresponds to an alive hci_conn before
trying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in
getsockopt/setsockopt to ensure it stays alive, and to avoid data races
in l2cap_chan fields.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8f90405a4a6f1f1880dc07996b47bf57c712bd8a Version: 32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b Version: 8922c7940bae9ce4b1736dddb6362370793835c2 Version: 91047a4396a8b1857a6f712a90cf33ec0012b189 Version: 0b0e2bf39cf99e458d991b9df253727e036a7d7d Version: d3b739db5dc6f688a60d56da872fabaf65246032 Version: b66774b48dd98f07254951f74ea6f513efe7ff8b Version: b66774b48dd98f07254951f74ea6f513efe7ff8b Version: 50c38d9f42a529691e4e67ea9cedf4f0bfc8d277 Version: 5.10.265 ≤ Version: 5.15.216 ≤ Version: 6.1.183 ≤ Version: 6.6.145 ≤ Version: 6.12.97 ≤ Version: 6.18.39 ≤ Version: 7.1.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c66cd500ba1a58b3798c468fcc774ed2c8c2ec7d",
"status": "affected",
"version": "8f90405a4a6f1f1880dc07996b47bf57c712bd8a",
"versionType": "git"
},
{
"lessThan": "737b80c97aef10404a9beed7c0ed45fcd5fc5931",
"status": "affected",
"version": "32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b",
"versionType": "git"
},
{
"lessThan": "0d7b7b31ea092e17d757bd24e2e9028ba5e3a4ca",
"status": "affected",
"version": "8922c7940bae9ce4b1736dddb6362370793835c2",
"versionType": "git"
},
{
"lessThan": "19e154d794eb4d33d99ca4a087b1cea9d5e65786",
"status": "affected",
"version": "91047a4396a8b1857a6f712a90cf33ec0012b189",
"versionType": "git"
},
{
"lessThan": "3af72bf8f73c519ee562e6963d5ff8e678924f93",
"status": "affected",
"version": "0b0e2bf39cf99e458d991b9df253727e036a7d7d",
"versionType": "git"
},
{
"lessThan": "8460dc49c9756a1e9288218060b4d41e1b704905",
"status": "affected",
"version": "d3b739db5dc6f688a60d56da872fabaf65246032",
"versionType": "git"
},
{
"lessThan": "f49321c85785178214fd67f2e9b4b73d6363783b",
"status": "affected",
"version": "b66774b48dd98f07254951f74ea6f513efe7ff8b",
"versionType": "git"
},
{
"lessThan": "ca2c4c26498643f421d35ffe258fafbd3ed461c3",
"status": "affected",
"version": "b66774b48dd98f07254951f74ea6f513efe7ff8b",
"versionType": "git"
},
{
"status": "affected",
"version": "50c38d9f42a529691e4e67ea9cedf4f0bfc8d277",
"versionType": "git"
},
{
"lessThan": "5.10.273",
"status": "affected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThan": "5.15.224",
"status": "affected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThan": "6.18.57",
"status": "affected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.10.265",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15.216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: access chan-\u003econn safely in get/setsockopt\n\nSince commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nl2cap_chan::conn has held reference and remains non-NULL also after the\ncorresponding hci_conn is deleted. In this state accessing various\nfields eg. hci_conn::hdev is invalid, which leads to KASAN crash in\nl2cap_sock_setsockopt() access of conn-\u003ehcon-\u003ehdev.\n\nCheck l2cap_chan::conn.hcon corresponds to an alive hci_conn before\ntrying to use it in l2cap_sock.c. Hold l2cap_chan_lock() in\ngetsockopt/setsockopt to ensure it stays alive, and to avoid data races\nin l2cap_chan fields."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached from __sys_setsockopt/__sys_getsockopt_iter into l2cap_sock_setsockopt()/l2cap_sock_getsockopt(), which dereference chan-\u003econn-\u003ehcon-\u003ehdev after the HCI device is already gone; the trigger is the local BT_FLUSHABLE/BT_SECURITY/BT_PHY sockopt, not a received L2CAP or HCI PDU. Syzbot frees that hdev via vhci_release()-\u003ehci_unregister_dev(), which an in-range peer cannot invoke.\nAC:L - After b66774b48dd9, l2cap_chan_del() sets FLAG_DEL but leaves chan-\u003econn non-NULL, so a later setsockopt(SOL_BLUETOOTH, BT_FLUSHABLE, BT_FLUSHABLE_OFF) deterministically hits lmp_no_flush_capable(conn-\u003ehcon-\u003ehdev) on the deleted hci_conn. The attacker opens the L2CAP socket, tears down the controller (close of /dev/vhci), then issues the sockopt; no un-controllable race or rare config is required.\nPR:L - l2cap_sock_create() requires capable(CAP_NET_RAW) only for SOCK_RAW; SOCK_SEQPACKET/STREAM/DGRAM L2CAP sockets used here have no capability gate, and vhci_open() likewise has no capable() check. An unprivileged init_net user who can open /dev/vhci (or an equivalent HCI node) can create the socket, unregister the controller, and call setsockopt without real root.\nUI:N - The attacker owns both the AF_BLUETOOTH/BTPROTO_L2CAP fd and the teardown fd: they connect, close /dev/vhci so hci_conn_hash_flush()-\u003el2cap_conn_del() runs, then call setsockopt on their still-open socket. No other user must pair, mount, or click anything.\nS:U - l2cap_sock_setsockopt() is using a dangling hci_dev through l2cap_conn-\u003ehcon after hci_release_dev(); the resulting slab UAF stays inside the host kernel Bluetooth stack and does not cross a VM, IOMMU, or sandbox authority.\nC:H - KASAN reports a use-after-free/OOB read in l2cap_sock_setsockopt() of conn-\u003ehcon-\u003ehdev (lmp_no_flush_capable() reads hdev-\u003efeatures[0][6]; getsockopt BT_SECURITY/BT_PHY and L2CAP_CONNINFO also read hcon fields). The freed hci_dev slab was reused as skbuff_small_head, so spraying that object yields a kernel-memory read primitive through the dangling hdev pointer.\nI:H - The same dangling conn-\u003ehcon remains usable from setsockopt after FLAG_DEL: BT_SECURITY on an ATT socket calls smp_conn_security(conn-\u003ehcon) which touches hcon-\u003ehdev flags and hcon-\u003epending_sec_level, and BT_PHY calls hci_conn_set_phy() on that hcon. A sprayed hci_dev in place of the freed object supplies function pointers (send/reset/workqueues) for write and control-flow hijack.\nA:H - Syzbot crashed in l2cap_sock_setsockopt+0x22c3 (net/bluetooth/l2cap_sock.c:1003) with both KASAN slab-out-of-bounds and use-after-free reads of the released hci_dev after vhci_release()-\u003ehci_release_dev(). Any such UAF dereference oopses or panics the kernel and can be repeated by open/connect/close/setsockopt."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:05.630Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c66cd500ba1a58b3798c468fcc774ed2c8c2ec7d"
},
{
"url": "https://git.kernel.org/stable/c/737b80c97aef10404a9beed7c0ed45fcd5fc5931"
},
{
"url": "https://git.kernel.org/stable/c/0d7b7b31ea092e17d757bd24e2e9028ba5e3a4ca"
},
{
"url": "https://git.kernel.org/stable/c/19e154d794eb4d33d99ca4a087b1cea9d5e65786"
},
{
"url": "https://git.kernel.org/stable/c/3af72bf8f73c519ee562e6963d5ff8e678924f93"
},
{
"url": "https://git.kernel.org/stable/c/8460dc49c9756a1e9288218060b4d41e1b704905"
},
{
"url": "https://git.kernel.org/stable/c/f49321c85785178214fd67f2e9b4b73d6363783b"
},
{
"url": "https://git.kernel.org/stable/c/ca2c4c26498643f421d35ffe258fafbd3ed461c3"
}
],
"title": "Bluetooth: L2CAP: access chan-\u003econn safely in get/setsockopt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90093",
"datePublished": "2026-09-17T16:06:06.843Z",
"dateReserved": "2026-09-11T19:38:34.786Z",
"dateUpdated": "2026-10-30T12:34:05.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90367 (GCVE-0-2026-90367)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
mt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs
before taking dev->mt76.mutex. mt76_worker_disable()/_enable() are plain
kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the
same worker and the MT76_RESET bit under the mutex. An L1 SER racing a
channel switch could therefore have the worker unparked and MT76_RESET
cleared while the reset path resets the DMA rings, corrupting descriptors
or tokens. Take the mutex before disabling the worker, as mt7915 does.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc4f4389f439e808185778d298da36976d13d415",
"status": "affected",
"version": "27015b6fbcca836c6dbf196afc266e068af4aeec",
"versionType": "git"
},
{
"lessThan": "69f23622533a4f054b5c8fdb226c3319ffa017b6",
"status": "affected",
"version": "27015b6fbcca836c6dbf196afc266e068af4aeec",
"versionType": "git"
},
{
"lessThan": "906ad486ba5c4933d82e1ebe0685656390a48450",
"status": "affected",
"version": "27015b6fbcca836c6dbf196afc266e068af4aeec",
"versionType": "git"
},
{
"lessThan": "594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701",
"status": "affected",
"version": "27015b6fbcca836c6dbf196afc266e068af4aeec",
"versionType": "git"
},
{
"lessThan": "6190db312b8230813f529f014b26247c6d9800d0",
"status": "affected",
"version": "27015b6fbcca836c6dbf196afc266e068af4aeec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: hold dev-\u003emt76.mutex while disabling tx worker in SER\n\nmt7996_mac_reset_work() parked the tx worker and disabled the RX/TX NAPIs\nbefore taking dev-\u003emt76.mutex. mt76_worker_disable()/_enable() are plain\nkthread park/unpark, not refcounted, and __mt76_set_channel() toggles the\nsame worker and the MT76_RESET bit under the mutex. An L1 SER racing a\nchannel switch could therefore have the worker unparked and MT76_RESET\ncleared while the reset path resets the DMA rings, corrupting descriptors\nor tokens. Take the mutex before disabling the worker, as mt7915 does."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - mt7996_irq_tasklet() handles MT_INT_MCU_CMD, reads MT_MCU_CMD, and on ERROR_MASK (including STOP_DMA) calls mt7996_reset() to queue L1 SER; the racing worker toggle is __mt76_set_channel() from mt76_switch_vif_chanctx() on an 802.11 Channel Switch Announcement. Both legs are WiFi radio-range, not a routable IP protocol.\nAC:L - A radio peer can drive both sides: emit CSA so ieee80211_csa_switch_work() runs mt76_switch_vif_chanctx()/__mt76_set_channel() (unparking the non-refcounted tx_worker under dev-\u003emt76.mutex) and induce firmware L1 SER so mt7996_mac_reset_work() parks that worker before taking the mutex. The MCU channel-switch hold and napi_disable() are a retryable millisecond window.\nPR:N - mt7996_irq_tasklet() consumes MT_MCU_CMD and queues reset_work with no capable() or 802.11 authentication gate; CSA is parsed from beacons/action frames in ieee80211_sta_process_chanswitch() without a host uid. An unauthenticated (SER) or associated (CSA) radio peer needs no Linux privilege.\nUI:N - ieee80211_csa_switch_work() applies CSA automatically once the STA is associated, and mt7996_mac_reset_work() runs from the driver workqueue after the MCU IRQ. No local user must write debugfs sys_recovery or issue nl80211 SET_CHANNEL to create the race.\nS:U - The corrupted TX DMA descriptors (mt76_dma_queue_reset of q-\u003edesc[]) and token IDR (mt7996_tx_token_put()/idr_destroy()) belong to this host\u0027s mt7996 driver; the race does not cross a VM, IOMMU, or sandbox authority.\nC:H - If __mt76_set_channel() unparks tx_worker while mt7996_mac_reset_work() still runs mt7996_dma_reset() and mt7996_tx_token_put(), the worker can idr_alloc on a destroyed token IDR and DMA-map into q-\u003edesc[] being zeroed, a UAF/descriptor confusion that discloses kernel memory.\nI:H - The same race lets the TX worker write queue head and descriptors (mt76_dma_add_buf) while mt76_dma_queue_reset() clears q-\u003edesc[] and mt7996_tx_token_put() destroys the token IDR, a write primitive against DMA-ring and heap token objects suitable for control-flow hijack.\nA:H - Concurrent mt76_dma_tx_cleanup()/mt76_dma_queue_reset() versus a live tx_worker oopses on a freed txwi/skb or wedges the WFDMA rings; the commit\u0027s descriptor/token corruption is a kernel crash, so availability is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:20.196Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc4f4389f439e808185778d298da36976d13d415"
},
{
"url": "https://git.kernel.org/stable/c/69f23622533a4f054b5c8fdb226c3319ffa017b6"
},
{
"url": "https://git.kernel.org/stable/c/906ad486ba5c4933d82e1ebe0685656390a48450"
},
{
"url": "https://git.kernel.org/stable/c/594c4b7f89f9ea75dc9c50b5e4c4296db4a3d701"
},
{
"url": "https://git.kernel.org/stable/c/6190db312b8230813f529f014b26247c6d9800d0"
}
],
"title": "wifi: mt76: mt7996: hold dev-\u003emt76.mutex while disabling tx worker in SER",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90367",
"datePublished": "2026-09-17T16:09:09.430Z",
"dateReserved": "2026-09-11T19:38:34.807Z",
"dateUpdated": "2026-10-21T12:51:20.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38656 (GCVE-0-2025-38656)
Vulnerability from cvelistv5
Published
2025-08-22 16:00
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
Preserve the error code if iwl_setup_deferred_work() fails. The current
code returns ERR_PTR(0) (which is NULL) on this path. I believe the
missing error code potentially leads to a use after free involving
debugfs.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ca980f1911a7144d451d1c31298ab8507c6bd88f Version: 7dd6350307af6521b6240b295c93b7eec4daebe6 Version: c0e43c3f6c0a79381b468574c241065998412b7c Version: 70a1b527eaea9430b1bd87de59f3b9f6bd225701 Version: 90a0d9f339960448a3acc1437a46730f975efd6a Version: c80832d445653baba5ac80cd2c2637c437ac881b Version: b398120fbe0acfef60b16f6a0f69902d385d7728 Version: 2e9f85ee3b46453a2f250a57d3a9f10c70c71202 Version: 6663c52608d8d8727bf1911e6d9218069ba1c85e Version: 5.4.297 ≤ Version: 5.10.241 ≤ Version: 5.15.190 ≤ Version: 6.1.148 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/dvm/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c432da1ee191e9f7830dd516456706063d7bec3",
"status": "affected",
"version": "ca980f1911a7144d451d1c31298ab8507c6bd88f",
"versionType": "git"
},
{
"lessThan": "f95598a133a905fd937354ad902773d05593b8b9",
"status": "affected",
"version": "7dd6350307af6521b6240b295c93b7eec4daebe6",
"versionType": "git"
},
{
"lessThan": "991e2066f6009d3cb898413058c62dbcc92bd6d2",
"status": "affected",
"version": "c0e43c3f6c0a79381b468574c241065998412b7c",
"versionType": "git"
},
{
"lessThan": "1d068272c21d886d06526454b68368100ba0a720",
"status": "affected",
"version": "70a1b527eaea9430b1bd87de59f3b9f6bd225701",
"versionType": "git"
},
{
"lessThan": "cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6",
"status": "affected",
"version": "90a0d9f339960448a3acc1437a46730f975efd6a",
"versionType": "git"
},
{
"status": "affected",
"version": "c80832d445653baba5ac80cd2c2637c437ac881b",
"versionType": "git"
},
{
"status": "affected",
"version": "b398120fbe0acfef60b16f6a0f69902d385d7728",
"versionType": "git"
},
{
"status": "affected",
"version": "2e9f85ee3b46453a2f250a57d3a9f10c70c71202",
"versionType": "git"
},
{
"status": "affected",
"version": "6663c52608d8d8727bf1911e6d9218069ba1c85e",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.297",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.148",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/dvm/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.102",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.42",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.102",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.148",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()\n\nPreserve the error code if iwl_setup_deferred_work() fails. The current\ncode returns ERR_PTR(0) (which is NULL) on this path. I believe the\nmissing error code potentially leads to a use after free involving\ndebugfs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is only reachable through the iwlwifi driver\u0027s PCI probe / firmware-load callback and the `iwl_opmode_register()` path when the `iwldvm` module loads \u2014 local module-load or device-bind activity, not any network or wireless frame processing (the radio is not even up at this point).\nAC:L - Reaching the faulty branch requires `alloc_ordered_workqueue()` to fail with ENOMEM at one specific small allocation during a one-shot driver probe; an attacker can raise system-wide memory pressure but cannot influence the timing of a boot-time or hotplug probe, so success depends on conditions outside their control.\nPR:L - Driver probe is normally triggered by root (modprobe, sysfs bind/unbind) or by hotplug, but an unprivileged local user can supply the only other precondition \u2014 memory exhaustion \u2014 while a probe occurs, so basic local user privileges are assumed rather than full root.\nUI:N - No victim action beyond ordinary system operation is needed; the probe path executes automatically at boot, on module autoload, or on device hotplug.\nS:U - The freed objects and the stale debugfs dentry all live in the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The commit identifies a resulting use-after-free involving debugfs; `ieee80211_free_hw()` has already freed the `iwl_priv` allocation while `drv-\u003edbgfs_op_mode` still references the orphaned tree, and a UAF on reclaimed slab memory can be leveraged to read attacker-chosen kernel data.\nI:H - The same use-after-free lets a reclaiming allocation overlap the freed object, giving a write primitive over kernel heap state that can be escalated to control-flow corruption.\nA:H - The driver is left in a half-torn-down state with a dangling debugfs reference, and dereferencing freed memory produces an oops/panic \u2014 a full availability loss, on top of the WiFi device being permanently unusable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:12.525Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c432da1ee191e9f7830dd516456706063d7bec3"
},
{
"url": "https://git.kernel.org/stable/c/f95598a133a905fd937354ad902773d05593b8b9"
},
{
"url": "https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2"
},
{
"url": "https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720"
},
{
"url": "https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"
}
],
"title": "wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38656",
"datePublished": "2025-08-22T16:00:59.678Z",
"dateReserved": "2025-04-16T04:51:24.030Z",
"dateUpdated": "2026-10-21T12:37:12.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72497 (GCVE-0-2026-72497)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Add a max slot check for SQ
The variable WQE mode must be validated against
the maximum slots supported by HW. The max supported
value is 64K. Adding a max and min check and fail if user
supplied value is more than the max supported and zero.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:09.318750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:27.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c",
"drivers/infiniband/hw/bnxt_re/qplib_sp.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b",
"status": "affected",
"version": "d8ea645d6984c84a87032063a0941f15a323831f",
"versionType": "git"
},
{
"lessThan": "2106c337905d7445d75818e36920b63f9211c584",
"status": "affected",
"version": "d8ea645d6984c84a87032063a0941f15a323831f",
"versionType": "git"
},
{
"lessThan": "a59d815cbe667929b693b5fa6716a074e6a31c5b",
"status": "affected",
"version": "d8ea645d6984c84a87032063a0941f15a323831f",
"versionType": "git"
},
{
"lessThan": "dc95931b7e1326dacae547874bf38c092e5960d8",
"status": "affected",
"version": "d8ea645d6984c84a87032063a0941f15a323831f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c",
"drivers/infiniband/hw/bnxt_re/qplib_sp.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Add a max slot check for SQ\n\nThe variable WQE mode must be validated against\nthe maximum slots supported by HW. The max supported\nvalue is 64K. Adding a max and min check and fail if user\nsupplied value is more than the max supported and zero."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only via local RDMA uverbs ioctl/write on /dev/infiniband/uverbs* (IB_USER_VERBS_CMD_CREATE_QP \u2192 bnxt_re_create_qp \u2192 bnxt_re_init_qp_attr); remote RoCE peers cannot supply the bnxt_re_qp_req.sq_slots field.\nAC:L - On bnxt_re hardware with variable WQE enabled, an attacker deterministically sets sq_slots to 0 or any value above 65536 in create_qp driver udata; no race, timing window, or uncontrollable memory layout is required beyond opening uverbs and issuing the ioctl.\nPR:L - Exploitation requires only local access to the world-accessible (mode 0666) uverbs character device to alloc a VAR_WQE ucontext and create a QP; no CAP_SYS_ADMIN, init-namespace root, or other elevated capability is needed on typical HPC/cloud RDMA hosts.\nUI:N - The attacker triggers the bug entirely through their own alloc_context/create_qp sequence with crafted sq_slots; no cooperative action by another user, administrator, or victim is required.\nS:C - On Kubernetes/HPC hosts that expose bnxt_re to unprivileged RDMA workloads or containers, corrupting host-kernel memory or NIC DMA state from a tenant create_qp escapes the workload security boundary to the hypervisor/host authority.\nC:H - Unvalidated sq_slots drives integer overflow in SQ/PSN byte sizing and can register undersized ib_umem while programming firmware with a far larger sq_size, enabling out-of-bounds DMA reads and kernel memory disclosure beyond the mapped queue buffer.\nI:H - Oversized sq_slots values program hardware queue depth beyond the registered user buffer and corrupt queue/PSN metadata sizing, yielding out-of-bounds writes and exploitable memory corruption rather than a benign error return.\nA:H - Invalid zero or \u003e64K slot counts can kernel-oops during QP setup (e.g., inconsistent HWQ/PSN allocation) and misprogrammed queue depths can panic or hang the host when the adapter accesses nonexistent queue memory."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:05.370Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b"
},
{
"url": "https://git.kernel.org/stable/c/2106c337905d7445d75818e36920b63f9211c584"
},
{
"url": "https://git.kernel.org/stable/c/a59d815cbe667929b693b5fa6716a074e6a31c5b"
},
{
"url": "https://git.kernel.org/stable/c/dc95931b7e1326dacae547874bf38c092e5960d8"
}
],
"title": "RDMA/bnxt_re: Add a max slot check for SQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72497",
"datePublished": "2026-08-15T05:57:30.386Z",
"dateReserved": "2026-08-09T03:40:39.937Z",
"dateUpdated": "2026-10-21T12:45:05.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93105 (GCVE-0-2026-93105)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
esp: do not unref managed frag pages in esp_ssg_unref()
esp_ssg_unref() releases the page references held on the source
scatterlist after the AEAD operation completes. It calls
skb_page_unref() on every frag page for an out-of-place transform
(req->src != req->dst), and in the error path of esp_output_tail()
(already_unref == true) on the request's own scatterlist.
This is wrong when the skb carries managed frags
(SKBFL_MANAGED_FRAG_REFS). Managed frags are owned by a zerocopy ubuf
and the skb does not hold a per-frag page reference; io_uring SEND_ZC
with a registered buffer attaches the bvec pages this way via
io_sg_from_iter(). The rest of the stack honours this invariant:
skb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS
is set, and skb_zcopy_managed() is the guard used at the other unref
sites.
esp_ssg_unref() is missing that guard, so for a managed-frag skb it
drops a page reference the skb never acquired. This can underflow the
page reference count and free a page that is still in use.
Guard the function with skb_zcopy_managed() so both unref paths are
skipped for managed-frag skbs, matching skb_release_data().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb375965800d474c0281a2e92c43c724fce9f463",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "201bdf10ae92e7cbd524adf8c0323e2a963d5fd7",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "3ec55f0c8a6a543cf660584d1346e11f6311ee59",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "1ad6456898f6e6cf58be83bdb607acb1119a9cd1",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "21697720ff43b8dfa25b8e8d9ca7f56f4597fc80",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nesp: do not unref managed frag pages in esp_ssg_unref()\n\nesp_ssg_unref() releases the page references held on the source\nscatterlist after the AEAD operation completes. It calls\nskb_page_unref() on every frag page for an out-of-place transform\n(req-\u003esrc != req-\u003edst), and in the error path of esp_output_tail()\n(already_unref == true) on the request\u0027s own scatterlist.\n\nThis is wrong when the skb carries managed frags\n(SKBFL_MANAGED_FRAG_REFS). Managed frags are owned by a zerocopy ubuf\nand the skb does not hold a per-frag page reference; io_uring SEND_ZC\nwith a registered buffer attaches the bvec pages this way via\nio_sg_from_iter(). The rest of the stack honours this invariant:\nskb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS\nis set, and skb_zcopy_managed() is the guard used at the other unref\nsites.\n\nesp_ssg_unref() is missing that guard, so for a managed-frag skb it\ndrops a page reference the skb never acquired. This can underflow the\npage reference count and free a page that is still in use.\n\nGuard the function with skb_zcopy_managed() so both unref paths are\nskipped for managed-frag skbs, matching skb_release_data()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The extra unref is reached from IORING_OP_SEND_ZC/SENDMSG_ZC with IORING_RECVSEND_FIXED_BUF: io_sendmsg_zc() -\u003e sock_sendmsg() -\u003e tcp_sendmsg_locked() -\u003e xfrm_output() -\u003e esp_output_tail() -\u003e esp_ssg_unref(). io_sg_from_iter() is the only site that sets SKBFL_MANAGED_FRAG_REFS; esp_input() never calls esp_ssg_unref(), so a remote ESP packet cannot supply the buggy skb.\nAC:L - tcp_stream_alloc_skb() allocates MAX_TCP_HEADER then skb_reserve()s all of it, so a SEND_ZC TCP skb has ~0 tailroom. esp_output_head() therefore takes inplace=false (tailen \u003e tailroom, nr_frags \u003c MAX_SKB_FRAGS, data_len+tailen \u003c= PAGE_SIZE), after which esp_output_tail() replaces the frags and esp_ssg_unref() always drops the managed pages. The attacker chooses the send size.\nPR:L - io_uring_setup() allows IORING_OP_SEND_ZC when sysctl_io_uring_disabled==0 (default); no capability is checked on that send path. An ESP SA is also required: the attacker can add one in a user+net namespace because xfrm_user_rcv_msg() only tests netlink_net_capable(CAP_NET_ADMIN) against the netns user_ns, or can send through an already-installed IPsec policy.\nUI:N - The attacker registers the buffer with IORING_REGISTER_BUFFERS, submits SEND_ZC, and if needed installs the XFRM state/policy; no other user must open a file, mount a volume, or otherwise act.\nS:U - esp_ssg_unref()\u0027s extra put_page() corrupts host kernel page refcounts. That is a conventional local privilege escalation inside the same kernel, not a KVM/Xen guest-to-host or IOMMU-scope change.\nC:H - After the out-of-place transform, esp_ssg_unref() calls skb_page_unref() on every source sg page past skb-\u003edata. Those pages were attached by io_sg_from_iter() without a per-frag get_page(), so the extra put underflows the refcount of still-mapped IORING_REGISTER_BUFFERS pages and frees memory the attacker can read.\nI:H - The same extra skb_page_unref() frees registered-buffer pages that remain in the io_uring bvec and the attacker\u0027s userspace mapping, so the page can be reallocated and overwritten, giving an arbitrary write and control-flow hijack.\nA:H - The extra put_page() on managed frag pages underflows the page refcount and frees a page still in use, which oopses with bad page state even when the use-after-free is not turned into a full memory-corruption exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:00.346Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb375965800d474c0281a2e92c43c724fce9f463"
},
{
"url": "https://git.kernel.org/stable/c/201bdf10ae92e7cbd524adf8c0323e2a963d5fd7"
},
{
"url": "https://git.kernel.org/stable/c/3ec55f0c8a6a543cf660584d1346e11f6311ee59"
},
{
"url": "https://git.kernel.org/stable/c/1ad6456898f6e6cf58be83bdb607acb1119a9cd1"
},
{
"url": "https://git.kernel.org/stable/c/26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf"
},
{
"url": "https://git.kernel.org/stable/c/21697720ff43b8dfa25b8e8d9ca7f56f4597fc80"
}
],
"title": "esp: do not unref managed frag pages in esp_ssg_unref()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93105",
"datePublished": "2026-09-17T16:11:16.442Z",
"dateReserved": "2026-09-17T16:02:15.085Z",
"dateUpdated": "2026-10-30T12:36:00.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92485 (GCVE-0-2026-92485)
Vulnerability from cvelistv5
Published
2026-09-17 16:10
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix WARNING in bpf_tracing_link_release
The trampoline could be corrupted by the blindly
'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.
1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became
'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the
trampoline would poke the target prog's nop insn using jmp insn instead
of call insn.
2. Another fexit loaded with the same tail_call_reachable prog target.
'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'.
3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in
'tr->flags', the trampoline will fail to restore the prog's nop insn
using call insn.
[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98
...
[ 3.428793] bpf_link_free+0x58/0x130
[ 3.429293] bpf_link_release+0x23/0x30
Fix the warning by updating 'tr->flags' with '|=' and lock.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 605c8d8f9966fcd2f0b858fabebe416fc83f2209 Version: 8f873cc3f67f2257493063e57d0caf07ef889ee9 Version: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 Version: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 Version: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 Version: 2b5dcb31a19a2e0acd869b12c9db9b2d696ef544 Version: 028480eaf2a1401e914a1fa1a4a21d877cf0ae30 Version: 6.1.72 ≤ Version: 6.6.2 ≤ Version: 6.5.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h",
"kernel/bpf/trampoline.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1757598b3804f7cb35b5b5e02558f6d8b9c2f254",
"status": "affected",
"version": "605c8d8f9966fcd2f0b858fabebe416fc83f2209",
"versionType": "git"
},
{
"lessThan": "a5c6316052f0ff1467221ecf2996cbab0a496b1e",
"status": "affected",
"version": "8f873cc3f67f2257493063e57d0caf07ef889ee9",
"versionType": "git"
},
{
"lessThan": "d02035c5eb4955616efc5c6dbe3d98f19d798cb2",
"status": "affected",
"version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
"versionType": "git"
},
{
"lessThan": "094f0a895cf97a993d06d5dc4c12e7cb7da845a5",
"status": "affected",
"version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
"versionType": "git"
},
{
"lessThan": "48a0209d8da0d90a7b0a0db19d1ff88027b13781",
"status": "affected",
"version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
"versionType": "git"
},
{
"lessThan": "61aaa8782bec59ecffd22e030f54ef9351bcabf9",
"status": "affected",
"version": "2b5dcb31a19a2e0acd869b12c9db9b2d696ef544",
"versionType": "git"
},
{
"status": "affected",
"version": "028480eaf2a1401e914a1fa1a4a21d877cf0ae30",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.72",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.2",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h",
"kernel/bpf/trampoline.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARNING in bpf_tracing_link_release\n\nThe trampoline could be corrupted by the blindly\n\u0027tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX\u0027 in verifier.\n\n1. A fexit attached to a tail_call_reachable prog. \u0027tr-\u003eflags\u0027 became\n \u0027BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX\u0027. And, the\n trampoline would poke the target prog\u0027s nop insn using jmp insn instead\n of call insn.\n2. Another fexit loaded with the same tail_call_reachable prog target.\n \u0027tr-\u003eflags\u0027 became \u0027BPF_TRAMP_F_TAIL_CALL_CTX\u0027.\n3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in\n \u0027tr-\u003eflags\u0027, the trampoline will fail to restore the prog\u0027s nop insn\n using call insn.\n\n[ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98\n...\n[ 3.428793] bpf_link_free+0x58/0x130\n[ 3.429293] bpf_link_release+0x23/0x30\n\nFix the warning by updating \u0027tr-\u003eflags\u0027 with \u0027|=\u0027 and lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is local bpf() only: BPF_PROG_LOAD of a tail_call_reachable target plus two BPF_TRACE_FEXIT programs (check_attach_btf_id overwrites tr-\u003eflags), BPF_LINK_CREATE via bpf_tracing_prog_attach, then close() of the first link into bpf_tracing_link_release. No remote protocol carries the malformed state.\nAC:L - After the first fexit attach, bpf_trampoline_update sets BPF_TRAMP_F_CALL_ORIG and bpf_arch_text_poke installs a JMP (bpf_trampoline_use_jmp). A second BPF_PROG_LOAD then does tr-\u003eflags = BPF_TRAMP_F_TAIL_CALL_CTX in check_attach_btf_id; closing the first link hits the JMP-vs-CALL mismatch. The attacker owns both loads and the close; CONFIG_DYNAMIC_FTRACE_WITH_JMP is def_bool y on x86_64.\nPR:L - bpf_prog_load() of BPF_PROG_TYPE_TRACING/BPF_TRACE_FEXIT requires CAP_BPF and, via is_perfmon_prog_type(), CAP_PERFMON; bpf_token_capable() with a delegated BPF token grants those into a non-init user namespace, so this is not init-namespace root.\nUI:N - The attacker loads both fexit programs, attaches the first with BPF_LINK_CREATE/bpf_tracing_prog_attach, and closes that link fd themselves; no victim mount, open, or other action is required.\nS:U - The leftover JMP in the target program and the use-after-free of fexit1\u0027s JIT image stay inside host kernel BPF trampoline code; they do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Failed bpf_trampoline_unlink_prog() leaves the target\u0027s 5-byte slot as a JMP into the trampoline image that still calls fexit1-\u003ebpf_func, while bpf_link_free()\u2192bpf_link_dealloc() immediately bpf_prog_put()s fexit1 (no dealloc_deferred). After bpf_jit_free(), later target invocations read that freed executable image.\nI:H - The same dangling trampoline CALL into fexit1\u0027s freed JIT pages is an executable use-after-free; the attacker controls the fexit program and can spray replacement JIT text at that address, hijacking kernel control flow when the target program runs.\nA:H - bpf_tracing_link_release() WARN_ON_ONCE()s the failed bpf_trampoline_unlink_prog() after bpf_arch_text_poke() rejects the JMP-vs-CALL restore. Running the target afterward jumps to the trampoline and calls the freed fexit JIT, causing a kernel paging fault/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:38.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1757598b3804f7cb35b5b5e02558f6d8b9c2f254"
},
{
"url": "https://git.kernel.org/stable/c/a5c6316052f0ff1467221ecf2996cbab0a496b1e"
},
{
"url": "https://git.kernel.org/stable/c/d02035c5eb4955616efc5c6dbe3d98f19d798cb2"
},
{
"url": "https://git.kernel.org/stable/c/094f0a895cf97a993d06d5dc4c12e7cb7da845a5"
},
{
"url": "https://git.kernel.org/stable/c/48a0209d8da0d90a7b0a0db19d1ff88027b13781"
},
{
"url": "https://git.kernel.org/stable/c/61aaa8782bec59ecffd22e030f54ef9351bcabf9"
}
],
"title": "bpf: Fix WARNING in bpf_tracing_link_release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-92485",
"datePublished": "2026-09-17T16:10:00.999Z",
"dateReserved": "2026-09-16T12:21:13.870Z",
"dateUpdated": "2026-10-30T12:35:38.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93221 (GCVE-0-2026-93221)
Vulnerability from cvelistv5
Published
2026-09-24 15:10
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: convert nfsd_net boolean flags to unsigned long flags word
nfsd_net contains several boolean fields that are accessed from
concurrent contexts without serialization. In particular,
nfsd4_end_grace() guards its drain path with a plain bool:
if (nn->grace_ended)
return;
nn->grace_ended = true;
The read and the write are independent, and nothing in struct
nfsd_net serializes them. At least two contexts can reach this
code with no lock held:
laundromat path
laundry_wq kworker
nfs4_laundromat()
nfsd4_end_grace()
RECLAIM_COMPLETE path
nfsd compound kthread
nfsd4_reclaim_complete()
inc_reclaim_complete()
nfsd4_end_grace()
Both callers can observe grace_ended == false on different CPUs,
both store true, and both proceed into nfsd4_record_grace_done(),
which invokes the active client_tracking_ops->grace_done callback.
For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops
via nfsd4_recdir_purge_old, and the cld v1+ ops via
nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),
which walks every bucket of reclaim_str_hashtbl with no lock and
calls nfs4_remove_reclaim_record() (list_del + kfree) on each
entry. Two concurrent walkers corrupt the list and double-free
every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client()
iterating the same bucket reads through freed memory.
A third call site exists in nfs4_state_start_net() on the
skip_grace startup path, but it runs under nfsd_mutex before any
client has connected and before the laundromat's first delayed
work fires, so it cannot race with the two callers above.
Replace the scattered boolean fields in nfsd_net with a single
unsigned long flags word and an enum nfsd_net_flag for the bit
positions. The grace_ended race is fixed by using
test_and_set_bit(), which is atomic on all architectures. The
remaining flags (grace_end_forced, in_grace, somebody_reclaimed,
track_reclaim_completes, nfsd_net_up, lockd_up) are converted to
use test_bit/set_bit/clear_bit for consistency. This avoids
sub-word cmpxchg issues on architectures like Hexagon that only
support word-sized atomic operations.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/netns.h",
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4recover.c",
"fs/nfsd/nfs4state.c",
"fs/nfsd/nfsctl.c",
"fs/nfsd/nfssvc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94b450977c60261903c945419d2df4a464de60c4",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
},
{
"lessThan": "faac245ca739b66e96fb7bb43e21df537239a4e5",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
},
{
"lessThan": "40bab0da844c142431a6b1cc21b4cf53491dac44",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
},
{
"lessThan": "df5922fe09a8131c793ffa86adf204999b0470f8",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
},
{
"lessThan": "11a5fe42e1811f793e04ef885b639ea7668f439d",
"status": "affected",
"version": "362063a595be959bc08f4163e6405a0266740091",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/netns.h",
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4recover.c",
"fs/nfsd/nfs4state.c",
"fs/nfsd/nfsctl.c",
"fs/nfsd/nfssvc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization. In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n if (nn-\u003egrace_ended)\n return;\n nn-\u003egrace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them. At least two contexts can reach this\ncode with no lock held:\n\n laundromat path\n laundry_wq kworker\n nfs4_laundromat()\n nfsd4_end_grace()\n\n RECLAIM_COMPLETE path\n nfsd compound kthread\n nfsd4_reclaim_complete()\n inc_reclaim_complete()\n nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops-\u003egrace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry. Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat\u0027s first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions. The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures. The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency. This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd4_end_grace() is reached from a remote NFSv4.1 RECLAIM_COMPLETE: svc_recv to nfsd_dispatch to nfsd4_proc_compound to nfsd4_sequence (sets cstate-\u003eclp) to nfsd4_reclaim_complete to inc_reclaim_complete to nfsd4_end_grace on TCP/2049. That RECLAIM_COMPLETE compound is the attacker-supplied protocol message.\nAC:H - The other nfsd4_end_grace() caller is nfs4_laundromat() on laundry_wq, queued in nfs4_state_start_net() for nn-\u003enfsd4_grace seconds. A peer cannot start that work (nfsd4_force_end_grace is only write_v4_end_grace). Both must see grace_ended==false, which needs an already-running grace with a non-empty reclaim_str_hashtbl the attacker cannot create on demand.\nPR:N - Typical nfsd exports accept AUTH_SYS, so the client only asserts a uid. nfsd4_exchange_id() with SP4_NONE and nfsd4_create_session() are ALLOWED_AS_FIRST_OP without a filehandle, and OP_RECLAIM_COMPLETE is ALLOWED_WITHOUT_FH, so no fh_verify, share access, or Kerberos is required.\nUI:N - The attacker sends EXCHANGE_ID, CREATE_SESSION, SEQUENCE, and RECLAIM_COMPLETE on their own session. No write to v4_end_grace, mount, or other victim action is required.\nS:U - Concurrent nfs4_release_reclaim() list_del/kfree of nfs4_client_reclaim entries corrupts heap inside the host nfsd kernel. That stays in the same kernel security authority and is not a VM, IOMMU, or sandbox escape.\nC:H - When two nfsd4_end_grace() callers both run nfsd4_record_grace_done() (nfsd4_cld_grace_done or nfsd4_recdir_purge_old), nfs4_release_reclaim() double-frees every nfs4_client_reclaim while nfsd4_find_reclaim_client() walks the same unlocked cr_strhash bucket through freed objects, a UAF read primitive.\nI:H - nfs4_remove_reclaim_record() does unlocked list_del(\u0026crp-\u003ecr_strhash) then kfree on each nfs4_client_reclaim. Two concurrent walkers corrupt adjacent list pointers (unlink write) and double-free the slab objects, which is an arbitrary kernel write.\nA:H - The same unlocked list_del/kfree in nfs4_release_reclaim(), or nfsd4_find_reclaim_client() following a freed cr_strhash, oopses the host kernel (poisoned list pointers or double-free of nfs4_client_reclaim), a full availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:22.888Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94b450977c60261903c945419d2df4a464de60c4"
},
{
"url": "https://git.kernel.org/stable/c/faac245ca739b66e96fb7bb43e21df537239a4e5"
},
{
"url": "https://git.kernel.org/stable/c/40bab0da844c142431a6b1cc21b4cf53491dac44"
},
{
"url": "https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8"
},
{
"url": "https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d"
}
],
"title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93221",
"datePublished": "2026-09-24T15:10:44.598Z",
"dateReserved": "2026-09-17T16:02:15.094Z",
"dateUpdated": "2026-10-21T12:52:22.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99103 (GCVE-0-2026-99103)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix unbound pool lifetime for pending pwqs
KASAN reports a use-after-free of an unbound worker_pool in
node_activate_pending_pwq():
BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120
Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318
CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: 0x0 (flush-8:0)
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x610
kasan_report+0xce/0x100
_raw_spin_trylock+0x6d/0x120
pwq_dec_nr_in_flight+0x4b4/0xcb0
process_one_work+0x921/0x11a0
worker_thread+0x4d0/0xd20
kthread+0x2de/0x3c0
ret_from_fork+0x3aa/0x620
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 311:
alloc_pwq+0x439/0xca0
apply_wqattrs_prepare+0x75e/0xd10
apply_workqueue_attrs_locked+0x44/0xa0
wq_nice_store+0x350/0x450
Freed by task 0:
kfree+0x127/0x3b0
rcu_core+0x523/0x1780
handle_softirqs+0x1b3/0x610
Last potentially related work creation:
put_unbound_pool+0x3f3/0x7d0
pwq_release_workfn+0x494/0x8e0
kthread_worker_fn+0x1ff/0x790
Canceling the last inactive work skips pwq_dec_nr_active(), so an empty
pwq can remain on pending_pwqs when its refcnt reaches zero.
pwq_release_workfn() currently puts the pool before removing that pwq.
If this drops the last pool reference, the pool can be RCU-freed while
the pwq remains reachable, and node_activate_pending_pwq() may trylock
the freed pool->lock.
Remove the pwq from pending_pwqs before putting the pool.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5a70baec2294e8a7d0fcc4558741c23e752dad5c Version: 843288afd3cc6f3342659c6cf81fc47684d25563 Version: 5797b1c18919cd9c289ded7954383e499f729ce0 Version: 5797b1c18919cd9c289ded7954383e499f729ce0 Version: 5797b1c18919cd9c289ded7954383e499f729ce0 Version: 5797b1c18919cd9c289ded7954383e499f729ce0 Version: fc67aebe34f22632ccb22faea48cc4d3134620a2 Version: 6.6.23 ≤ Version: 6.8.2 ≤ Version: 6.7.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/workqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6741dd3fd38e47c08bc39d11ef5fa141fa6d0441",
"status": "affected",
"version": "5a70baec2294e8a7d0fcc4558741c23e752dad5c",
"versionType": "git"
},
{
"lessThan": "9f5d5aef3072a33c6f9bfb954bb0cba1c2541849",
"status": "affected",
"version": "843288afd3cc6f3342659c6cf81fc47684d25563",
"versionType": "git"
},
{
"lessThan": "390b9542fe670b8936738140ef9f349df6adeab6",
"status": "affected",
"version": "5797b1c18919cd9c289ded7954383e499f729ce0",
"versionType": "git"
},
{
"lessThan": "f320b85c90fe5fc9d4d06badd450518323a94a7f",
"status": "affected",
"version": "5797b1c18919cd9c289ded7954383e499f729ce0",
"versionType": "git"
},
{
"lessThan": "3d2ef2b9f4c084ab498494d26495a82f7e15407b",
"status": "affected",
"version": "5797b1c18919cd9c289ded7954383e499f729ce0",
"versionType": "git"
},
{
"lessThan": "cf9c8aaea0d47410df8708bec195889f3a85cd3c",
"status": "affected",
"version": "5797b1c18919cd9c289ded7954383e499f729ce0",
"versionType": "git"
},
{
"status": "affected",
"version": "fc67aebe34f22632ccb22faea48cc4d3134620a2",
"versionType": "git"
},
{
"lessThan": "6.6.25",
"status": "affected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThan": "6.8.4",
"status": "affected",
"version": "6.8.2",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/workqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.25",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.25",
"versionStartIncluding": "6.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.4",
"versionStartIncluding": "6.8.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix unbound pool lifetime for pending pwqs\n\nKASAN reports a use-after-free of an unbound worker_pool in\nnode_activate_pending_pwq():\n\n BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120\n Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318\n\n CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Workqueue: 0x0 (flush-8:0)\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x610\n kasan_report+0xce/0x100\n _raw_spin_trylock+0x6d/0x120\n pwq_dec_nr_in_flight+0x4b4/0xcb0\n process_one_work+0x921/0x11a0\n worker_thread+0x4d0/0xd20\n kthread+0x2de/0x3c0\n ret_from_fork+0x3aa/0x620\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n Allocated by task 311:\n alloc_pwq+0x439/0xca0\n apply_wqattrs_prepare+0x75e/0xd10\n apply_workqueue_attrs_locked+0x44/0xa0\n wq_nice_store+0x350/0x450\n\n Freed by task 0:\n kfree+0x127/0x3b0\n rcu_core+0x523/0x1780\n handle_softirqs+0x1b3/0x610\n\n Last potentially related work creation:\n put_unbound_pool+0x3f3/0x7d0\n pwq_release_workfn+0x494/0x8e0\n kthread_worker_fn+0x1ff/0x790\n\nCanceling the last inactive work skips pwq_dec_nr_active(), so an empty\npwq can remain on pending_pwqs when its refcnt reaches zero.\npwq_release_workfn() currently puts the pool before removing that pwq.\nIf this drops the last pool reference, the pool can be RCU-freed while\nthe pwq remains reachable, and node_activate_pending_pwq() may trylock\nthe freed pool-\u003elock.\n\nRemove the pwq from pending_pwqs before putting the pool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:45.076Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441"
},
{
"url": "https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849"
},
{
"url": "https://git.kernel.org/stable/c/390b9542fe670b8936738140ef9f349df6adeab6"
},
{
"url": "https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f"
},
{
"url": "https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b"
},
{
"url": "https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c"
}
],
"title": "workqueue: Fix unbound pool lifetime for pending pwqs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99103",
"datePublished": "2026-10-28T10:34:22.945Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-30T12:41:45.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99213 (GCVE-0-2026-99213)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-31 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock: treat TCP_CLOSING as once-established
Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can
race with the connect loop. Immediately break and return 0 on
ESTABLISHED/CLOSING. The return value of connect() should reflect what
happened up to the point the connection was established or failed. Events
that occur afterwards must not affect it. E.g. even if OP_RW has already
set sk_err, connect() should still return 0, not ENOBUFS because of it.
Adapt the inaccurate comment above signal_pending().
Resetting a socket that is still present in connected_table can lead to
memory corruption. The reporter noted lost transports for in-flight skbs,
and I have reproduced crashes caused by re-insertion into connected_table.
list_add double add: new=, prev=, next=.
kernel BUG at lib/list_debug.c:35!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
Workqueue: vsock-loopback vsock_loopback_work
RIP: 0010:__list_add_valid_or_report+0x11f/0x130
Call Trace:
vsock_insert_connected.cold+0xe/0x13
virtio_transport_recv_pkt+0x10e9/0x1460
vsock_loopback_work+0x305/0x480
process_one_work+0xe4c/0x1560
worker_thread+0x4f1/0xd60
kthread+0x36e/0x470
ret_from_fork+0x47b/0x6b0
ret_from_fork_asm+0x1a/0x30
This fix is supplementary to commit 002541ef650b ("vsock: Ignore
signal/timeout on connect() if already established"). Details under Link.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/af_vsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea36ef3c229d54b552432d1290aee1d807f67fd5",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "5f2ab77028602a22f0cc33cac063a313787cbeae",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "f89770c7365748d9d6a2ae07d1c23497ca21ec07",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "deb972c7eea8d0bc3109c35c30a1c86d4939f811",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "baf1b5715640e434249ce7f63f94bd1a00938ef9",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "c2c5359ef2c33684fa3f3652fd761a483db8d1e7",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "44d1ca05d6094a5d75c671a0545249186d790b8d",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "4f6ac74fa594a918d41255c941256e1d51592d3b",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/af_vsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -\u003e TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_table can lead to\nmemory corruption. The reporter noted lost transports for in-flight skbs,\nand I have reproduced crashes caused by re-insertion into connected_table.\n\n list_add double add: new=, prev=, next=.\n kernel BUG at lib/list_debug.c:35!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n Workqueue: vsock-loopback vsock_loopback_work\n RIP: 0010:__list_add_valid_or_report+0x11f/0x130\n Call Trace:\n vsock_insert_connected.cold+0xe/0x13\n virtio_transport_recv_pkt+0x10e9/0x1460\n vsock_loopback_work+0x305/0x480\n process_one_work+0xe4c/0x1560\n worker_thread+0x4f1/0xd60\n kthread+0x36e/0x470\n ret_from_fork+0x47b/0x6b0\n ret_from_fork_asm+0x1a/0x30\n\nThis fix is supplementary to commit 002541ef650b (\"vsock: Ignore\nsignal/timeout on connect() if already established\"). Details under Link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local connect() on AF_VSOCK reaches the patched vsock_connect() through connect_socket() and vsock_stream_ops.connect; VMADDR_CID_LOCAL drives the response and reset through vsock_loopback_work(), not a routable network protocol.\nAC:L - The same attacker can operate both VMADDR_CID_LOCAL endpoints, deliver signals while connect() races with RESPONSE/RST processing, and retry connect() until the controlled window is hit.\nPR:L - vsock_create() and vsock_connect() impose no capability check, and vsock_auto_bind() selects an unreserved port; CAP_NET_BIND_SERVICE is checked only for an explicit port at or below LAST_RESERVED_PORT.\nUI:N - The attacker\u0027s own threads perform socket creation, connect, peer reset, signal delivery, and reconnection without any action by another user.\nS:U - The corrupted connected_table and transport state belong to the same kernel reached by the local AF_VSOCK caller; this path does not cross a guest-host, IOMMU, or other security authority boundary.\nC:H - A transport-changing reconnect reaches vsock_deassign_transport() and virtio_transport_destruct(), freeing vsk-\u003etrans while virtio_transport_consume_skb_sent() can retain and dereference it for an in-flight skb; this heap use-after-free can expose reclaimed kernel contents.\nI:H - A same-transport reconnect passes the already-linked connected_table node to vsock_insert_connected() and list_add(), while the transport-change path can modify a freed virtio_vsock_sock through bytes_unsent; these corruptions support heap grooming and control-flow hijacking.\nA:H - The demonstrated re-insertion reaches __list_add_valid_or_report() and its list_add double-add BUG, producing a kernel Oops from vsock_loopback_work(); the attacker can repeat the connection sequence."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:45:10.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea36ef3c229d54b552432d1290aee1d807f67fd5"
},
{
"url": "https://git.kernel.org/stable/c/5f2ab77028602a22f0cc33cac063a313787cbeae"
},
{
"url": "https://git.kernel.org/stable/c/f89770c7365748d9d6a2ae07d1c23497ca21ec07"
},
{
"url": "https://git.kernel.org/stable/c/deb972c7eea8d0bc3109c35c30a1c86d4939f811"
},
{
"url": "https://git.kernel.org/stable/c/baf1b5715640e434249ce7f63f94bd1a00938ef9"
},
{
"url": "https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7"
},
{
"url": "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d"
},
{
"url": "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"
}
],
"title": "vsock: treat TCP_CLOSING as once-established",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99213",
"datePublished": "2026-10-28T10:36:06.441Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-31T12:45:10.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90408 (GCVE-0-2026-90408)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.
Compile tested only.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4aec20f3a84634171c139ab2e02bb2e5a5c756b",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "24f7cdabea9f7ab95dbd6d8bc9ac6ec48d96a7e5",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "23bed4ef132c55c9016f0c6122c8b8ba2efa2353",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "bf97c9d5123859a07848462539153176db029f3a",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "878654eb78c6aa0ff585baf1376567c775ca28ec",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Firmware supplies the malformed bytes in WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID (num_vdevs and the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT TLV length) on CE2 \u2192 ath12k_ce_recv_process_cb \u2192 ath12k_htc_rx_completion_handler \u2192 ath12k_wmi_op_rx; 802.11 CSA IEs do not carry those fields, so this is the host-firmware HTC path, not an over-the-air frame parse.\nAC:L - Pre-fix ath12k_wmi_tlv_policies had no min_len for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, and ath12k_wmi_process_csa_switch_count_event() used firmware le32 num_vdevs as the vdev_ids[] loop bound with no TLV-length check, so a short event TLV or oversized num_vdevs overreads on every such event with no race.\nPR:N - ath12k_wmi_op_rx() dispatches WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID from the WMI HTC endpoint (ath12k_connect_pdev_htc_service) with no host uid, capability, or authentication check; the Wi-Fi firmware is the sole source of the event.\nUI:N - ath12k_wmi_process_csa_switch_count_event() reads vdev_ids[i] in the num_vdevs loop before the conf-\u003ecsa_active continue, so a crafted CSA-count WMI event overreads even when the victim never started a channel switch; no mount or other user action is required.\nS:U - The vdev_ids[] overread and any oops remain inside the host kernel ath12k/mac80211 authority; the bug does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Firmware-chosen num_vdevs is an unbounded u32 loop over the WMI_TAG_ARRAY_UINT32 vdev_ids payload (policy min_len 0), so the handler can read far past the CE WMI skb (~2KB); unknown vdev_ids[i] values are also printed by ath12k_warn(), which is an unbounded kernel overread, not a few bytes.\nI:N - The loop only loads vdev_ids[i] and looks them up with ath12k_mac_get_arvif_by_vdev_id(); it does not write out of bounds, and ieee80211_csa_finish() runs only for an already-valid in-CSA arvif rather than as a write primitive from the overread.\nA:H - A huge num_vdevs walks vdev_ids[] off the WMI skb while holding rcu_read_lock(), which can oops/panic on unmapped or KASAN-redzoned heap past the CE buffer and can stall RCU for a 32-bit iteration count, a full kernel availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:31.378Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4aec20f3a84634171c139ab2e02bb2e5a5c756b"
},
{
"url": "https://git.kernel.org/stable/c/24f7cdabea9f7ab95dbd6d8bc9ac6ec48d96a7e5"
},
{
"url": "https://git.kernel.org/stable/c/23bed4ef132c55c9016f0c6122c8b8ba2efa2353"
},
{
"url": "https://git.kernel.org/stable/c/bf97c9d5123859a07848462539153176db029f3a"
},
{
"url": "https://git.kernel.org/stable/c/878654eb78c6aa0ff585baf1376567c775ca28ec"
}
],
"title": "wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90408",
"datePublished": "2026-09-17T16:09:36.089Z",
"dateReserved": "2026-09-11T19:38:34.812Z",
"dateUpdated": "2026-10-21T12:51:31.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99169 (GCVE-0-2026-99169)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM.
It is possible for a process to wait on a shared futex with a different MM
because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED
futex by another process.
This can cause FUT_OFF_MMSHARED waiters on a freed MM to consume
wakeups intended for a newly allocated MM at the same address.
Fix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID.
Leave private futexes as before to avoid influencing the performance of the
hotpath.
(Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by
setting clear_child_tid such that it points into anonymous memory, which
causes mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d Version: 222993395ed38f3751287f4bd82ef46b3eb3a66d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/futex.h",
"include/linux/futex_types.h",
"kernel/futex/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "096b5d4b80d19b1f7bf8e63fae0d0a32dbb6e1a2",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "a7aa4ce1b56a688fe4da75430ec7bf9fe3311807",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "f470b76584b5e32d9f9436ef78fb899914116d75",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "0c133ed51700036796318f038dde813976bf1227",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "16cc0fee39dffd9994b7bea676a886ed52206754",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "2855ddc6844f527e375e78afb55ec2a5182f23b3",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
},
{
"lessThan": "3267512ad1c2cc0c7768c5b014dc2cceb398a801",
"status": "affected",
"version": "222993395ed38f3751287f4bd82ef46b3eb3a66d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/futex.h",
"include/linux/futex_types.h",
"kernel/futex/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix mm reuse handling for FUT_OFF_MMSHARED\n\nA FUT_OFF_MMSHARED futex is a shared futex that refers to an MM.\nIt is possible for a process to wait on a shared futex with a different MM\nbecause a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED\nfutex by another process.\nThis can cause FUT_OFF_MMSHARED waiters on a freed MM to consume\nwakeups intended for a newly allocated MM at the same address.\n\nFix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID.\nLeave private futexes as before to avoid influencing the performance of the\nhotpath.\n\n(Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by\nsetting clear_child_tid such that it points into anonymous memory, which\ncauses mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:34.724Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/096b5d4b80d19b1f7bf8e63fae0d0a32dbb6e1a2"
},
{
"url": "https://git.kernel.org/stable/c/a7aa4ce1b56a688fe4da75430ec7bf9fe3311807"
},
{
"url": "https://git.kernel.org/stable/c/f470b76584b5e32d9f9436ef78fb899914116d75"
},
{
"url": "https://git.kernel.org/stable/c/0c133ed51700036796318f038dde813976bf1227"
},
{
"url": "https://git.kernel.org/stable/c/16cc0fee39dffd9994b7bea676a886ed52206754"
},
{
"url": "https://git.kernel.org/stable/c/c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81"
},
{
"url": "https://git.kernel.org/stable/c/2855ddc6844f527e375e78afb55ec2a5182f23b3"
},
{
"url": "https://git.kernel.org/stable/c/3267512ad1c2cc0c7768c5b014dc2cceb398a801"
}
],
"title": "futex: Fix mm reuse handling for FUT_OFF_MMSHARED",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99169",
"datePublished": "2026-10-28T10:35:20.170Z",
"dateReserved": "2026-09-25T10:25:14.398Z",
"dateUpdated": "2026-10-30T12:42:34.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90232 (GCVE-0-2026-90232)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
amt: Don't support cross-netns setup.
When a lower device is unregistered, amt_device_event() tries
to unregister its upper AMT device, but it has two problems.
1. amt_lookup_upper_dev() looks up an upper device in the
lower device's netns only
2. amt_device_event() unregisters a single upper device only
If AMT device is created on a lower device in another netns,
removing the lower device triggers the splat below and gets
stuck until all upper devices are removed. [0]
The cross-netns setup seems unintentional considering 1. and
the following points:
* amt_link_setup() sets dev->netns_immutable to true
* skb_scrub_packet() is not called in the fast path
* iproute2 binary fails to find cross-netns lower device via
link-netns:
# ip -n ns1 link add amt0 link-netns ns2 type amt dev veth1
Cannot find device "veth1"
Instead of supporting it properly and preparing for per-netns
netdev unreg, let's forbid cross-netns setup.
Note that the problem 2. needs a separate fix.
[0]:
WARNING: net/core/dev.c:12518 at unregister_netdevice_many_notify+0x1cce/0x2250, CPU#48: ip/2031
Modules linked in:
CPU: 48 UID: 0 PID: 2031 Comm: ip Not tainted 7.2.0-rc5+ #27 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
RIP: 0010:unregister_netdevice_many_notify (net/core/dev.c:12518)
Code: 89 ef e8 d5 52 ae fe e9 d0 f4 ff ff 48 8d 3d f9 3b 9c 02 48 c7 c6 c0 0b 63 84 ba ab 1f 00 00 67 48 0f b9 3a e9 65 ff ff ff 90 <0f> 0b 90 eb 81 48 8d 3d f6 3b 9c 02 48 c7 c6 c0 0b 63 84 ba e2 1f
RSP: 0018:ffffc90004abf160 EFLAGS: 00010212
RAX: ffff888104d38260 RBX: ffff88800b0911b8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff85b9f880
RBP: ffffc90004abf2d0 R08: ffffffff85b9f887 R09: 1ffffffff0b73f10
R10: dffffc0000000000 R11: fffffbfff0b73f11 R12: ffff88800b091d08
R13: ffff88800b091178 R14: dffffc0000000000 R15: ffff88800b091000
FS: 00007f555b86c600(0000) GS:ffff8881942a0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562107d489c0 CR3: 0000000109a40002 CR4: 0000000000372ef0
Call Trace:
<TASK>
rtnl_dellink (net/core/rtnetlink.c:3632 net/core/rtnetlink.c:3674)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7112)
netlink_rcv_skb (net/netlink/af_netlink.c:2556)
netlink_unicast (net/netlink/af_netlink.c:1319)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
____sys_sendmsg (net/socket.c:775)
__sys_sendmsg (net/socket.c:2738)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
...
unregister_netdevice: waiting for veth0 to become free. Usage count = 7
ref_tracker: netdev@ffff88800d7496d8 has 3/3 users at
__netdev_adjacent_dev_insert (./include/linux/netdevice.h:4525 ./include/linux/netdevice.h:4554 net/core/dev.c:8791)
__netdev_upper_dev_link (net/core/dev.c:8879 net/core/dev.c:8963)
netdev_upper_dev_link (net/core/dev.c:9009)
amt_newlink (drivers/net/amt.c:3321)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b9022b53adad88fd6cf2b9718c9e498504f3e1dd Version: b9022b53adad88fd6cf2b9718c9e498504f3e1dd Version: b9022b53adad88fd6cf2b9718c9e498504f3e1dd Version: b9022b53adad88fd6cf2b9718c9e498504f3e1dd Version: b9022b53adad88fd6cf2b9718c9e498504f3e1dd Version: b9022b53adad88fd6cf2b9718c9e498504f3e1dd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/amt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a5a578d2e13d2dd6c1b272be7cfa0a6dd64552c",
"status": "affected",
"version": "b9022b53adad88fd6cf2b9718c9e498504f3e1dd",
"versionType": "git"
},
{
"lessThan": "a457ff1189f22c2f15f69df55dc910b8b6d7a77d",
"status": "affected",
"version": "b9022b53adad88fd6cf2b9718c9e498504f3e1dd",
"versionType": "git"
},
{
"lessThan": "5ebaad6cf2a639afbf0b265f9a7d1fb6f656a37e",
"status": "affected",
"version": "b9022b53adad88fd6cf2b9718c9e498504f3e1dd",
"versionType": "git"
},
{
"lessThan": "569eb11f0990849ba48706a2bfa743273707e254",
"status": "affected",
"version": "b9022b53adad88fd6cf2b9718c9e498504f3e1dd",
"versionType": "git"
},
{
"lessThan": "e1dc0af719a2566ae7ccb82c0a11f70aa54908e9",
"status": "affected",
"version": "b9022b53adad88fd6cf2b9718c9e498504f3e1dd",
"versionType": "git"
},
{
"lessThan": "e99ecc3046ea5f5c6b5e1f8b4ef854c6c6998e06",
"status": "affected",
"version": "b9022b53adad88fd6cf2b9718c9e498504f3e1dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/amt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: Don\u0027t support cross-netns setup.\n\nWhen a lower device is unregistered, amt_device_event() tries\nto unregister its upper AMT device, but it has two problems.\n\n 1. amt_lookup_upper_dev() looks up an upper device in the\n lower device\u0027s netns only\n\n 2. amt_device_event() unregisters a single upper device only\n\nIf AMT device is created on a lower device in another netns,\nremoving the lower device triggers the splat below and gets\nstuck until all upper devices are removed. [0]\n\nThe cross-netns setup seems unintentional considering 1. and\nthe following points:\n\n * amt_link_setup() sets dev-\u003enetns_immutable to true\n * skb_scrub_packet() is not called in the fast path\n * iproute2 binary fails to find cross-netns lower device via\n link-netns:\n # ip -n ns1 link add amt0 link-netns ns2 type amt dev veth1\n Cannot find device \"veth1\"\n\nInstead of supporting it properly and preparing for per-netns\nnetdev unreg, let\u0027s forbid cross-netns setup.\n\nNote that the problem 2. needs a separate fix.\n\n[0]:\nWARNING: net/core/dev.c:12518 at unregister_netdevice_many_notify+0x1cce/0x2250, CPU#48: ip/2031\nModules linked in:\nCPU: 48 UID: 0 PID: 2031 Comm: ip Not tainted 7.2.0-rc5+ #27 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nRIP: 0010:unregister_netdevice_many_notify (net/core/dev.c:12518)\nCode: 89 ef e8 d5 52 ae fe e9 d0 f4 ff ff 48 8d 3d f9 3b 9c 02 48 c7 c6 c0 0b 63 84 ba ab 1f 00 00 67 48 0f b9 3a e9 65 ff ff ff 90 \u003c0f\u003e 0b 90 eb 81 48 8d 3d f6 3b 9c 02 48 c7 c6 c0 0b 63 84 ba e2 1f\nRSP: 0018:ffffc90004abf160 EFLAGS: 00010212\nRAX: ffff888104d38260 RBX: ffff88800b0911b8 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff85b9f880\nRBP: ffffc90004abf2d0 R08: ffffffff85b9f887 R09: 1ffffffff0b73f10\nR10: dffffc0000000000 R11: fffffbfff0b73f11 R12: ffff88800b091d08\nR13: ffff88800b091178 R14: dffffc0000000000 R15: ffff88800b091000\nFS: 00007f555b86c600(0000) GS:ffff8881942a0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000562107d489c0 CR3: 0000000109a40002 CR4: 0000000000372ef0\nCall Trace:\n \u003cTASK\u003e\n rtnl_dellink (net/core/rtnetlink.c:3632 net/core/rtnetlink.c:3674)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7112)\n netlink_rcv_skb (net/netlink/af_netlink.c:2556)\n netlink_unicast (net/netlink/af_netlink.c:1319)\n netlink_sendmsg (net/netlink/af_netlink.c:1900)\n ____sys_sendmsg (net/socket.c:775)\n __sys_sendmsg (net/socket.c:2738)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n...\nunregister_netdevice: waiting for veth0 to become free. Usage count = 7\nref_tracker: netdev@ffff88800d7496d8 has 3/3 users at\n __netdev_adjacent_dev_insert (./include/linux/netdevice.h:4525 ./include/linux/netdevice.h:4554 net/core/dev.c:8791)\n __netdev_upper_dev_link (net/core/dev.c:8879 net/core/dev.c:8963)\n netdev_upper_dev_link (net/core/dev.c:9009)\n amt_newlink (drivers/net/amt.c:3321)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:51.853Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a5a578d2e13d2dd6c1b272be7cfa0a6dd64552c"
},
{
"url": "https://git.kernel.org/stable/c/a457ff1189f22c2f15f69df55dc910b8b6d7a77d"
},
{
"url": "https://git.kernel.org/stable/c/5ebaad6cf2a639afbf0b265f9a7d1fb6f656a37e"
},
{
"url": "https://git.kernel.org/stable/c/569eb11f0990849ba48706a2bfa743273707e254"
},
{
"url": "https://git.kernel.org/stable/c/e1dc0af719a2566ae7ccb82c0a11f70aa54908e9"
},
{
"url": "https://git.kernel.org/stable/c/e99ecc3046ea5f5c6b5e1f8b4ef854c6c6998e06"
}
],
"title": "amt: Don\u0027t support cross-netns setup.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90232",
"datePublished": "2026-09-17T16:07:39.279Z",
"dateReserved": "2026-09-11T19:38:34.794Z",
"dateUpdated": "2026-10-30T12:34:51.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68393 (GCVE-0-2026-68393)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: extend conn_hash lookup critical sections
Using RCU-protected pointers outside the critical sections without
refcount is incorrect and may result to UAF.
Extend critical section to cover both hci_conn_hash lookup and use of
the returned conn.
Add surrounding rcu_read_lock() also when return value is not used, in
preparation for RCU lockdep requirement to hci_lookup_le_connect().
This avoids concurrent deletion of the conn before we are done
dereferencing it.
Also, make sure to hold hdev->lock when accessing hdev->accept_list.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eb8b860e87b296bd1874c79a668081efd00f9754 Version: 6d0417e4e1cf66fd917f06f0454958362714ef7d Version: 6d0417e4e1cf66fd917f06f0454958362714ef7d Version: 6d0417e4e1cf66fd917f06f0454958362714ef7d Version: 94bf6380e936339a700c0b3171a49baf512aa70b Version: 6.12.28 ≤ Version: 6.14.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:58.636844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:07.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3f98e7f38e1bb761a9964a8851f9c08e9c23b3dd",
"status": "affected",
"version": "eb8b860e87b296bd1874c79a668081efd00f9754",
"versionType": "git"
},
{
"lessThan": "83b7e67698d0b93f685875ce82c8d335436834f7",
"status": "affected",
"version": "6d0417e4e1cf66fd917f06f0454958362714ef7d",
"versionType": "git"
},
{
"lessThan": "38326774df6198df0cc2744cc73bf77cb741c538",
"status": "affected",
"version": "6d0417e4e1cf66fd917f06f0454958362714ef7d",
"versionType": "git"
},
{
"lessThan": "d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d",
"status": "affected",
"version": "6d0417e4e1cf66fd917f06f0454958362714ef7d",
"versionType": "git"
},
{
"status": "affected",
"version": "94bf6380e936339a700c0b3171a49baf512aa70b",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.28",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: extend conn_hash lookup critical sections\n\nUsing RCU-protected pointers outside the critical sections without\nrefcount is incorrect and may result to UAF.\n\nExtend critical section to cover both hci_conn_hash lookup and use of\nthe returned conn.\n\nAdd surrounding rcu_read_lock() also when return value is not used, in\npreparation for RCU lockdep requirement to hci_lookup_le_connect().\n\nThis avoids concurrent deletion of the conn before we are done\ndereferencing it.\n\nAlso, make sure to hold hdev-\u003elock when accessing hdev-\u003eaccept_list."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The affected code is the Bluetooth HCI sync/scan management layer; both sides of the race are driven by LE radio events (connection complete, disconnect, periodic advertising sync creation/termination) from a device in radio range, requiring no local access.\nAC:L - A nearby attacker drives both sides of the race \u2014 repeated LE connect/disconnect and PA sync setup/teardown queue the hci_sync work while concurrently triggering hci_conn_del() on the event workqueue \u2014 so the window can be re-attempted arbitrarily until won.\nPR:N - The vulnerable hci_update_passive_scan_sync()/hci_update_accept_list_sync()/hci_le_set_ext_scan_param_sync() paths are invoked automatically by the kernel in response to incoming LE connection and periodic-advertising events; the remote attacker needs no credentials or pairing on the target.\nUI:N - No victim action is needed \u2014 background LE scanning and accept-list updates are performed autonomously by the host stack whenever connection state changes.\nS:U - The use-after-free occurs in kernel memory and its impact is confined to the kernel\u0027s own security authority, with no crossing into a separate authorization scope such as a hypervisor or IOMMU boundary.\nC:H - The freed hci_conn is read after release (conn-\u003edst, conn-\u003edst_type, PHY parameters), and a heap-groomed replacement object lets the attacker read attacker-chosen or sensitive kernel data, which can additionally be exfiltrated via the resulting accept-list/scan parameters.\nI:H - hci_conn is kfree()\u0027d via bt_link_release() while still referenced, so reallocating the slab with a controlled object yields write/control-flow primitives typical of slab use-after-free, enabling kernel memory corruption and privilege escalation.\nA:H - Dereferencing the freed hci_conn readily causes slab corruption, KASAN splats, or an oops/panic in the Bluetooth workqueues, taking down the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:55.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3f98e7f38e1bb761a9964a8851f9c08e9c23b3dd"
},
{
"url": "https://git.kernel.org/stable/c/83b7e67698d0b93f685875ce82c8d335436834f7"
},
{
"url": "https://git.kernel.org/stable/c/38326774df6198df0cc2744cc73bf77cb741c538"
},
{
"url": "https://git.kernel.org/stable/c/d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d"
}
],
"title": "Bluetooth: hci_sync: extend conn_hash lookup critical sections",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68393",
"datePublished": "2026-08-10T12:04:12.564Z",
"dateReserved": "2026-07-30T09:28:09.388Z",
"dateUpdated": "2026-10-21T12:43:55.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74571 (GCVE-0-2026-74571)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: skip global block reserve accounting for rescue mounts
[BUG]
Mounting with rescue=ibadroots after corrupting the block group tree
root triggers a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000100
RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]
Call Trace:
fill_dummy_bgs+0xd4/0x120 [btrfs]
open_ctree+0xc6e/0x1ca0 [btrfs]
btrfs_get_tree+0x50d/0xa40 [btrfs]
The same crash occurs with a corrupted raid stripe tree root, via
btrfs_read_block_groups() instead of fill_dummy_bgs().
[CAUSE]
With rescue=ibadroots, btrfs_read_roots() allows the mount to continue
when either root cannot be read, leaving the corresponding root pointer
NULL while its on-disk feature bit remains set.
btrfs_update_global_block_rsv() then dereferences the missing root based
on the feature bit alone.
[FIX]
Rescue mounts are fully read-only and cannot start transactions, so the
global reserve is never consumed. Under btrfs_is_full_ro(), mark the
reserve as full and return before performing the accounting.
And since we need to check if the fs is mount fully RO, export
fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.
[ Squash the fs_is_full_ro() export commit into this one. ]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cbec34d3021d47007a0334c634f7053dbaf93d02 Version: 8dbfc14fc736eb701089aff09645c3d4ad3decb1 Version: 8dbfc14fc736eb701089aff09645c3d4ad3decb1 Version: 8dbfc14fc736eb701089aff09645c3d4ad3decb1 Version: 8dbfc14fc736eb701089aff09645c3d4ad3decb1 Version: 8dbfc14fc736eb701089aff09645c3d4ad3decb1 Version: 1e8087589b5cf6fa17adaf57b64cf1656d77dfec Version: 6.1.43 ≤ Version: 6.4.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/block-rsv.c",
"fs/btrfs/disk-io.c",
"fs/btrfs/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aa72cc4675240ab6b01ec72ac6a1fe832e715569",
"status": "affected",
"version": "cbec34d3021d47007a0334c634f7053dbaf93d02",
"versionType": "git"
},
{
"lessThan": "ca05d9abde2195cec3d07d0d4d65152d8171078f",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"lessThan": "3a69fae2371a5ee190d4c4bbe5304a753558c1c6",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"lessThan": "969a96479add6bd42d7f7241f99f27b31571a953",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"lessThan": "076349e4c8d11f6b58c4549976a513b2b4dc6df2",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"lessThan": "51a0e8399858621442807a26057bcd1cd3ced046",
"status": "affected",
"version": "8dbfc14fc736eb701089aff09645c3d4ad3decb1",
"versionType": "git"
},
{
"status": "affected",
"version": "1e8087589b5cf6fa17adaf57b64cf1656d77dfec",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.43",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/block-rsv.c",
"fs/btrfs/disk-io.c",
"fs/btrfs/fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: skip global block reserve accounting for rescue mounts\n\n[BUG]\nMounting with rescue=ibadroots after corrupting the block group tree\nroot triggers a NULL pointer dereference:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000100\n RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]\n Call Trace:\n fill_dummy_bgs+0xd4/0x120 [btrfs]\n open_ctree+0xc6e/0x1ca0 [btrfs]\n btrfs_get_tree+0x50d/0xa40 [btrfs]\n\nThe same crash occurs with a corrupted raid stripe tree root, via\nbtrfs_read_block_groups() instead of fill_dummy_bgs().\n\n[CAUSE]\nWith rescue=ibadroots, btrfs_read_roots() allows the mount to continue\nwhen either root cannot be read, leaving the corresponding root pointer\nNULL while its on-disk feature bit remains set.\n\nbtrfs_update_global_block_rsv() then dereferences the missing root based\non the feature bit alone.\n\n[FIX]\nRescue mounts are fully read-only and cannot start transactions, so the\nglobal reserve is never consumed. Under btrfs_is_full_ro(), mark the\nreserve as full and return before performing the accounting.\n\nAnd since we need to check if the fs is mount fully RO, export\nfs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.\n\n[ Squash the fs_is_full_ro() export commit into this one. ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:11.015Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aa72cc4675240ab6b01ec72ac6a1fe832e715569"
},
{
"url": "https://git.kernel.org/stable/c/ca05d9abde2195cec3d07d0d4d65152d8171078f"
},
{
"url": "https://git.kernel.org/stable/c/3a69fae2371a5ee190d4c4bbe5304a753558c1c6"
},
{
"url": "https://git.kernel.org/stable/c/969a96479add6bd42d7f7241f99f27b31571a953"
},
{
"url": "https://git.kernel.org/stable/c/076349e4c8d11f6b58c4549976a513b2b4dc6df2"
},
{
"url": "https://git.kernel.org/stable/c/51a0e8399858621442807a26057bcd1cd3ced046"
}
],
"title": "btrfs: skip global block reserve accounting for rescue mounts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74571",
"datePublished": "2026-08-15T12:28:10.711Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-10-30T12:30:11.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90409 (GCVE-0-2026-90409)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Add vm_bind region with kbo range overlap check
When a VM is created, caller has to specify the range of the address space
carve-out set aside for mapping kernel BO's. That means vm_bind mappings of
UM-exposed BO's should not intersect with that region, but at the moment
we're not checking this.
At first, I thought of giving these values to drm_gpuvm_init() through its
reserve_{offset, range} arguments, but it turns out that is meant for VM
address spans that are not managed through the usual drm_gpuvm split/merge
circuit, so storing the end of the user VA range at VM creation time and
doing a quick check in the vm_bind ioctl path was the simplest workaround.
The new check also makes sure vm_bind range doesn't overflow the size of a
64-bit unsigned integer. That was already being done further down the call
stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to
fail early in the driver before GPUVM functions are invoked so that we
won't waste time allocating vm_bind context resources.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "276753aaad65e6f7dac7989a600c1c2d3a382c1a",
"status": "affected",
"version": "647810ec247641eb5aec8caef818919a4518a0b1",
"versionType": "git"
},
{
"lessThan": "f2be47fa8e225968eb66863657143fe900ec4bca",
"status": "affected",
"version": "647810ec247641eb5aec8caef818919a4518a0b1",
"versionType": "git"
},
{
"lessThan": "761cf9c63274a5b711c3dc829601723215710d2d",
"status": "affected",
"version": "647810ec247641eb5aec8caef818919a4518a0b1",
"versionType": "git"
},
{
"lessThan": "985f5e12f3cdf43030e13c2bbd154913133b5c3f",
"status": "affected",
"version": "647810ec247641eb5aec8caef818919a4518a0b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Add vm_bind region with kbo range overlap check\n\nWhen a VM is created, caller has to specify the range of the address space\ncarve-out set aside for mapping kernel BO\u0027s. That means vm_bind mappings of\nUM-exposed BO\u0027s should not intersect with that region, but at the moment\nwe\u0027re not checking this.\n\nAt first, I thought of giving these values to drm_gpuvm_init() through its\nreserve_{offset, range} arguments, but it turns out that is meant for VM\naddress spans that are not managed through the usual drm_gpuvm split/merge\ncircuit, so storing the end of the user VA range at VM creation time and\ndoing a quick check in the vm_bind ioctl path was the simplest workaround.\n\nThe new check also makes sure vm_bind range doesn\u0027t overflow the size of a\n64-bit unsigned integer. That was already being done further down the call\nstack inside drm_gpuvm_sm_map -\u003e drm_gpuvm_range_valid, but it\u0027s best to\nfail early in the driver before GPUVM functions are invoked so that we\nwon\u0027t waste time allocating vm_bind context resources."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:32.495Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/276753aaad65e6f7dac7989a600c1c2d3a382c1a"
},
{
"url": "https://git.kernel.org/stable/c/f2be47fa8e225968eb66863657143fe900ec4bca"
},
{
"url": "https://git.kernel.org/stable/c/761cf9c63274a5b711c3dc829601723215710d2d"
},
{
"url": "https://git.kernel.org/stable/c/985f5e12f3cdf43030e13c2bbd154913133b5c3f"
}
],
"title": "drm/panthor: Add vm_bind region with kbo range overlap check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90409",
"datePublished": "2026-09-17T16:09:36.740Z",
"dateReserved": "2026-09-11T19:38:34.812Z",
"dateUpdated": "2026-10-21T12:51:32.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74513 (GCVE-0-2026-74513)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()
look up the dmb_node under dmb_ht_lock, drop the lock and only then
operate on the node's refcount. Nothing keeps the node alive across
that window: __dibs_lo_unregister_dmb() removes the node from the hash
table under the write lock and immediately frees it.
A concurrent final put can therefore free the node between the lookup
and the refcount operation:
CPU0 (attach) CPU1 (owner unregisters)
read_lock_bh(&dmb_ht_lock)
find dmb_node (refcnt == 1)
read_unlock_bh(&dmb_ht_lock)
refcount_dec_and_test() 1 -> 0
write_lock_bh(&dmb_ht_lock)
hash_del(&dmb_node->list)
write_unlock_bh(&dmb_ht_lock)
kfree(dmb_node)
refcount_inc_not_zero(&dmb_node->refcnt) <-- use-after-free
The same window exists for the refcount_dec_and_test() calls in the
detach and unregister paths.
Close the race structurally by making hash table membership and the
refcount transitions atomic with respect to each other:
- Perform the final refcount_dec_and_test() and hash_del() in a single
dmb_ht_lock write-side critical section, in both the unregister and
the detach path. Freeing the node still happens after the lock is
dropped, which is safe because a node whose refcount reached zero has
left the hash table and can no longer be found.
- This establishes the invariant that any node found in the hash table
holds at least one reference, and that the final reference can only
be dropped under the write lock. dibs_lo_attach_dmb() can thus take
its reference with a plain refcount_inc() while still holding the
read lock; refcount_inc_not_zero() is no longer needed.
__dibs_lo_unregister_dmb() no longer touches the hash table and is
renamed to dibs_lo_free_dmb() accordingly.
Note: commit cc21191b584c ("dibs: Move data path to dibs layer") moved
the code to its current location; the race was introduced earlier by
commit c3a910f2380f ("net/smc: implement DMB-merged operations of
loopback-ism").
Tested SMC-D via ISM and dibs loopback.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dibs/dibs_loopback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "90b2166605a7476007f7c013521d30b0be557cac",
"status": "affected",
"version": "c3a910f2380fe294d14e42af66af3d3eed8fecbf",
"versionType": "git"
},
{
"lessThan": "c0837aeace96152d14b17fdd19d70102b6631a7d",
"status": "affected",
"version": "c3a910f2380fe294d14e42af66af3d3eed8fecbf",
"versionType": "git"
},
{
"lessThan": "48c073f88c93707089a4214f21cb4c3de5aea6e4",
"status": "affected",
"version": "c3a910f2380fe294d14e42af66af3d3eed8fecbf",
"versionType": "git"
},
{
"lessThan": "a10ea943356b9d70c5616a0a06f6fa97cfdaccb1",
"status": "affected",
"version": "c3a910f2380fe294d14e42af66af3d3eed8fecbf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dibs/dibs_loopback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndibs: fix use-after-free of dmb_node in loopback attach/detach/unregister\n\ndibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()\nlook up the dmb_node under dmb_ht_lock, drop the lock and only then\noperate on the node\u0027s refcount. Nothing keeps the node alive across\nthat window: __dibs_lo_unregister_dmb() removes the node from the hash\ntable under the write lock and immediately frees it.\n\nA concurrent final put can therefore free the node between the lookup\nand the refcount operation:\n\nCPU0 (attach) CPU1 (owner unregisters)\n\nread_lock_bh(\u0026dmb_ht_lock)\nfind dmb_node (refcnt == 1)\nread_unlock_bh(\u0026dmb_ht_lock)\n refcount_dec_and_test() 1 -\u003e 0\n write_lock_bh(\u0026dmb_ht_lock)\n hash_del(\u0026dmb_node-\u003elist)\n write_unlock_bh(\u0026dmb_ht_lock)\n kfree(dmb_node)\nrefcount_inc_not_zero(\u0026dmb_node-\u003erefcnt) \u003c-- use-after-free\n\nThe same window exists for the refcount_dec_and_test() calls in the\ndetach and unregister paths.\n\nClose the race structurally by making hash table membership and the\nrefcount transitions atomic with respect to each other:\n\n- Perform the final refcount_dec_and_test() and hash_del() in a single\n dmb_ht_lock write-side critical section, in both the unregister and\n the detach path. Freeing the node still happens after the lock is\n dropped, which is safe because a node whose refcount reached zero has\n left the hash table and can no longer be found.\n\n- This establishes the invariant that any node found in the hash table\n holds at least one reference, and that the final reference can only\n be dropped under the write lock. dibs_lo_attach_dmb() can thus take\n its reference with a plain refcount_inc() while still holding the\n read lock; refcount_inc_not_zero() is no longer needed.\n\n__dibs_lo_unregister_dmb() no longer touches the hash table and is\nrenamed to dibs_lo_free_dmb() accordingly.\n\nNote: commit cc21191b584c (\"dibs: Move data path to dibs layer\") moved\nthe code to its current location; the race was introduced earlier by\ncommit c3a910f2380f (\"net/smc: implement DMB-merged operations of\nloopback-ism\").\n\nTested SMC-D via ISM and dibs loopback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is only in the DIBS loopback driver used for same-host SMC-D DMB merge; reachable via AF_SMC connect/accept/close syscalls, not from remote packet handling, and loopback-ism cannot be used across machines.\nAC:L - This is a refcount/hash-table race where an attacker can open multiple SMC loopback connections and concurrently trigger attach, detach, and unregister to control both sides of the window without external timing dependencies.\nPR:L - No capability checks gate AF_SMC socket create/connect/close; any unprivileged local user (including in a user/network namespace with SMC/DIBS loopback enabled) can drive the vulnerable dibs_lo_attach/detach/unregister paths.\nUI:N - Exploitation requires only attacker-controlled SMC socket operations; no victim interaction such as opening files, mounting filesystems, or approving prompts is needed beyond normal daemon availability.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Use-after-free on dibs_lo_dmb_node allows operating on freed slab memory; attach then returns cpu_addr/len from the freed node, enabling arbitrary kernel memory disclosure via heap reuse.\nI:H - The UAF permits corrupting refcount and adjacent heap metadata and returning a dangling buffer pointer used as a merged SMC send buffer, enabling arbitrary kernel writes and potential code execution.\nA:H - Concurrent refcount operations on a freed dmb_node can cause kernel oops/panic from invalid refcount access or use of freed folio-backed memory during SMC-D buffer attach/detach teardown."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:43.905Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/90b2166605a7476007f7c013521d30b0be557cac"
},
{
"url": "https://git.kernel.org/stable/c/c0837aeace96152d14b17fdd19d70102b6631a7d"
},
{
"url": "https://git.kernel.org/stable/c/48c073f88c93707089a4214f21cb4c3de5aea6e4"
},
{
"url": "https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1"
}
],
"title": "dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74513",
"datePublished": "2026-08-15T12:27:34.329Z",
"dateReserved": "2026-08-15T05:44:03.909Z",
"dateUpdated": "2026-10-21T12:45:43.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63825 (GCVE-0-2026-63825)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gcov: use atomic counter updates to fix concurrent access crashes
GCC's GCOV instrumentation can merge global branch counters with loop
induction variables as an optimization. In inflate_fast(), the inner copy
loops get transformed so that the GCOV counter value is loaded multiple
times to compute the loop base address, start index, and end bound. Since
GCOV counters are global (not per-CPU), concurrent execution on different
CPUs causes the counter to change between loads, producing inconsistent
values and out-of-bounds memory writes.
The crash manifests during IPComp (IP Payload Compression) processing when
inflate_fast() runs concurrently on multiple CPUs:
BUG: unable to handle page fault for address: ffffd0a3c0902ffa
RIP: inflate_fast+1431
Call Trace:
zlib_inflate
__deflate_decompress
crypto_comp_decompress
ipcomp_decompress [xfrm_ipcomp]
ipcomp_input [xfrm_ipcomp]
xfrm_input
At the crash point, the compiler generated three loads from the same
global GCOV counter (__gcov0.inflate_fast+216) to compute base, start, and
end for an indexed loop. Another CPU modified the counter between loads,
making the values inconsistent - the write went 3.4 MB past a 65 KB
buffer.
Add -fprofile-update=prefer-atomic to CFLAGS_GCOV at the global level in
the top-level Makefile, guarded by a try-run compile test. The test
compiles a minimal program with and without -fprofile-update=prefer-atomic
using the full KBUILD_CFLAGS, then compares undefined symbols in the
resulting object files. If prefer-atomic introduces new undefined
references (such as __atomic_fetch_add_8 on i386 or __aarch64_ldadd8_relax
on arm64 with outline-atomics), the flag is not added -- the kernel does
not link against libatomic.
On architectures where GCC inlines 64-bit atomic counter updates (x86_64,
s390, ...) the test passes and the flag is enabled, preventing the
compiler from merging counters with loop induction variables and fixing
the observed concurrent-access crash.
On architectures where the flag would introduce libatomic dependencies, it
is silently omitted and behaviour is no worse than before this patch.
Move the CFLAGS_GCOV block from its original position (before the arch
Makefile include) to after the core KBUILD_CFLAGS assignments but before
the scripts/Makefile.gcc-plugins include. This placement ensures the
try-run test sees arch-specific flags (-m32, -march=,
-mno-outline-atomics) while avoiding GCC plugin flags (-fplugin=) that
would break the test on clean builds when plugin shared objects do not yet
exist.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2521f2c228ad750701ba4702484e31d876dbc386 Version: 2521f2c228ad750701ba4702484e31d876dbc386 Version: 2521f2c228ad750701ba4702484e31d876dbc386 Version: 2521f2c228ad750701ba4702484e31d876dbc386 Version: 2521f2c228ad750701ba4702484e31d876dbc386 Version: 2521f2c228ad750701ba4702484e31d876dbc386 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Makefile"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76cb9fde95eba4bd8f06d142a8b8810bf2d09de4",
"status": "affected",
"version": "2521f2c228ad750701ba4702484e31d876dbc386",
"versionType": "git"
},
{
"lessThan": "b0f7bd5eeb903a0021a80e9d704814e2a9d3998c",
"status": "affected",
"version": "2521f2c228ad750701ba4702484e31d876dbc386",
"versionType": "git"
},
{
"lessThan": "4575852c23a10abc7648d31e4c12cf79d7391637",
"status": "affected",
"version": "2521f2c228ad750701ba4702484e31d876dbc386",
"versionType": "git"
},
{
"lessThan": "49d893b9cbcfc5802a32e53a64c6c6956670d65b",
"status": "affected",
"version": "2521f2c228ad750701ba4702484e31d876dbc386",
"versionType": "git"
},
{
"lessThan": "5b959c1dbb4522b9e3ac4e26ad638b8784869841",
"status": "affected",
"version": "2521f2c228ad750701ba4702484e31d876dbc386",
"versionType": "git"
},
{
"lessThan": "56cb9b7d96b28a1173a510ab25354b6599ad3a33",
"status": "affected",
"version": "2521f2c228ad750701ba4702484e31d876dbc386",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Makefile"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngcov: use atomic counter updates to fix concurrent access crashes\n\nGCC\u0027s GCOV instrumentation can merge global branch counters with loop\ninduction variables as an optimization. In inflate_fast(), the inner copy\nloops get transformed so that the GCOV counter value is loaded multiple\ntimes to compute the loop base address, start index, and end bound. Since\nGCOV counters are global (not per-CPU), concurrent execution on different\nCPUs causes the counter to change between loads, producing inconsistent\nvalues and out-of-bounds memory writes.\n\nThe crash manifests during IPComp (IP Payload Compression) processing when\ninflate_fast() runs concurrently on multiple CPUs:\n\n BUG: unable to handle page fault for address: ffffd0a3c0902ffa\n RIP: inflate_fast+1431\n Call Trace:\n zlib_inflate\n __deflate_decompress\n crypto_comp_decompress\n ipcomp_decompress [xfrm_ipcomp]\n ipcomp_input [xfrm_ipcomp]\n xfrm_input\n\nAt the crash point, the compiler generated three loads from the same\nglobal GCOV counter (__gcov0.inflate_fast+216) to compute base, start, and\nend for an indexed loop. Another CPU modified the counter between loads,\nmaking the values inconsistent - the write went 3.4 MB past a 65 KB\nbuffer.\n\nAdd -fprofile-update=prefer-atomic to CFLAGS_GCOV at the global level in\nthe top-level Makefile, guarded by a try-run compile test. The test\ncompiles a minimal program with and without -fprofile-update=prefer-atomic\nusing the full KBUILD_CFLAGS, then compares undefined symbols in the\nresulting object files. If prefer-atomic introduces new undefined\nreferences (such as __atomic_fetch_add_8 on i386 or __aarch64_ldadd8_relax\non arm64 with outline-atomics), the flag is not added -- the kernel does\nnot link against libatomic.\n\nOn architectures where GCC inlines 64-bit atomic counter updates (x86_64,\ns390, ...) the test passes and the flag is enabled, preventing the\ncompiler from merging counters with loop induction variables and fixing\nthe observed concurrent-access crash.\n\nOn architectures where the flag would introduce libatomic dependencies, it\nis silently omitted and behaviour is no worse than before this patch.\n\nMove the CFLAGS_GCOV block from its original position (before the arch\nMakefile include) to after the core KBUILD_CFLAGS assignments but before\nthe scripts/Makefile.gcc-plugins include. This placement ensures the\ntry-run test sees arch-specific flags (-m32, -march=,\n-mno-outline-atomics) while avoiding GCC plugin flags (-fplugin=) that\nwould break the test on clean builds when plugin shared objects do not yet\nexist."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The demonstrated crash path is inbound IPComp processing via xfrm_input on network-received packets (xfrm4_ipcomp_rcv \u2192 ipcomp_input \u2192 deflate_decompress \u2192 inflate_fast), reachable by any remote host that can send IP traffic to a system with a matching IPComp SA.\nAC:L - Exploitation requires a concurrent GCOV counter race, and the attacker fully controls timing by flooding parallel IPComp/deflate decompression requests; per-CPU acompress streams allow inflate_fast() to run simultaneously on multiple CPUs.\nPR:N - No local account or kernel capabilities are needed on the victim; a remote attacker only needs network reachability to an endpoint with IPComp configured and can trigger decompression by sending crafted IPComp packets matching an existing SA.\nUI:N - Exploitation is driven entirely by attacker-sent network packets and requires no action from any local user or administrator at attack time.\nS:U - The out-of-bounds write corrupts kernel memory within the same kernel security domain; it enables local privilege escalation but does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The bug produces a large out-of-bounds kernel write (documented 3.4 MB past a 65 KB buffer), which is arbitrary memory corruption that can be leveraged for kernel memory disclosure, not merely a bounded crash.\nI:H - The corrupted write targets kernel heap memory far outside the decompression buffer, providing a memory-corruption primitive suitable for control-flow hijacking and arbitrary kernel code execution.\nA:H - The reported failure is a kernel page fault in inflate_fast() during IPComp processing, and the underlying out-of-bounds write can reliably cause kernel oops/panic or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:09.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76cb9fde95eba4bd8f06d142a8b8810bf2d09de4"
},
{
"url": "https://git.kernel.org/stable/c/b0f7bd5eeb903a0021a80e9d704814e2a9d3998c"
},
{
"url": "https://git.kernel.org/stable/c/4575852c23a10abc7648d31e4c12cf79d7391637"
},
{
"url": "https://git.kernel.org/stable/c/49d893b9cbcfc5802a32e53a64c6c6956670d65b"
},
{
"url": "https://git.kernel.org/stable/c/5b959c1dbb4522b9e3ac4e26ad638b8784869841"
},
{
"url": "https://git.kernel.org/stable/c/56cb9b7d96b28a1173a510ab25354b6599ad3a33"
}
],
"title": "gcov: use atomic counter updates to fix concurrent access crashes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63825",
"datePublished": "2026-07-19T12:02:20.968Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-10-30T12:27:09.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97989 (GCVE-0-2026-97989)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vduse: validate virtqueue alignment
vduse_validate_config() only checks the upper bound of vq_align. Invalid
values can therefore reach vring_create_virtqueue_map(). The split-ring
helpers use align - 1 as a bit mask, so the alignment must be a non-zero
power of two. A zero value makes vring_size() drop the descriptor and
available-ring part and vring_init() leave the used ring pointer NULL.
The VIRTIO spec requires the used ring to start at an address
aligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as
well as non-power-of-two values before they reach the virtio ring helpers.
Opening a virtio-net device created with vq_align=0 triggered:
BUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100
Read of size 2 at addr 0000000000000000 by task systemd-network/1062
Call Trace (relevant frames):
dump_stack_lvl
print_report
kasan_report
__asan_load2
virtqueue_kick_prepare_split+0xe3/0x100
virtqueue_kick_prepare+0x40/0x60
try_fill_recv+0x857/0x1250
virtnet_open+0x189/0x460
__dev_open+0x225/0x390
__dev_change_flags+0x368/0x3b0
netif_change_flags+0x56/0xc0
do_setlink.isra.0+0x68c/0x1e30
Validate the value before it reaches the virtio ring helpers.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa_user/vduse_dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "650bac9c73d3b4d83be683028283654c05346556",
"status": "affected",
"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
"versionType": "git"
},
{
"lessThan": "5d4bdca17d87c90b1d888f8846a781a18aa453c9",
"status": "affected",
"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
"versionType": "git"
},
{
"lessThan": "831dab9b9bcc184adf78f18b5b788316e3174aec",
"status": "affected",
"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
"versionType": "git"
},
{
"lessThan": "c3c3b0839a1197530cc18f535062fc84dbdfc885",
"status": "affected",
"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
"versionType": "git"
},
{
"lessThan": "fa2c25b4add57888acfa89e398389e267bff3dcf",
"status": "affected",
"version": "c8a6153b6c59d95c0e091f053f6f180952ade91e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa_user/vduse_dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvduse: validate virtqueue alignment\n\nvduse_validate_config() only checks the upper bound of vq_align. Invalid\nvalues can therefore reach vring_create_virtqueue_map(). The split-ring\nhelpers use align - 1 as a bit mask, so the alignment must be a non-zero\npower of two. A zero value makes vring_size() drop the descriptor and\navailable-ring part and vring_init() leave the used ring pointer NULL.\n\nThe VIRTIO spec requires the used ring to start at an address\naligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as\nwell as non-power-of-two values before they reach the virtio ring helpers.\n\nOpening a virtio-net device created with vq_align=0 triggered:\n\nBUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100\nRead of size 2 at addr 0000000000000000 by task systemd-network/1062\n\nCall Trace (relevant frames):\n dump_stack_lvl\n print_report\n kasan_report\n __asan_load2\n virtqueue_kick_prepare_split+0xe3/0x100\n virtqueue_kick_prepare+0x40/0x60\n try_fill_recv+0x857/0x1250\n virtnet_open+0x189/0x460\n __dev_open+0x225/0x390\n __dev_change_flags+0x368/0x3b0\n netif_change_flags+0x56/0xc0\n do_setlink.isra.0+0x68c/0x1e30\n\nValidate the value before it reaches the virtio ring helpers."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:59.737Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/650bac9c73d3b4d83be683028283654c05346556"
},
{
"url": "https://git.kernel.org/stable/c/5d4bdca17d87c90b1d888f8846a781a18aa453c9"
},
{
"url": "https://git.kernel.org/stable/c/831dab9b9bcc184adf78f18b5b788316e3174aec"
},
{
"url": "https://git.kernel.org/stable/c/c3c3b0839a1197530cc18f535062fc84dbdfc885"
},
{
"url": "https://git.kernel.org/stable/c/fa2c25b4add57888acfa89e398389e267bff3dcf"
}
],
"title": "vduse: validate virtqueue alignment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97989",
"datePublished": "2026-09-25T10:23:22.620Z",
"dateReserved": "2026-09-25T10:18:58.209Z",
"dateUpdated": "2026-10-21T12:53:59.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52937 (GCVE-0-2026-52937)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-11-06 16:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
uninitialised on-stack struct sockaddr_storage to userspace via
ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
macvtap chardev returns kernel .text and direct-map pointers, defeating
KASLR.
Initialise ss at declaration.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b23a32a63219f51a5298bc55a65ecee866e79d0 Version: 3b23a32a63219f51a5298bc55a65ecee866e79d0 Version: 3b23a32a63219f51a5298bc55a65ecee866e79d0 Version: 3b23a32a63219f51a5298bc55a65ecee866e79d0 Version: 3b23a32a63219f51a5298bc55a65ecee866e79d0 Version: 3b23a32a63219f51a5298bc55a65ecee866e79d0 Version: 176188cff67ec1aa55103647b61d02315cc38e98 Version: 1fc205d9e400f069ebf30d3faa6ec2bab2cbd7b4 Version: 4d0ae760c02c98fc78b78d3a0509896bc648ad1c Version: 5.4.103 ≤ Version: 5.10.21 ≤ Version: 5.11.4 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52937",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:14:31.366522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:23:50.415Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b6dcfe0e3dfffd8057a4fc99b3f096c45709905",
"status": "affected",
"version": "3b23a32a63219f51a5298bc55a65ecee866e79d0",
"versionType": "git"
},
{
"lessThan": "37d028a473b0826ad5970b52b791db4a29a23627",
"status": "affected",
"version": "3b23a32a63219f51a5298bc55a65ecee866e79d0",
"versionType": "git"
},
{
"lessThan": "8197905d97099d8b1e3883112bbb497abd20f9f0",
"status": "affected",
"version": "3b23a32a63219f51a5298bc55a65ecee866e79d0",
"versionType": "git"
},
{
"lessThan": "719007c3492f0f1f9e9cdbed8ac45ba45bb13eeb",
"status": "affected",
"version": "3b23a32a63219f51a5298bc55a65ecee866e79d0",
"versionType": "git"
},
{
"lessThan": "05305e832be7b9d65b2b72caacf7d850b3942b2a",
"status": "affected",
"version": "3b23a32a63219f51a5298bc55a65ecee866e79d0",
"versionType": "git"
},
{
"lessThan": "bddc09212c24934643bd44fc794748d2bbb3b6cd",
"status": "affected",
"version": "3b23a32a63219f51a5298bc55a65ecee866e79d0",
"versionType": "git"
},
{
"status": "affected",
"version": "176188cff67ec1aa55103647b61d02315cc38e98",
"versionType": "git"
},
{
"status": "affected",
"version": "1fc205d9e400f069ebf30d3faa6ec2bab2cbd7b4",
"versionType": "git"
},
{
"status": "affected",
"version": "4d0ae760c02c98fc78b78d3a0509896bc648ad1c",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.103",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.21",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\nIn the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an\nuninitialised on-stack struct sockaddr_storage to userspace via\nifr_hwaddr, but netif_get_mac_address() only writes sa_family and\ndev-\u003eaddr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.\n\nThose 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a\nmacvtap chardev returns kernel .text and direct-map pointers, defeating\nKASLR.\n\nInitialise ss at declaration."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:20.549Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b6dcfe0e3dfffd8057a4fc99b3f096c45709905"
},
{
"url": "https://git.kernel.org/stable/c/37d028a473b0826ad5970b52b791db4a29a23627"
},
{
"url": "https://git.kernel.org/stable/c/8197905d97099d8b1e3883112bbb497abd20f9f0"
},
{
"url": "https://git.kernel.org/stable/c/719007c3492f0f1f9e9cdbed8ac45ba45bb13eeb"
},
{
"url": "https://git.kernel.org/stable/c/05305e832be7b9d65b2b72caacf7d850b3942b2a"
},
{
"url": "https://git.kernel.org/stable/c/bddc09212c24934643bd44fc794748d2bbb3b6cd"
}
],
"title": "tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52937",
"datePublished": "2026-06-24T07:14:27.305Z",
"dateReserved": "2026-06-09T07:44:35.370Z",
"dateUpdated": "2026-11-06T16:23:50.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38199 (GCVE-0-2025-38199)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-11-05 20:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
rx_stats for each arsta is allocated when adding a station.
arsta->rx_stats will be freed when a station is removed.
Redundant allocations are occurring when the same station is added
multiple times. This causes ath12k_mac_station_add() to be called
multiple times, and rx_stats is allocated each time. As a result there
is memory leaks.
Prevent multiple allocations of rx_stats when ath12k_mac_station_add()
is called repeatedly by checking if rx_stats is already allocated
before allocating again. Allocate arsta->rx_stats if arsta->rx_stats
is NULL respectively.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:51:09.967665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:52:19.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c4b122c75581331177686f68a08981371147d37",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "232f962ae5fca98912a719e64b4964a5aec7c99b",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "c426497fa2055c8005196922e7d29c41d7e0948a",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix memory leak due to multiple rx_stats allocation\n\nrx_stats for each arsta is allocated when adding a station.\narsta-\u003erx_stats will be freed when a station is removed.\n\nRedundant allocations are occurring when the same station is added\nmultiple times. This causes ath12k_mac_station_add() to be called\nmultiple times, and rx_stats is allocated each time. As a result there\nis memory leaks.\n\nPrevent multiple allocations of rx_stats when ath12k_mac_station_add()\nis called repeatedly by checking if rx_stats is already allocated\nbefore allocating again. Allocate arsta-\u003erx_stats if arsta-\u003erx_stats\nis NULL respectively.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:50.145Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c4b122c75581331177686f68a08981371147d37"
},
{
"url": "https://git.kernel.org/stable/c/232f962ae5fca98912a719e64b4964a5aec7c99b"
},
{
"url": "https://git.kernel.org/stable/c/c426497fa2055c8005196922e7d29c41d7e0948a"
}
],
"title": "wifi: ath12k: Fix memory leak due to multiple rx_stats allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38199",
"datePublished": "2025-07-04T13:37:21.227Z",
"dateReserved": "2025-04-16T04:51:23.993Z",
"dateUpdated": "2026-11-05T20:52:19.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43118 (GCVE-0-2026-43118)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix zero size inode with non-zero size after log replay
When logging that an inode exists, as part of logging a new name or
logging new dir entries for a directory, we always set the generation of
the logged inode item to 0. This is to signal during log replay (in
overwrite_item()), that we should not set the i_size since we only logged
that an inode exists, so the i_size of the inode in the subvolume tree
must be preserved (as when we log new names or that an inode exists, we
don't log extents).
This works fine except when we have already logged an inode in full mode
or it's the first time we are logging an inode created in a past
transaction, that inode has a new i_size of 0 and then we log a new name
for the inode (due to a new hardlink or a rename), in which case we log
an i_size of 0 for the inode and a generation of 0, which causes the log
replay code to not update the inode's i_size to 0 (in overwrite_item()).
An example scenario:
mkdir /mnt/dir
xfs_io -f -c "pwrite 0 64K" /mnt/dir/foo
sync
xfs_io -c "truncate 0" -c "fsync" /mnt/dir/foo
ln /mnt/dir/foo /mnt/dir/bar
xfs_io -c "fsync" /mnt/dir
<power fail>
After log replay the file remains with a size of 64K. This is because when
we first log the inode, when we fsync file foo, we log its current i_size
of 0, and then when we create a hard link we log again the inode in exists
mode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we
add to the log tree, so during log replay overwrite_item() sees that the
generation is 0 and i_size is 0 so we skip updating the inode's i_size
from 64K to 0.
Fix this by making sure at fill_inode_item() we always log the real
generation of the inode if it was logged in the current transaction with
the i_size we logged before. Also if an inode created in a previous
transaction is logged in exists mode only, make sure we log the i_size
stored in the inode item located from the commit root, so that if we log
multiple times that the inode exists we get the correct i_size.
A test case for fstests will follow soon.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/tree-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "126999610eddeb1de3b47680585f4bc9531dc7f4",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "c939bfa67d221f75351a5bf2fc912e8125547b7e",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "91990732ec4ce5c09361d498c6d621f5a76ee1f2",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "fddb157536e67a055597f00a8b4922d5f5ed0826",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "03e966b63df5b06790310c1faaf3e0cb43adea8b",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "5254d4181add9dfaa5e3519edd71cc8f752b2f85",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/tree-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix zero size inode with non-zero size after log replay\n\nWhen logging that an inode exists, as part of logging a new name or\nlogging new dir entries for a directory, we always set the generation of\nthe logged inode item to 0. This is to signal during log replay (in\noverwrite_item()), that we should not set the i_size since we only logged\nthat an inode exists, so the i_size of the inode in the subvolume tree\nmust be preserved (as when we log new names or that an inode exists, we\ndon\u0027t log extents).\n\nThis works fine except when we have already logged an inode in full mode\nor it\u0027s the first time we are logging an inode created in a past\ntransaction, that inode has a new i_size of 0 and then we log a new name\nfor the inode (due to a new hardlink or a rename), in which case we log\nan i_size of 0 for the inode and a generation of 0, which causes the log\nreplay code to not update the inode\u0027s i_size to 0 (in overwrite_item()).\n\nAn example scenario:\n\n mkdir /mnt/dir\n xfs_io -f -c \"pwrite 0 64K\" /mnt/dir/foo\n\n sync\n\n xfs_io -c \"truncate 0\" -c \"fsync\" /mnt/dir/foo\n\n ln /mnt/dir/foo /mnt/dir/bar\n\n xfs_io -c \"fsync\" /mnt/dir\n\n \u003cpower fail\u003e\n\nAfter log replay the file remains with a size of 64K. This is because when\nwe first log the inode, when we fsync file foo, we log its current i_size\nof 0, and then when we create a hard link we log again the inode in exists\nmode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we\nadd to the log tree, so during log replay overwrite_item() sees that the\ngeneration is 0 and i_size is 0 so we skip updating the inode\u0027s i_size\nfrom 64K to 0.\n\nFix this by making sure at fill_inode_item() we always log the real\ngeneration of the inode if it was logged in the current transaction with\nthe i_size we logged before. Also if an inode created in a previous\ntransaction is logged in exists mode only, make sure we log the i_size\nstored in the inode item located from the commit root, so that if we log\nmultiple times that the inode exists we get the correct i_size.\n\nA test case for fstests will follow soon."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:59.447Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/126999610eddeb1de3b47680585f4bc9531dc7f4"
},
{
"url": "https://git.kernel.org/stable/c/c939bfa67d221f75351a5bf2fc912e8125547b7e"
},
{
"url": "https://git.kernel.org/stable/c/91990732ec4ce5c09361d498c6d621f5a76ee1f2"
},
{
"url": "https://git.kernel.org/stable/c/fddb157536e67a055597f00a8b4922d5f5ed0826"
},
{
"url": "https://git.kernel.org/stable/c/03e966b63df5b06790310c1faaf3e0cb43adea8b"
},
{
"url": "https://git.kernel.org/stable/c/5254d4181add9dfaa5e3519edd71cc8f752b2f85"
}
],
"title": "btrfs: fix zero size inode with non-zero size after log replay",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43118",
"datePublished": "2026-05-06T07:40:42.598Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-10-30T12:24:59.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99165 (GCVE-0-2026-99165)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: revalidate output stream after association connect wait
When message interleaving is enabled, the first send waits for association
establishment before building its data chunks. The wait drops the socket
lock, and handshake processing can reduce the output stream count to the
peer-advertised inbound stream count. sctp_stream_init() then frees the
extension of every removed stream.
The sender resumes with the stream that it checked before the wait. If the
peer removed that stream, sctp_outq_tail() later dereferences its NULL
extension. Fatal-oops policies then panic the host.
KASAN: null-ptr-deref in range [0x38-0x3f]
RIP: sctp_outq_tail+0x49e/0xaa0
Call Trace:
sctp_primitive_SEND
sctp_sendmsg_to_asoc
sctp_sendmsg
A range check alone is insufficient. Stream reconfiguration can grow the
output count again while the lock is released without recreating extensions
freed by the earlier shrink. The stream can then be in range while its
extension remains NULL. The send-buffer wait has the same issue.
Factor the range and extension checks into a helper and repeat both after
each send-path wait that drops the socket lock. Once the lock is
reacquired, the validation remains stable through data creation and
queueing.
If validation fails after the connect wait, the auto-created association is
already established. Return ESRCH so the existing caller path keeps it
under state-machine ownership instead of freeing it directly, which would
leave protocol, counter and socket state inconsistent.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 Version: 668c9beb9020d5834ee9e43c208190a07d2b1928 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "26af2969b29cc5eb893a454fee2a36b39521a5bd",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "b925652ba3a3ee11b2617e68de92379144b5b84b",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "504bdf55438ad4b1ecbfba0f7fe95e1933f7fb66",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "994694a2d4611d7b76cf05ff401a92b1c0451e1f",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "84f741b7bb3974e674c9739055826aa040362bba",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "77a63d1b813b08c4e5a948f5e04fbaca6176aa8f",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "fd56ac95ec31a05b66e8938debfa847f49c0e993",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "b7ad72414c673ce1fa1f463e807cd4f34f8be9bf",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: revalidate output stream after association connect wait\n\nWhen message interleaving is enabled, the first send waits for association\nestablishment before building its data chunks. The wait drops the socket\nlock, and handshake processing can reduce the output stream count to the\npeer-advertised inbound stream count. sctp_stream_init() then frees the\nextension of every removed stream.\n\nThe sender resumes with the stream that it checked before the wait. If the\npeer removed that stream, sctp_outq_tail() later dereferences its NULL\nextension. Fatal-oops policies then panic the host.\n\nKASAN: null-ptr-deref in range [0x38-0x3f]\nRIP: sctp_outq_tail+0x49e/0xaa0\nCall Trace:\n sctp_primitive_SEND\n sctp_sendmsg_to_asoc\n sctp_sendmsg\n\nA range check alone is insufficient. Stream reconfiguration can grow the\noutput count again while the lock is released without recreating extensions\nfreed by the earlier shrink. The stream can then be in range while its\nextension remains NULL. The send-buffer wait has the same issue.\n\nFactor the range and extension checks into a helper and repeat both after\neach send-path wait that drops the socket lock. Once the lock is\nreacquired, the validation remains stable through data creation and\nqueueing.\n\nIf validation fails after the connect wait, the auto-created association is\nalready established. Return ESRCH so the existing caller path keeps it\nunder state-machine ownership instead of freeing it directly, which would\nleave protocol, counter and socket state inconsistent."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:30.300Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/26af2969b29cc5eb893a454fee2a36b39521a5bd"
},
{
"url": "https://git.kernel.org/stable/c/b925652ba3a3ee11b2617e68de92379144b5b84b"
},
{
"url": "https://git.kernel.org/stable/c/504bdf55438ad4b1ecbfba0f7fe95e1933f7fb66"
},
{
"url": "https://git.kernel.org/stable/c/994694a2d4611d7b76cf05ff401a92b1c0451e1f"
},
{
"url": "https://git.kernel.org/stable/c/84f741b7bb3974e674c9739055826aa040362bba"
},
{
"url": "https://git.kernel.org/stable/c/77a63d1b813b08c4e5a948f5e04fbaca6176aa8f"
},
{
"url": "https://git.kernel.org/stable/c/fd56ac95ec31a05b66e8938debfa847f49c0e993"
},
{
"url": "https://git.kernel.org/stable/c/b7ad72414c673ce1fa1f463e807cd4f34f8be9bf"
}
],
"title": "sctp: revalidate output stream after association connect wait",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99165",
"datePublished": "2026-10-28T10:35:17.366Z",
"dateReserved": "2026-09-25T10:25:14.398Z",
"dateUpdated": "2026-10-30T12:42:30.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43463 (GCVE-0-2026-43463)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
rxrpc_kernel_lookup_peer() can also return error pointers in addition to
NULL, so just checking for NULL is not sufficient.
Fix this by:
(1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL
on allocation failure.
(2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the
error code returned.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 72904d7b9bfbf2dd146254edea93958bc35bbbfe Version: 72904d7b9bfbf2dd146254edea93958bc35bbbfe Version: 72904d7b9bfbf2dd146254edea93958bc35bbbfe Version: 72904d7b9bfbf2dd146254edea93958bc35bbbfe Version: 056fc740be000d39a7dba700a935f3bbfbc664e6 Version: 6.7.3 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:39:27.146019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:55.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/afs/addr_list.c",
"net/rxrpc/af_rxrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d854c93b12f2076c564f595b41b93b02fd42a0f9",
"status": "affected",
"version": "72904d7b9bfbf2dd146254edea93958bc35bbbfe",
"versionType": "git"
},
{
"lessThan": "d55fa7cd4b19ba91b34b307d769c149e56ad0a75",
"status": "affected",
"version": "72904d7b9bfbf2dd146254edea93958bc35bbbfe",
"versionType": "git"
},
{
"lessThan": "54331c5dcc6d97683d7ca2788e7ef9c9505e1477",
"status": "affected",
"version": "72904d7b9bfbf2dd146254edea93958bc35bbbfe",
"versionType": "git"
},
{
"lessThan": "4245a79003adf30e67f8e9060915bd05cb31d142",
"status": "affected",
"version": "72904d7b9bfbf2dd146254edea93958bc35bbbfe",
"versionType": "git"
},
{
"status": "affected",
"version": "056fc740be000d39a7dba700a935f3bbfbc664e6",
"versionType": "git"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/afs/addr_list.c",
"net/rxrpc/af_rxrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()\n\nrxrpc_kernel_lookup_peer() can also return error pointers in addition to\nNULL, so just checking for NULL is not sufficient.\n\nFix this by:\n\n (1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL\n on allocation failure.\n\n (2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the\n error code returned."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:48.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d854c93b12f2076c564f595b41b93b02fd42a0f9"
},
{
"url": "https://git.kernel.org/stable/c/d55fa7cd4b19ba91b34b307d769c149e56ad0a75"
},
{
"url": "https://git.kernel.org/stable/c/54331c5dcc6d97683d7ca2788e7ef9c9505e1477"
},
{
"url": "https://git.kernel.org/stable/c/4245a79003adf30e67f8e9060915bd05cb31d142"
}
],
"title": "rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43463",
"datePublished": "2026-05-08T14:22:25.346Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-11-06T15:42:55.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72341 (GCVE-0-2026-72341)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix publication race for priv->channel_stats[]
mlx5e_channel_stats_alloc() publishes a new entry to
priv->channel_stats[] and then increments priv->stats_nch as a
publication token, but neither store carries any memory barrier:
priv->channel_stats[ix] = kvzalloc_node(...);
if (!priv->channel_stats[ix])
return -ENOMEM;
priv->stats_nch++;
Concurrent readers compute the loop bound from priv->stats_nch and
then dereference priv->channel_stats[i] using plain accesses, e.g.
for (i = 0; i < priv->stats_nch; i++) {
struct mlx5e_channel_stats *cs = priv->channel_stats[i];
... cs->rq.packets ...
}
On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to
channel_stats[ix] and stats_nch may become visible to other CPUs out
of program order. A reader can observe stats_nch == N while still
seeing channel_stats[N-1] == NULL, leading to a NULL pointer
dereference in the channel_stats loop.
This has been observed in production on BlueField-3 DPUs (arm64),
where ovs-vswitchd queries netdev statistics over netlink during NIC
bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc()
on another CPU:
Unable to handle kernel NULL pointer dereference at virtual address 0x840
Hardware name: BlueField-3 DPU
pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]
Call trace:
mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]
dev_get_stats+0x50/0xc0
ovs_vport_get_stats+0x38/0xac [openvswitch]
ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]
ovs_vport_cmd_get+0xbc/0x10c [openvswitch]
genl_family_rcv_msg_doit+0xd0/0x160
genl_rcv_msg+0xec/0x1f0
netlink_rcv_skb+0x64/0x130
genl_rcv+0x40/0x60
netlink_unicast+0x2fc/0x370
netlink_sendmsg+0x1dc/0x454
...
__arm64_sys_sendmsg+0x2c/0x40
Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h
that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.
The release/acquire pair establishes the contract:
stats_nch == N => channel_stats[0..N-1] are visible and non-NULL.
Publish the stats_nch increment via mlx5e_stats_nch_write() in the
writer (mlx5e_channel_stats_alloc()), and read stats_nch via
mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,
mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the
sw_stats fold and the HV VHCA stats agent.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa691d0c9c0812b9045f3a9420862e47b3b92518 Version: fa691d0c9c0812b9045f3a9420862e47b3b92518 Version: fa691d0c9c0812b9045f3a9420862e47b3b92518 Version: fa691d0c9c0812b9045f3a9420862e47b3b92518 Version: fa691d0c9c0812b9045f3a9420862e47b3b92518 Version: fa691d0c9c0812b9045f3a9420862e47b3b92518 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en.h",
"drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
"drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "df122c593735aa5e1c97457767aa10ed8fa972e0",
"status": "affected",
"version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
"versionType": "git"
},
{
"lessThan": "268869794170af37727816ad02051808adb9c9c3",
"status": "affected",
"version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
"versionType": "git"
},
{
"lessThan": "acd34d24342a28794e706ce8191ca6c3114a38ae",
"status": "affected",
"version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
"versionType": "git"
},
{
"lessThan": "5c7e3755abf663f033de24f917b77685e9543045",
"status": "affected",
"version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
"versionType": "git"
},
{
"lessThan": "815515ec68f527ca755cb1e2c1ff9148f6b3ea56",
"status": "affected",
"version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
"versionType": "git"
},
{
"lessThan": "5a799714e8ca0bce9ea40694f49914cf1adbbaa9",
"status": "affected",
"version": "fa691d0c9c0812b9045f3a9420862e47b3b92518",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en.h",
"drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_stats.c",
"drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix publication race for priv-\u003echannel_stats[]\n\nmlx5e_channel_stats_alloc() publishes a new entry to\npriv-\u003echannel_stats[] and then increments priv-\u003estats_nch as a\npublication token, but neither store carries any memory barrier:\n\n\tpriv-\u003echannel_stats[ix] = kvzalloc_node(...);\n\tif (!priv-\u003echannel_stats[ix])\n\t\treturn -ENOMEM;\n\tpriv-\u003estats_nch++;\n\nConcurrent readers compute the loop bound from priv-\u003estats_nch and\nthen dereference priv-\u003echannel_stats[i] using plain accesses, e.g.\n\n\tfor (i = 0; i \u003c priv-\u003estats_nch; i++) {\n\t\tstruct mlx5e_channel_stats *cs = priv-\u003echannel_stats[i];\n\t\t... cs-\u003erq.packets ...\n\t}\n\nOn weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to\nchannel_stats[ix] and stats_nch may become visible to other CPUs out\nof program order. A reader can observe stats_nch == N while still\nseeing channel_stats[N-1] == NULL, leading to a NULL pointer\ndereference in the channel_stats loop.\n\nThis has been observed in production on BlueField-3 DPUs (arm64),\nwhere ovs-vswitchd queries netdev statistics over netlink during NIC\nbringup, racing mlx5e_open_channel() -\u003e mlx5e_channel_stats_alloc()\non another CPU:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0x840\n Hardware name: BlueField-3 DPU\n pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n Call trace:\n mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n dev_get_stats+0x50/0xc0\n ovs_vport_get_stats+0x38/0xac [openvswitch]\n ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]\n ovs_vport_cmd_get+0xbc/0x10c [openvswitch]\n genl_family_rcv_msg_doit+0xd0/0x160\n genl_rcv_msg+0xec/0x1f0\n netlink_rcv_skb+0x64/0x130\n genl_rcv+0x40/0x60\n netlink_unicast+0x2fc/0x370\n netlink_sendmsg+0x1dc/0x454\n ...\n __arm64_sys_sendmsg+0x2c/0x40\n\nAdd mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h\nthat wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.\nThe release/acquire pair establishes the contract:\n\n stats_nch == N =\u003e channel_stats[0..N-1] are visible and non-NULL.\n\nPublish the stats_nch increment via mlx5e_stats_nch_write() in the\nwriter (mlx5e_channel_stats_alloc()), and read stats_nch via\nmlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,\nmlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the\nsw_stats fold and the HV VHCA stats agent."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:09.273Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/df122c593735aa5e1c97457767aa10ed8fa972e0"
},
{
"url": "https://git.kernel.org/stable/c/268869794170af37727816ad02051808adb9c9c3"
},
{
"url": "https://git.kernel.org/stable/c/acd34d24342a28794e706ce8191ca6c3114a38ae"
},
{
"url": "https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045"
},
{
"url": "https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56"
},
{
"url": "https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9"
}
],
"title": "net/mlx5e: Fix publication race for priv-\u003echannel_stats[]",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72341",
"datePublished": "2026-08-15T05:55:47.764Z",
"dateReserved": "2026-08-09T03:40:39.920Z",
"dateUpdated": "2026-10-30T12:29:09.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92482 (GCVE-0-2026-92482)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
The gpio_chip is allocated with device-managed memory but registered with
the non-managed gpiochip_add_data(). This was harmless while the drivers
were built-in, but once they can be built as modules and unbound/rmmod'd,
devm frees the gpio_chip's memory while it is still registered, causing a
use-after-free.
Register it with devm_gpiochip_add_data() so it shares the same
device-managed lifecycle, which also lets the manual gpiochip_remove()
error paths go away.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a6df410d420aa4ff316797d352f69e7ebae5ff98 Version: a6df410d420aa4ff316797d352f69e7ebae5ff98 Version: a6df410d420aa4ff316797d352f69e7ebae5ff98 Version: a6df410d420aa4ff316797d352f69e7ebae5ff98 Version: a6df410d420aa4ff316797d352f69e7ebae5ff98 Version: a6df410d420aa4ff316797d352f69e7ebae5ff98 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/mediatek/pinctrl-moore.c",
"drivers/pinctrl/mediatek/pinctrl-mtk-common.c",
"drivers/pinctrl/mediatek/pinctrl-paris.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13a25cb4f0f0863afded5e915cb3bceede221426",
"status": "affected",
"version": "a6df410d420aa4ff316797d352f69e7ebae5ff98",
"versionType": "git"
},
{
"lessThan": "dc6e5d802c88468290fee8826dd3a54cf58da25a",
"status": "affected",
"version": "a6df410d420aa4ff316797d352f69e7ebae5ff98",
"versionType": "git"
},
{
"lessThan": "2490528a90a26f408ec3e95f865bad35454f9ff3",
"status": "affected",
"version": "a6df410d420aa4ff316797d352f69e7ebae5ff98",
"versionType": "git"
},
{
"lessThan": "01b5fcdc30c0ab35af960b60508eae1f7f7d32fd",
"status": "affected",
"version": "a6df410d420aa4ff316797d352f69e7ebae5ff98",
"versionType": "git"
},
{
"lessThan": "b8fa1098ee9f627d38bdf7c0ef6c1a6058a4165b",
"status": "affected",
"version": "a6df410d420aa4ff316797d352f69e7ebae5ff98",
"versionType": "git"
},
{
"lessThan": "9c650317ba553d297f3fc5f0ae40ec53d86f9dab",
"status": "affected",
"version": "a6df410d420aa4ff316797d352f69e7ebae5ff98",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/mediatek/pinctrl-moore.c",
"drivers/pinctrl/mediatek/pinctrl-mtk-common.c",
"drivers/pinctrl/mediatek/pinctrl-paris.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip\n\nThe gpio_chip is allocated with device-managed memory but registered with\nthe non-managed gpiochip_add_data(). This was harmless while the drivers\nwere built-in, but once they can be built as modules and unbound/rmmod\u0027d,\ndevm frees the gpio_chip\u0027s memory while it is still registered, causing a\nuse-after-free.\n\nRegister it with devm_gpiochip_add_data() so it shares the same\ndevice-managed lifecycle, which also lets the manual gpiochip_remove()\nerror paths go away."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:37.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13a25cb4f0f0863afded5e915cb3bceede221426"
},
{
"url": "https://git.kernel.org/stable/c/dc6e5d802c88468290fee8826dd3a54cf58da25a"
},
{
"url": "https://git.kernel.org/stable/c/2490528a90a26f408ec3e95f865bad35454f9ff3"
},
{
"url": "https://git.kernel.org/stable/c/01b5fcdc30c0ab35af960b60508eae1f7f7d32fd"
},
{
"url": "https://git.kernel.org/stable/c/b8fa1098ee9f627d38bdf7c0ef6c1a6058a4165b"
},
{
"url": "https://git.kernel.org/stable/c/9c650317ba553d297f3fc5f0ae40ec53d86f9dab"
}
],
"title": "pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-92482",
"datePublished": "2026-09-17T16:09:59.019Z",
"dateReserved": "2026-09-16T12:21:13.870Z",
"dateUpdated": "2026-10-30T12:35:37.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99211 (GCVE-0-2026-99211)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlink: reset skb headers before unicast and multicast filtering
Socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to
an skb's network and MAC headers. Netlink producers may reserve
headroom without resetting those headers, allowing a receiving socket's
filter to read data before the initialized message.
For example, IWPM HELLO replies are allocated with dev_alloc_skb(),
which reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can
attach a classic socket filter and disclose this headroom through the
length of the delivered reply. The resets in netlink_dump() do not help
because IWPM sends a separately allocated skb through netlink_unicast().
Reset both headers before running the receiver's filter in unicast and
broadcast delivery, as is already done for dump skbs. This also covers
other netlink producers that reserve headroom without changing their
allocation or message-building code.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b1153f29ee07dc1a788964409255a4b4fae50b98 Version: b1153f29ee07dc1a788964409255a4b4fae50b98 Version: b1153f29ee07dc1a788964409255a4b4fae50b98 Version: b1153f29ee07dc1a788964409255a4b4fae50b98 Version: b1153f29ee07dc1a788964409255a4b4fae50b98 Version: b1153f29ee07dc1a788964409255a4b4fae50b98 Version: b1153f29ee07dc1a788964409255a4b4fae50b98 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4123f8d2099863e2421187af9d87b45e8eebd867",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "6ec7cc02458c6a1509377a7f2eec9c7b1a355b5e",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "ea0e0fc4c72f71bd6d8bf460bfe309b61c35b548",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "c69db9e1f5cf886d4e3011313761a0f63a1d0da0",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "06791594274f87c29f1a9f1961d700272716a49d",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "06935da5de83aa8b98841563894857e7d2f80e47",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "8bf659bd54e1f00e34cf5244b1d289c506fa47c0",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb\u0027s network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket\u0027s\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in netlink_dump() do not help\nbecause IWPM sends a separately allocated skb through netlink_unicast().\n\nReset both headers before running the receiver\u0027s filter in unicast and\nbroadcast delivery, as is already done for dump skbs. This also covers\nother netlink producers that reserve headroom without changing their\nallocation or message-building code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:57.701Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4123f8d2099863e2421187af9d87b45e8eebd867"
},
{
"url": "https://git.kernel.org/stable/c/6ec7cc02458c6a1509377a7f2eec9c7b1a355b5e"
},
{
"url": "https://git.kernel.org/stable/c/ea0e0fc4c72f71bd6d8bf460bfe309b61c35b548"
},
{
"url": "https://git.kernel.org/stable/c/c69db9e1f5cf886d4e3011313761a0f63a1d0da0"
},
{
"url": "https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d"
},
{
"url": "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47"
},
{
"url": "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"
}
],
"title": "netlink: reset skb headers before unicast and multicast filtering",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99211",
"datePublished": "2026-10-28T10:36:04.864Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-30T12:42:57.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45961 (GCVE-0-2026-45961)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-11-06 16:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix memory leaks in gfs2_fill_super error path
Fix two memory leaks in the gfs2_fill_super() error handling path when
transitioning a filesystem to read-write mode fails.
First leak: kthread objects (thread_struct, task_struct, etc.)
When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the
created kernel threads (logd and quotad) are never destroyed. This
occurs because the fail_per_node label doesn't call
gfs2_destroy_threads().
Second leak: quota bitmap buffer (8192 bytes)
When gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but
before other operations complete, the allocated quota bitmap is never
freed.
The fix moves thread cleanup to the fail_per_node label to handle all
error paths uniformly. gfs2_destroy_threads() is safe to call
unconditionally as it checks for NULL pointers. Quota cleanup is added
in gfs2_make_fs_rw() to properly handle the withdrawal case where
quota initialization succeeds but the filesystem is then withdrawn.
Thread leak backtrace (gfs2_freeze_lock_shared failure):
unreferenced object 0xffff88801d7bca80 (size 4480):
copy_process+0x3a1/0x4670 kernel/fork.c:2422
kernel_clone+0xf3/0x6e0 kernel/fork.c:2779
kthread_create_on_node+0x100/0x150 kernel/kthread.c:478
init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611
gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265
Quota leak backtrace (gfs2_make_fs_rw failure):
unreferenced object 0xffff88812de7c000 (size 8192):
gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409
gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149
gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c2191e507147b1a22e9170ebb2aaa0f2902fcbfa Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: 2f8623377f3e0cfaa80558631b8694d02a492b4c Version: c713ebf2fe3f469e4af4de60a3427689ffb7c5d7 Version: 9fc32dad3cdba18669c71893f3e6d96905b39b3f Version: 6.1.16 ≤ Version: 5.10.173 ≤ Version: 5.15.99 ≤ Version: 6.2.3 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:03:04.826948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:03:16.501Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/gfs2/ops_fstype.c",
"fs/gfs2/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1fcca0f021ac8e2d19efddb6a733e8b6d4a3fb72",
"status": "affected",
"version": "c2191e507147b1a22e9170ebb2aaa0f2902fcbfa",
"versionType": "git"
},
{
"lessThan": "4db5e4c8f1103b21005ab9e7fe9a5d2554438b74",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"lessThan": "d049ba2c1723110f82227eaf521427980811169b",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"lessThan": "4456be93464a599eac0eb2afa63b5d662e1599d8",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"lessThan": "e54229ecf49add8451d5f765a32c86ab4446e06c",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"lessThan": "da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"status": "affected",
"version": "2f8623377f3e0cfaa80558631b8694d02a492b4c",
"versionType": "git"
},
{
"status": "affected",
"version": "c713ebf2fe3f469e4af4de60a3427689ffb7c5d7",
"versionType": "git"
},
{
"status": "affected",
"version": "9fc32dad3cdba18669c71893f3e6d96905b39b3f",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/gfs2/ops_fstype.c",
"fs/gfs2/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.173",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix memory leaks in gfs2_fill_super error path\n\nFix two memory leaks in the gfs2_fill_super() error handling path when\ntransitioning a filesystem to read-write mode fails.\n\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\ncreated kernel threads (logd and quotad) are never destroyed. This\noccurs because the fail_per_node label doesn\u0027t call\ngfs2_destroy_threads().\n\nSecond leak: quota bitmap buffer (8192 bytes)\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\nbefore other operations complete, the allocated quota bitmap is never\nfreed.\n\nThe fix moves thread cleanup to the fail_per_node label to handle all\nerror paths uniformly. gfs2_destroy_threads() is safe to call\nunconditionally as it checks for NULL pointers. Quota cleanup is added\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\nquota initialization succeeds but the filesystem is then withdrawn.\n\nThread leak backtrace (gfs2_freeze_lock_shared failure):\n unreferenced object 0xffff88801d7bca80 (size 4480):\n copy_process+0x3a1/0x4670 kernel/fork.c:2422\n kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\n kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\n init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\n gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\n\nQuota leak backtrace (gfs2_make_fs_rw failure):\n unreferenced object 0xffff88812de7c000 (size 8192):\n gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\n gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\n gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:52.033Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1fcca0f021ac8e2d19efddb6a733e8b6d4a3fb72"
},
{
"url": "https://git.kernel.org/stable/c/4db5e4c8f1103b21005ab9e7fe9a5d2554438b74"
},
{
"url": "https://git.kernel.org/stable/c/d049ba2c1723110f82227eaf521427980811169b"
},
{
"url": "https://git.kernel.org/stable/c/4456be93464a599eac0eb2afa63b5d662e1599d8"
},
{
"url": "https://git.kernel.org/stable/c/e54229ecf49add8451d5f765a32c86ab4446e06c"
},
{
"url": "https://git.kernel.org/stable/c/da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102"
}
],
"title": "gfs2: fix memory leaks in gfs2_fill_super error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45961",
"datePublished": "2026-05-27T12:18:17.637Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-11-06T16:03:16.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97501 (GCVE-0-2026-97501)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-30 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
pinctrl_gpio_direction_input() / pinctrl_gpio_direction_output() take
the pinctrl mutex. This causes a gpiochip operations to need to sleep.
Worse yet, the .can_sleep field in the gpiochip is not set. This causes
the shared GPIO proxy to trip over, as it uses gpiod_cansleep() to check
whether it can use a spinlock or needs a mutex. In this case, it ends
up taking a spinlock, then calls pinctrl_gpio_direction_output(), which
takes a mutex. This causes a huge warning.
While this class of Mediatek hardware does not have separate clear/set
registers, the pinctrl context has a spinlock that is taken whenever
a register read-modify-write is done. Also, once the GPIO function is
selected / muxed in, further GPIO operations do not involve pinctrl
operations or state. The GPIO direction and level values do not require
toggling the pinmux or any other pin config options.
Switch to directly calling mtk_pinmux_gpio_set_direction() in the GPIO
set direction callbacks to avoid taking the pinctrl mutex. Drop the
.gpio_set_direction field in mtk_pmxops to signal we are no longer using
the pinctrl GPIO layer for setting the direction.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/mediatek/pinctrl-paris.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1536772cb3e4aa8d63988051f6fd6e4bb005cf7",
"status": "affected",
"version": "805250982bb5c5ce4a6e52e1d87204c5feea0dd1",
"versionType": "git"
},
{
"lessThan": "482ba972f9638f467df2d498b46384a1d1f80529",
"status": "affected",
"version": "805250982bb5c5ce4a6e52e1d87204c5feea0dd1",
"versionType": "git"
},
{
"lessThan": "3c4897861759fd8bd81dc2ada92121ac76332592",
"status": "affected",
"version": "805250982bb5c5ce4a6e52e1d87204c5feea0dd1",
"versionType": "git"
},
{
"lessThan": "428b031dad390edd5da729b9afd474a95dc4f76b",
"status": "affected",
"version": "805250982bb5c5ce4a6e52e1d87204c5feea0dd1",
"versionType": "git"
},
{
"lessThan": "c87c9046c4e00d599454e033a477176c4d73ac2a",
"status": "affected",
"version": "805250982bb5c5ce4a6e52e1d87204c5feea0dd1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/mediatek/pinctrl-paris.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction\n\npinctrl_gpio_direction_input() / pinctrl_gpio_direction_output() take\nthe pinctrl mutex. This causes a gpiochip operations to need to sleep.\nWorse yet, the .can_sleep field in the gpiochip is not set. This causes\nthe shared GPIO proxy to trip over, as it uses gpiod_cansleep() to check\nwhether it can use a spinlock or needs a mutex. In this case, it ends\nup taking a spinlock, then calls pinctrl_gpio_direction_output(), which\ntakes a mutex. This causes a huge warning.\n\nWhile this class of Mediatek hardware does not have separate clear/set\nregisters, the pinctrl context has a spinlock that is taken whenever\na register read-modify-write is done. Also, once the GPIO function is\nselected / muxed in, further GPIO operations do not involve pinctrl\noperations or state. The GPIO direction and level values do not require\ntoggling the pinmux or any other pin config options.\n\nSwitch to directly calling mtk_pinmux_gpio_set_direction() in the GPIO\nset direction callbacks to avoid taking the pinctrl mutex. Drop the\n.gpio_set_direction field in mtk_pmxops to signal we are no longer using\nthe pinctrl GPIO layer for setting the direction."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:37:06.130Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1536772cb3e4aa8d63988051f6fd6e4bb005cf7"
},
{
"url": "https://git.kernel.org/stable/c/482ba972f9638f467df2d498b46384a1d1f80529"
},
{
"url": "https://git.kernel.org/stable/c/3c4897861759fd8bd81dc2ada92121ac76332592"
},
{
"url": "https://git.kernel.org/stable/c/428b031dad390edd5da729b9afd474a95dc4f76b"
},
{
"url": "https://git.kernel.org/stable/c/c87c9046c4e00d599454e033a477176c4d73ac2a"
}
],
"title": "pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97501",
"datePublished": "2026-09-24T16:04:48.101Z",
"dateReserved": "2026-09-24T16:01:01.151Z",
"dateUpdated": "2026-10-30T12:37:06.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97554 (GCVE-0-2026-97554)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-30 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
cifs_posix_to_fattr() ignores the return value of posix_info_parse().
When a malformed POSIX directory entry is encountered (e.g. invalid
SID lengths from an untrusted server), posix_info_parse() returns -1
without populating the 'parsed' struct. The uninitialized stack
memory in parsed.owner and parsed.group is then passed to
sid_to_id(), which processes the garbage bytes and passes them to
request_key() to construct a SID string, potentially leaking kernel
stack contents to the userspace idmap daemon.
Fix this by checking the return value and skipping the SID-to-id
mapping when parsing fails. The remaining fattr fields (timestamps,
mode, etc.) are populated directly from the 'info' pointer so they
are unaffected.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9934430e2178d5164eb1ac91a9b092f9e7e64745 Version: 9934430e2178d5164eb1ac91a9b092f9e7e64745 Version: 9934430e2178d5164eb1ac91a9b092f9e7e64745 Version: 9934430e2178d5164eb1ac91a9b092f9e7e64745 Version: 9934430e2178d5164eb1ac91a9b092f9e7e64745 Version: 9934430e2178d5164eb1ac91a9b092f9e7e64745 Version: dd80b98bdf0a4b3206739f3513b0518f27a7b4ef Version: d8e39c11f66125f49de55537a6efc8ecadf4a0f7 Version: 5.8.17 ≤ Version: 5.9.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/readdir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1915b69e36906968e2b698699d0f219875ae846e",
"status": "affected",
"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745",
"versionType": "git"
},
{
"lessThan": "604feb3e8141bf11f5afd48d36d401fee5af9536",
"status": "affected",
"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745",
"versionType": "git"
},
{
"lessThan": "33106019c3be57b5fc6411cfaad6d98214a51265",
"status": "affected",
"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745",
"versionType": "git"
},
{
"lessThan": "2be31f252ade791b84f7164991f14436aed1d4b9",
"status": "affected",
"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745",
"versionType": "git"
},
{
"lessThan": "c9a8b60ce140a68d172452f418137fc7ddbae7db",
"status": "affected",
"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745",
"versionType": "git"
},
{
"lessThan": "da6e25842431982d5a53cf00d925b98c690f4467",
"status": "affected",
"version": "9934430e2178d5164eb1ac91a9b092f9e7e64745",
"versionType": "git"
},
{
"status": "affected",
"version": "dd80b98bdf0a4b3206739f3513b0518f27a7b4ef",
"versionType": "git"
},
{
"status": "affected",
"version": "d8e39c11f66125f49de55537a6efc8ecadf4a0f7",
"versionType": "git"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.17",
"versionType": "semver"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/readdir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n\ncifs_posix_to_fattr() ignores the return value of posix_info_parse().\nWhen a malformed POSIX directory entry is encountered (e.g. invalid\nSID lengths from an untrusted server), posix_info_parse() returns -1\nwithout populating the \u0027parsed\u0027 struct. The uninitialized stack\nmemory in parsed.owner and parsed.group is then passed to\nsid_to_id(), which processes the garbage bytes and passes them to\nrequest_key() to construct a SID string, potentially leaking kernel\nstack contents to the userspace idmap daemon.\n\nFix this by checking the return value and skipping the SID-to-id\nmapping when parsing fails. The remaining fattr fields (timestamps,\nmode, etc.) are populated directly from the \u0027info\u0027 pointer so they\nare unaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:37:18.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1915b69e36906968e2b698699d0f219875ae846e"
},
{
"url": "https://git.kernel.org/stable/c/604feb3e8141bf11f5afd48d36d401fee5af9536"
},
{
"url": "https://git.kernel.org/stable/c/33106019c3be57b5fc6411cfaad6d98214a51265"
},
{
"url": "https://git.kernel.org/stable/c/2be31f252ade791b84f7164991f14436aed1d4b9"
},
{
"url": "https://git.kernel.org/stable/c/c9a8b60ce140a68d172452f418137fc7ddbae7db"
},
{
"url": "https://git.kernel.org/stable/c/da6e25842431982d5a53cf00d925b98c690f4467"
}
],
"title": "smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97554",
"datePublished": "2026-09-25T10:21:45.851Z",
"dateReserved": "2026-09-24T16:01:01.154Z",
"dateUpdated": "2026-10-30T12:37:18.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64060 (GCVE-0-2026-64060)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix leak of request in netfs_write_begin() error handling
Fix netfs_write_begin() to not leak our ref on the request in the event
that we get an error from netfs_wait_for_read().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64060",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:29:32.272226Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:25.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9192f304379187b396d56d6a1a406712c6bfa5a3",
"status": "affected",
"version": "4090b31422a6f24dfe701e31ffec7ba5804a7e2f",
"versionType": "git"
},
{
"lessThan": "22ae28aae43623be235ff455558cdd13fbe2daeb",
"status": "affected",
"version": "4090b31422a6f24dfe701e31ffec7ba5804a7e2f",
"versionType": "git"
},
{
"lessThan": "28686d6d8b60dc5bbae9ef6023ab2051d6c66cdf",
"status": "affected",
"version": "4090b31422a6f24dfe701e31ffec7ba5804a7e2f",
"versionType": "git"
},
{
"lessThan": "5046a34f0643441f05b0253ea64e1a3af87efe14",
"status": "affected",
"version": "4090b31422a6f24dfe701e31ffec7ba5804a7e2f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix leak of request in netfs_write_begin() error handling\n\nFix netfs_write_begin() to not leak our ref on the request in the event\nthat we get an error from netfs_wait_for_read()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:59.144Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9192f304379187b396d56d6a1a406712c6bfa5a3"
},
{
"url": "https://git.kernel.org/stable/c/22ae28aae43623be235ff455558cdd13fbe2daeb"
},
{
"url": "https://git.kernel.org/stable/c/28686d6d8b60dc5bbae9ef6023ab2051d6c66cdf"
},
{
"url": "https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14"
}
],
"title": "netfs: Fix leak of request in netfs_write_begin() error handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64060",
"datePublished": "2026-07-19T15:39:40.243Z",
"dateReserved": "2026-07-19T07:54:57.030Z",
"dateUpdated": "2026-11-06T16:34:25.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90061 (GCVE-0-2026-90061)
Vulnerability from cvelistv5
Published
2026-09-17 16:05
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: skip double clone set expressions on element insert
Both the dynset and newsetelem path clone the existing set expressions
when setting set element expressions if no override expressions are
provided. This results in a double clone, once to clone the template set
expressions then another clone on the new element. Add a flag to
annotate if userspace provides a override expression (ie. expression of
the same type of the set but different configuration), otherwise borrow
the existing expression from the set. Add conditionals to release
expression iif they represent an override. Use this new override_exprs
flag to dump the dynset expression override to userspace.
This simplifies the existing logic and it also fixes a bug with the
connlimit expression which results in a module refcount imbalance
WARNING splat when resorting on the default set expressions.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Version: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_dynset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "109bf28a90ac365ec4d25622c50959bb43b35ed4",
"status": "affected",
"version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
"versionType": "git"
},
{
"lessThan": "9cbf6da967ec8c6e8278b70353b712980a12d848",
"status": "affected",
"version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
"versionType": "git"
},
{
"lessThan": "04d1930072e694d9d03bfefdb7e1ebdc872a3d0c",
"status": "affected",
"version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
"versionType": "git"
},
{
"lessThan": "c6b56b8d549a043b6c8ff616db8748263eae05ae",
"status": "affected",
"version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
"versionType": "git"
},
{
"lessThan": "1e7fb6801d9cc826adcdb7fa0533c397730657f2",
"status": "affected",
"version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
"versionType": "git"
},
{
"lessThan": "43559058d21e0493aa220ac167e0279334dea5f9",
"status": "affected",
"version": "65038428b2c6c5be79d3f78a6b79c0cdc3a58a41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_dynset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: skip double clone set expressions on element insert\n\nBoth the dynset and newsetelem path clone the existing set expressions\nwhen setting set element expressions if no override expressions are\nprovided. This results in a double clone, once to clone the template set\nexpressions then another clone on the new element. Add a flag to\nannotate if userspace provides a override expression (ie. expression of\nthe same type of the set but different configuration), otherwise borrow\nthe existing expression from the set. Add conditionals to release\nexpression iif they represent an override. Use this new override_exprs\nflag to dump the dynset expression override to userspace.\n\nThis simplifies the existing logic and it also fixes a bug with the\nconnlimit expression which results in a module refcount imbalance\nWARNING splat when resorting on the default set expressions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:59.233Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/109bf28a90ac365ec4d25622c50959bb43b35ed4"
},
{
"url": "https://git.kernel.org/stable/c/9cbf6da967ec8c6e8278b70353b712980a12d848"
},
{
"url": "https://git.kernel.org/stable/c/04d1930072e694d9d03bfefdb7e1ebdc872a3d0c"
},
{
"url": "https://git.kernel.org/stable/c/c6b56b8d549a043b6c8ff616db8748263eae05ae"
},
{
"url": "https://git.kernel.org/stable/c/1e7fb6801d9cc826adcdb7fa0533c397730657f2"
},
{
"url": "https://git.kernel.org/stable/c/43559058d21e0493aa220ac167e0279334dea5f9"
}
],
"title": "netfilter: nf_tables: skip double clone set expressions on element insert",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90061",
"datePublished": "2026-09-17T16:05:45.182Z",
"dateReserved": "2026-09-11T19:38:34.784Z",
"dateUpdated": "2026-10-30T12:33:59.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72423 (GCVE-0-2026-72423)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Guard conntrack opts error writes
The conntrack lookup and allocation kfuncs take an opts pointer
together with an opts__sz argument. The verifier checks only the memory
range described by opts__sz, but the wrappers unconditionally write
opts->error whenever the internal lookup or allocation helper returns an
error.
For an invalid size smaller than the end of opts->error, that write can
land outside the verifier-checked range. Keep returning NULL for invalid
arguments, but only report the error through opts->error when the
supplied size includes the field.
This preserves error reporting for the supported 12-byte and 16-byte
layouts, and for other invalid sizes that still include opts->error.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 Version: b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 Version: b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 Version: b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 Version: b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 Version: b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:49:41.501757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:23.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6fd973def4d6cb89aaf7e9b6bc26cac977f6da13",
"status": "affected",
"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6",
"versionType": "git"
},
{
"lessThan": "669bc3b345712112d3f033a1953f5a10b15e7c65",
"status": "affected",
"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6",
"versionType": "git"
},
{
"lessThan": "63d95c6bbd6fc0e411404188306a1fea456300b0",
"status": "affected",
"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6",
"versionType": "git"
},
{
"lessThan": "453f4f1e90de55b6bc297936031b68bef93f2e28",
"status": "affected",
"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6",
"versionType": "git"
},
{
"lessThan": "dd74c80203842a21b2ebb9f70d1260d9aa20fa05",
"status": "affected",
"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6",
"versionType": "git"
},
{
"lessThan": "6f6183a39533d727deaa5061cadae6dd9e6744d0",
"status": "affected",
"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts-\u003eerror whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts-\u003eerror, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts-\u003eerror when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts-\u003eerror."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires loading and attaching a BPF XDP or TC program that calls the conntrack kfuncs via the bpf() syscall; per kernel CNA guidance BPF/netfilter paths are Local even when programs later run on network packets.\nAC:L - An attacker reliably triggers the bug by calling bpf_xdp_ct_lookup/alloc or bpf_skb_ct_lookup/alloc with opts__sz smaller than the error field (e.g. 4); the helper returns EINVAL and the wrapper performs the out-of-bounds write with no races or attacker-uncontrollable conditions.\nPR:L - Loading BPF_PROG_TYPE_XDP or BPF_PROG_TYPE_SCHED_CLS programs requires CAP_NET_ADMIN, which unprivileged users can obtain inside user/network namespaces (unshare -Urn) on typical Linux deployments without init-namespace root.\nUI:N - No victim interaction is required; the attacker loads their own BPF program and invokes the kfunc with a small opts__sz to trigger the out-of-bounds write on demand.\nS:C - Corrupting kernel memory via a verifier-bypassing BPF stack write from a user/network namespace can cross the namespace/container trust boundary to compromise the host kernel, exceeding the attacker\u0027s original security scope.\nC:H - The bug is a controlled 4-byte out-of-bounds write past the verifier-approved opts buffer on the BPF stack, a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Writing opts-\u003eerror outside the verifier-checked range corrupts adjacent BPF stack slots with attacker-influenced errno values, enabling heap/stack grooming and control-flow hijacking toward arbitrary kernel code execution.\nA:H - Corrupting BPF stack memory outside verifier bounds can cause immediate kernel oops/panic or be used in a repeatable crash/DoS loop when the attached XDP/TC program runs on incoming traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:22.084Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6fd973def4d6cb89aaf7e9b6bc26cac977f6da13"
},
{
"url": "https://git.kernel.org/stable/c/669bc3b345712112d3f033a1953f5a10b15e7c65"
},
{
"url": "https://git.kernel.org/stable/c/63d95c6bbd6fc0e411404188306a1fea456300b0"
},
{
"url": "https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28"
},
{
"url": "https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05"
},
{
"url": "https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0"
}
],
"title": "bpf: Guard conntrack opts error writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72423",
"datePublished": "2026-08-15T05:56:41.711Z",
"dateReserved": "2026-08-09T03:40:39.928Z",
"dateUpdated": "2026-10-30T12:29:22.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64190 (GCVE-0-2026-64190)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: team: fix NULL pointer dereference in team_xmit during mode change
__team_change_mode() clears team->ops with memset() before restoring
safe dummy handlers via team_adjust_ops(). A concurrent team_xmit()
running under RCU on another CPU can read team->ops.transmit during
this window and call a NULL function pointer, crashing the kernel.
The race requires a mode change (CAP_NET_ADMIN) concurrent with
transmit on the team device.
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0010 [#1] SMP KASAN NOPTI
RIP: 0010:0x0
Call Trace:
team_xmit (drivers/net/team/team_core.c:1853)
dev_hard_start_xmit (net/core/dev.c:3904)
__dev_queue_xmit (net/core/dev.c:4871)
packet_sendmsg (net/packet/af_packet.c:3109)
__sys_sendto (net/socket.c:2265)
The original code assumed that no ports means no traffic, so mode
changes could freely memset()/memcpy() the ops. AF_PACKET with
forced carrier breaks that assumption.
Prevent the race instead of making it safe: replace memset()/memcpy()
with per-field updates that never touch transmit or receive. Those
two handlers are managed solely by team_adjust_ops(), which already
installs dummies when tx_en_port_count == 0 (always true during mode
change since no ports are present). WRITE_ONCE/READ_ONCE prevent
store/load tearing on the handler pointers.
synchronize_net() before exit_op() drains in-flight readers that may
still reference old mode state from before port removal switched the
handlers to dummies.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64190",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:31:58.842626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:29.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d61bf3bc17de1e18cbdac94cf5389bb9dc2ddfe7",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "ac342f86638f5e184c8511cff12a421aea56acc6",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "a879f78c478cee77f4bd43e92225a640c23f45d4",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "9486377e5e971988a3add171c398eb654a866fab",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "cde5c7f0286c4203d0abc7248201542aa8bf33bb",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "03e9405c518c4d61f28079492f252d6d4e2bac5c",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "25fe708bbc59289d3d1ea4b126fbc1b460a072a5",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: fix NULL pointer dereference in team_xmit during mode change\n\n__team_change_mode() clears team-\u003eops with memset() before restoring\nsafe dummy handlers via team_adjust_ops(). A concurrent team_xmit()\nrunning under RCU on another CPU can read team-\u003eops.transmit during\nthis window and call a NULL function pointer, crashing the kernel.\n\nThe race requires a mode change (CAP_NET_ADMIN) concurrent with\ntransmit on the team device.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n Oops: 0010 [#1] SMP KASAN NOPTI\n RIP: 0010:0x0\n Call Trace:\n team_xmit (drivers/net/team/team_core.c:1853)\n dev_hard_start_xmit (net/core/dev.c:3904)\n __dev_queue_xmit (net/core/dev.c:4871)\n packet_sendmsg (net/packet/af_packet.c:3109)\n __sys_sendto (net/socket.c:2265)\n\nThe original code assumed that no ports means no traffic, so mode\nchanges could freely memset()/memcpy() the ops. AF_PACKET with\nforced carrier breaks that assumption.\n\nPrevent the race instead of making it safe: replace memset()/memcpy()\nwith per-field updates that never touch transmit or receive. Those\ntwo handlers are managed solely by team_adjust_ops(), which already\ninstalls dummies when tx_en_port_count == 0 (always true during mode\nchange since no ports are present). WRITE_ONCE/READ_ONCE prevent\nstore/load tearing on the handler pointers.\n\nsynchronize_net() before exit_op() drains in-flight readers that may\nstill reference old mode state from before port removal switched the\nhandlers to dummies."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:40.497Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d61bf3bc17de1e18cbdac94cf5389bb9dc2ddfe7"
},
{
"url": "https://git.kernel.org/stable/c/ac342f86638f5e184c8511cff12a421aea56acc6"
},
{
"url": "https://git.kernel.org/stable/c/a879f78c478cee77f4bd43e92225a640c23f45d4"
},
{
"url": "https://git.kernel.org/stable/c/9486377e5e971988a3add171c398eb654a866fab"
},
{
"url": "https://git.kernel.org/stable/c/cde5c7f0286c4203d0abc7248201542aa8bf33bb"
},
{
"url": "https://git.kernel.org/stable/c/03e9405c518c4d61f28079492f252d6d4e2bac5c"
},
{
"url": "https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"
}
],
"title": "net: team: fix NULL pointer dereference in team_xmit during mode change",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64190",
"datePublished": "2026-07-20T16:27:48.314Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-11-06T16:34:29.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74350 (GCVE-0-2026-74350)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate fast symlink target during inode read
ocfs2_validate_inode_block() already rejects several inconsistent
self-contained dinodes before they are exposed to the rest of the
filesystem. Fast symlinks need the same treatment.
A zero-cluster symlink is treated as a fast symlink and later read through
page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses
strnlen() on the inline payload and then copies len + 1 bytes into the
folio. If a corrupt dinode stores an i_size that does not fit the inline
area or omits the terminating NUL at i_size, that copy reads past the end
of the inode block buffer.
Reject zero-cluster symlink dinodes whose i_size exceeds the inline
fast-symlink capacity or whose inline payload is not NUL-terminated
exactly at i_size when the inode block is validated. This keeps malformed
fast symlinks from reaching the read path.
Validation reproduced this kernel report:
KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0
RIP: 0033:0x7f5c6d859aa7
Read of size 3905
Call trace:
dump_stack_lvl+0x66/0xa0 (?:?)
print_report+0xce/0x630 (?:?)
ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
__virt_addr_valid+0x19f/0x330 (?:?)
kasan_report+0xe0/0x110 (?:?)
kasan_check_range+0x105/0x1b0 (?:?)
__asan_memcpy+0x23/0x60 (?:?)
filemap_read_folio+0x27/0xe0 (?:?)
filemap_read_folio+0x35/0xe0 (?:?)
do_read_cache_folio+0x138/0x230 (?:?)
__page_get_link+0x26/0x110 (?:?)
page_get_link+0x2e/0x70 (?:?)
vfs_readlink+0x15e/0x250 (?:?)
touch_atime+0x4d/0x370 (?:?)
do_readlinkat+0x186/0x200 (?:?)
do_user_addr_fault+0x65a/0x890 (?:?)
__x64_sys_readlink+0x46/0x60 (?:?)
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1 Version: ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1 Version: ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1 Version: ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1 Version: ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1 Version: ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed9f95ee3bbaea9b05808727eb86ea5e5ccf2b52",
"status": "affected",
"version": "ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1",
"versionType": "git"
},
{
"lessThan": "dcabbf7da43825e23e5e89adccc1430faee1bce1",
"status": "affected",
"version": "ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1",
"versionType": "git"
},
{
"lessThan": "030d4caae89977b80349df95523dfda1dfb10f73",
"status": "affected",
"version": "ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1",
"versionType": "git"
},
{
"lessThan": "d94bf50756d7f80bb728ad58246376649e1035b6",
"status": "affected",
"version": "ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1",
"versionType": "git"
},
{
"lessThan": "f9e2cb692b77a679b1f4cc2b7b277fa908586533",
"status": "affected",
"version": "ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1",
"versionType": "git"
},
{
"lessThan": "e234973f286ed2e8961a24561ec91594ec3e3ff8",
"status": "affected",
"version": "ea022dfb3c2a4680483b00eb2fecc9fc4f6091d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate fast symlink target during inode read\n\nocfs2_validate_inode_block() already rejects several inconsistent\nself-contained dinodes before they are exposed to the rest of the\nfilesystem. Fast symlinks need the same treatment.\n\nA zero-cluster symlink is treated as a fast symlink and later read through\npage_get_link() and ocfs2_fast_symlink_read_folio(). That path uses\nstrnlen() on the inline payload and then copies len + 1 bytes into the\nfolio. If a corrupt dinode stores an i_size that does not fit the inline\narea or omits the terminating NUL at i_size, that copy reads past the end\nof the inode block buffer.\n\nReject zero-cluster symlink dinodes whose i_size exceeds the inline\nfast-symlink capacity or whose inline payload is not NUL-terminated\nexactly at i_size when the inode block is validated. This keeps malformed\nfast symlinks from reaching the read path.\n\nValidation reproduced this kernel report:\nKASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0\nRIP: 0033:0x7f5c6d859aa7\nRead of size 3905\nCall trace:\n dump_stack_lvl+0x66/0xa0 (?:?)\n print_report+0xce/0x630 (?:?)\n ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x19f/0x330 (?:?)\n kasan_report+0xe0/0x110 (?:?)\n kasan_check_range+0x105/0x1b0 (?:?)\n __asan_memcpy+0x23/0x60 (?:?)\n filemap_read_folio+0x27/0xe0 (?:?)\n filemap_read_folio+0x35/0xe0 (?:?)\n do_read_cache_folio+0x138/0x230 (?:?)\n __page_get_link+0x26/0x110 (?:?)\n page_get_link+0x2e/0x70 (?:?)\n vfs_readlink+0x15e/0x250 (?:?)\n touch_atime+0x4d/0x370 (?:?)\n do_readlinkat+0x186/0x200 (?:?)\n do_user_addr_fault+0x65a/0x890 (?:?)\n __x64_sys_readlink+0x46/0x60 (?:?)\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - OCFS2 cluster nodes commonly NFS-export shared LUNs; nfsd READLINK reaches vfs_readlink\u2192page_get_link\u2192ocfs2_fast_symlink_read_folio on a forged zero-cluster symlink dinode on the volume, giving a remote network attack path without a local syscall.\nAC:L - A forged dinode fully controls i_size and inline bytes; strnlen() bounded only by ocfs2_fast_symlink_chars() then memcpy_to_folio() copies len+1 past the inode buffer_head (KASAN read ~3905), deterministically and without races.\nPR:N - Triggering needs only permission to read the symlink: a remote NFS client on an exported share, or any unprivileged local/cluster user; planting the malformed dinode uses attacker-controlled on-disk metadata on shared storage, not init-namespace root on the victim.\nUI:N - Once the corrupt fast symlink exists on a mounted/exported volume, readlink(2), NFS READLINK, or path lookup via get_link automatically pulls the inline target through ocfs2_fast_symlink_read_folio with no further deliberate victim action.\nS:U - Impact stays within the host kernel parsing the OCFS2 symlink (memory disclosure/crash/privilege escalation on the server); no VM escape, IOMMU bypass, or cross-authority scope change.\nC:H - memcpy_to_folio() performs an out-of-bounds read up to ~3900 bytes past the inode block buffer (KASAN UAF/slab read of size 3905); OOB/UAF kernel reads enable arbitrary adjacent-heap disclosure.\nI:H - The same unvalidated strnlen/memcpy path corrupts kernel memory semantics (KASAN UAF) and, per kernel CNA guidance, UAF/OOB reads adjacent slab objects can be leveraged into write/control-flow primitives via heap grooming.\nA:H - KASAN reports use-after-free in ocfs2_fast_symlink_read_folio during the over-wide memcpy; such kernel memory faults typically oops/panic the host, fully denying availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:50.024Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed9f95ee3bbaea9b05808727eb86ea5e5ccf2b52"
},
{
"url": "https://git.kernel.org/stable/c/dcabbf7da43825e23e5e89adccc1430faee1bce1"
},
{
"url": "https://git.kernel.org/stable/c/030d4caae89977b80349df95523dfda1dfb10f73"
},
{
"url": "https://git.kernel.org/stable/c/d94bf50756d7f80bb728ad58246376649e1035b6"
},
{
"url": "https://git.kernel.org/stable/c/f9e2cb692b77a679b1f4cc2b7b277fa908586533"
},
{
"url": "https://git.kernel.org/stable/c/e234973f286ed2e8961a24561ec91594ec3e3ff8"
}
],
"title": "ocfs2: validate fast symlink target during inode read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74350",
"datePublished": "2026-08-15T05:58:37.298Z",
"dateReserved": "2026-08-15T05:44:03.886Z",
"dateUpdated": "2026-10-30T12:29:50.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43485 (GCVE-0-2026-43485)
Vulnerability from cvelistv5
Published
2026-05-13 15:08
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nouveau/gsp: drop WARN_ON in ACPI probes
These WARN_ONs seem to trigger a lot, and we don't seem to have a
plan to fix them, so just drop them, as they are most likely
harmless.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2bbb55c4e6665e35a2ebb856d393802753017b2d",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
},
{
"lessThan": "214b6bde0e941a34ba877cf2f26f85d62fb5d598",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
},
{
"lessThan": "d1c991c860496d97044802ea54b30f20db468c1d",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
},
{
"lessThan": "9478c166c46934160135e197b049b5a05753f2ad",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/gsp: drop WARN_ON in ACPI probes\n\nThese WARN_ONs seem to trigger a lot, and we don\u0027t seem to have a\nplan to fix them, so just drop them, as they are most likely\nharmless."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:51.314Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2bbb55c4e6665e35a2ebb856d393802753017b2d"
},
{
"url": "https://git.kernel.org/stable/c/214b6bde0e941a34ba877cf2f26f85d62fb5d598"
},
{
"url": "https://git.kernel.org/stable/c/d1c991c860496d97044802ea54b30f20db468c1d"
},
{
"url": "https://git.kernel.org/stable/c/9478c166c46934160135e197b049b5a05753f2ad"
}
],
"title": "nouveau/gsp: drop WARN_ON in ACPI probes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43485",
"datePublished": "2026-05-13T15:08:31.508Z",
"dateReserved": "2026-05-01T14:12:56.012Z",
"dateUpdated": "2026-10-21T12:40:51.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64079 (GCVE-0-2026-64079)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: allocate hook ops while under mutex
arp/ip(6)t_register_table() add the table to the per-netns list via
xt_register_table() before allocating the per-netns hook ops copy
via kmemdup_array(). This leaves a window where the table is
visible in the list with ops=NULL.
If the pernet exit happens runs concurrently the pre_exit callback finds
the table via xt_find_table() and passes the NULL ops pointer to
nf_unregister_net_hooks(), causing a NULL dereference:
general protection fault in nf_unregister_net_hooks+0xbc/0x150
RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)
Call Trace:
ipt_unregister_table_pre_exit
iptable_mangle_net_pre_exit
ops_pre_exit_list
cleanup_net
Fix by moving the ops allocation into the xtables core so the table is
never in the list without valid ops. Also ensure the table is no longer
processing packets before its torn down on error unwind.
nf_register_net_hooks might have published at least one hook; call
synchronize_rcu() if there was an error.
audit log register message gets deferred until all operations have
passed, this avoids need to emit another ureg message in case of
error unwinding.
Based on earlier patch by Tristan Madani.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:29:48.142762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:25.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netfilter/x_tables.h",
"net/ipv4/netfilter/arp_tables.c",
"net/ipv4/netfilter/ip_tables.c",
"net/ipv6/netfilter/ip6_tables.c",
"net/netfilter/x_tables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ea15e78232253e657d352e625fb4913e2f57e63",
"status": "affected",
"version": "ae689334225ff0e4ef112459ecd24aea932c2b00",
"versionType": "git"
},
{
"lessThan": "693bffd742dd4fa9a0076ed120545af3679c588b",
"status": "affected",
"version": "ae689334225ff0e4ef112459ecd24aea932c2b00",
"versionType": "git"
},
{
"lessThan": "f669571a2bf5067f50091cc598df9613663ee226",
"status": "affected",
"version": "ae689334225ff0e4ef112459ecd24aea932c2b00",
"versionType": "git"
},
{
"lessThan": "2f92c5f923979f37ab1d5445381e4b8378a196cc",
"status": "affected",
"version": "ae689334225ff0e4ef112459ecd24aea932c2b00",
"versionType": "git"
},
{
"lessThan": "b62eb8dcf2c47d4d676a434efbd57c4f776f7829",
"status": "affected",
"version": "ae689334225ff0e4ef112459ecd24aea932c2b00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netfilter/x_tables.h",
"net/ipv4/netfilter/arp_tables.c",
"net/ipv4/netfilter/ip_tables.c",
"net/ipv6/netfilter/ip6_tables.c",
"net/netfilter/x_tables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: allocate hook ops while under mutex\n\narp/ip(6)t_register_table() add the table to the per-netns list via\nxt_register_table() before allocating the per-netns hook ops copy\nvia kmemdup_array(). This leaves a window where the table is\nvisible in the list with ops=NULL.\n\nIf the pernet exit happens runs concurrently the pre_exit callback finds\nthe table via xt_find_table() and passes the NULL ops pointer to\nnf_unregister_net_hooks(), causing a NULL dereference:\n\n general protection fault in nf_unregister_net_hooks+0xbc/0x150\n RIP: nf_unregister_net_hooks (net/netfilter/core.c:613)\n Call Trace:\n ipt_unregister_table_pre_exit\n iptable_mangle_net_pre_exit\n ops_pre_exit_list\n cleanup_net\n\nFix by moving the ops allocation into the xtables core so the table is\nnever in the list without valid ops. Also ensure the table is no longer\nprocessing packets before its torn down on error unwind.\nnf_register_net_hooks might have published at least one hook; call\nsynchronize_rcu() if there was an error.\n\naudit log register message gets deferred until all operations have\npassed, this avoids need to emit another ureg message in case of\nerror unwinding.\n\nBased on earlier patch by Tristan Madani."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:03.518Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ea15e78232253e657d352e625fb4913e2f57e63"
},
{
"url": "https://git.kernel.org/stable/c/693bffd742dd4fa9a0076ed120545af3679c588b"
},
{
"url": "https://git.kernel.org/stable/c/f669571a2bf5067f50091cc598df9613663ee226"
},
{
"url": "https://git.kernel.org/stable/c/2f92c5f923979f37ab1d5445381e4b8378a196cc"
},
{
"url": "https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829"
}
],
"title": "netfilter: x_tables: allocate hook ops while under mutex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64079",
"datePublished": "2026-07-19T15:39:52.192Z",
"dateReserved": "2026-07-19T07:54:57.031Z",
"dateUpdated": "2026-11-06T16:34:25.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90351 (GCVE-0-2026-90351)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
If the WED attach for the primary PCIe function fails, the probe path
still attached wed_hif2 for the secondary function, leaving the device
in an inconsistent half-WED configuration that crashes later. The hif2
call also re-enabled hwrro_mode, which the failed primary attach had
just turned off.
Skip the hif2 WED setup when the primary WED device is not active.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mmio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d1fd637336588d8118c104a025eca1341d9ec85",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
},
{
"lessThan": "76144da3c6184c7850631ad79d0600ac8bf7649a",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
},
{
"lessThan": "d566387df8306257d2f703a0d99fd9896400317e",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
},
{
"lessThan": "7c1924332e986019c6bcddf55c843361cccac73f",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mmio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed\n\nIf the WED attach for the primary PCIe function fails, the probe path\nstill attached wed_hif2 for the secondary function, leaving the device\nin an inconsistent half-WED configuration that crashes later. The hif2\ncall also re-enabled hwrro_mode, which the failed primary attach had\njust turned off.\n\nSkip the hif2 WED setup when the primary WED device is not active."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:14.533Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d1fd637336588d8118c104a025eca1341d9ec85"
},
{
"url": "https://git.kernel.org/stable/c/76144da3c6184c7850631ad79d0600ac8bf7649a"
},
{
"url": "https://git.kernel.org/stable/c/d566387df8306257d2f703a0d99fd9896400317e"
},
{
"url": "https://git.kernel.org/stable/c/7c1924332e986019c6bcddf55c843361cccac73f"
}
],
"title": "wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90351",
"datePublished": "2026-09-17T16:08:58.905Z",
"dateReserved": "2026-09-11T19:38:34.805Z",
"dateUpdated": "2026-10-21T12:51:14.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68400 (GCVE-0-2026-68400)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
Use the descriptor's `ep_mem_offset` to calculate the start of the endpoint
memory access array and to comply with the FF-A spec instead of defaulting
to `sizeof(struct ffa_mem_region)`.
This requires moving `ffa_mem_region_additional_setup()` earlier in the setup
flow.
Also, add sanity checks to ensure the calculated descriptor offsets do not
exceed `max_fragsize`.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c",
"include/linux/arm_ffa.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e902bea625b710f8bf2f40b4ae4b14fa6a33f13",
"status": "affected",
"version": "113580530ee7dc61e668b641d657920734533b9f",
"versionType": "git"
},
{
"lessThan": "b39b08e6bee812514b449dc874076890e6b871a0",
"status": "affected",
"version": "113580530ee7dc61e668b641d657920734533b9f",
"versionType": "git"
},
{
"lessThan": "8ef18f0ab3c0ec1eac77289f5a542bd96a8a6d66",
"status": "affected",
"version": "113580530ee7dc61e668b641d657920734533b9f",
"versionType": "git"
},
{
"lessThan": "b4d961351aa84fdf0148783fb1f3a1391b8a0adb",
"status": "affected",
"version": "113580530ee7dc61e668b641d657920734533b9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c",
"include/linux/arm_ffa.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation\n\nUse the descriptor\u0027s `ep_mem_offset` to calculate the start of the endpoint\nmemory access array and to comply with the FF-A spec instead of defaulting\nto `sizeof(struct ffa_mem_region)`.\nThis requires moving `ffa_mem_region_additional_setup()` earlier in the setup\nflow.\nAlso, add sanity checks to ensure the calculated descriptor offsets do not\nexceed `max_fragsize`."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable FF-A memory-descriptor setup is reached only through local kernel interfaces \u2014 TEE device ioctls (/dev/tee*) driving optee/tstee shared-memory registration and lend paths, or host-side FF-A SMC handling. No network or remote packet input reaches this code.\nAC:L - The out-of-bounds descriptor writes follow deterministically from the endpoint count and offsets used to build the transaction; no race, no memory-layout luck, and no condition outside the attacker\u0027s influence is needed to drive the unvalidated offset arithmetic past max_fragsize.\nPR:L - An unprivileged local process holding a handle to the TEE device node (common on Android/embedded ARM systems, where TEE clients are ordinary user processes) can drive ffa_setup_and_transmit() via shared-memory registration/lend operations; no root or capability check gates that path.\nUI:N - The vulnerable path is entered directly from the attacker\u0027s own ioctl/FF-A operations; no action by another user or administrator is required.\nS:U - The out-of-bounds writes corrupt kernel memory adjacent to the FF-A TX buffer within the same kernel security authority, so impact is scored as Unchanged even though the same offset confusion also feeds the pKVM/secure-world descriptor parsing.\nC:H - Descriptor offsets computed without validation against max_fragsize let structured data be placed and read back outside the intended buffer, and the resulting heap corruption is leverageable into disclosure of adjacent kernel memory, including data later handed to the secure world.\nI:H - This is an out-of-bounds write of attacker-influenced endpoint descriptor fields (receiver, attrs, composite_off, impdef values) plus a memset past the end of the TX buffer, giving heap corruption that can be groomed into a control-flow or data-structure overwrite primitive.\nA:H - Writing endpoint memory access descriptors beyond the RX/TX buffer corrupts unrelated kernel allocations and readily produces an oops or panic, and the mis-parsed descriptor can also drive the memory transaction into an inconsistent state with the secure partition."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:58.807Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e902bea625b710f8bf2f40b4ae4b14fa6a33f13"
},
{
"url": "https://git.kernel.org/stable/c/b39b08e6bee812514b449dc874076890e6b871a0"
},
{
"url": "https://git.kernel.org/stable/c/8ef18f0ab3c0ec1eac77289f5a542bd96a8a6d66"
},
{
"url": "https://git.kernel.org/stable/c/b4d961351aa84fdf0148783fb1f3a1391b8a0adb"
}
],
"title": "firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68400",
"datePublished": "2026-08-10T12:04:19.952Z",
"dateReserved": "2026-07-30T09:28:09.389Z",
"dateUpdated": "2026-10-21T12:43:58.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74261 (GCVE-0-2026-74261)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: avoid stale FIFO cells during resize
snd_seq_fifo_resize() still needs to publish the replacement pool
before it waits for FIFO users. A blocking snd_seq_read() holds
f->use_lock while it sleeps, so concurrent senders must be able to
queue to the new pool and wake that reader instead of failing against a
closing old pool.
However, snd_seq_fifo_event_in() duplicates an event before it takes
f->lock, and snd_seq_read() can dequeue a cell and later call
snd_seq_fifo_cell_putback() if copy_to_user() or
snd_seq_expand_var_event() fails. If resize swaps f->pool and detaches
oldhead in between, either path can relink an old-pool cell after the
snapshot. That stale cell sits outside the drained oldhead list, keeps
oldpool->counter elevated, and can leave snd_seq_pool_delete() waiting
for the retired pool to drain.
Keep the existing swap-before-wait ordering in snd_seq_fifo_resize(),
but reject stale cells before any FIFO relink. Revalidate event-in cells
under f->lock and retry them against the published replacement pool, and
free stale putback cells instead of linking them back into the FIFO.
The buggy scenario involves two paths, with each column showing the
order within that path:
resize path: relink path:
1. Allocate newpool. 1. Take f->use_lock.
2. Swap f->pool to newpool and 2. Duplicate or dequeue an old-pool
detach oldhead. cell before oldpool closes.
3. Mark oldpool closing and 3. Reach a later relink point after
wait for FIFO users. resize published newpool.
4. Free oldhead and delete 4. Relink the old-pool cell after
oldpool. resize detached oldhead.
5. Drop f->use_lock.
The reproducer reports a resize ioctl blocked in the expected pool
teardown path:
signal: resize iteration=98 target_pool=4 exceeded 250ms
(elapsed=251ms)
diagnostic: resize_tid=651 wchan=snd_seq_pool_done
diagnostic: resize_tid=651 stack=
snd_seq_pool_done+0x5b/0x140
snd_seq_pool_delete+0x7a/0x90
snd_seq_fifo_resize+0x193/0x1e0
snd_seq_ioctl_set_client_pool+0x214/0x260
snd_seq_ioctl+0x119/0x540
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
A second run with larger pools hit the same target path:
signal: resize iteration=32 target_pool=64 exceeded 250ms
(elapsed=251ms)
diagnostic: resize_tid=663 wchan=snd_seq_pool_done
diagnostic: resize_tid=663 stack=
snd_seq_pool_done+0x5b/0x140
snd_seq_pool_delete+0x7a/0x90
snd_seq_fifo_resize+0x193/0x1e0
snd_seq_ioctl_set_client_pool+0x214/0x260
snd_seq_ioctl+0x119/0x540
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110 Version: 28e0ebdd57cd3287ac821068364b74c70af3861c Version: d4b8e8a32d74052fe292618ae19f794944ddc673 Version: e91325f27c4d98d1088e9e86b3ab475f752eeb80 Version: 9ebfed203c0d93449a074c5c2fd5bb3e58518f0d Version: 3492352e1f34673708fa7409b4b1d97545aa2f1c Version: a90d7447e4a154ad26e3b9e09a0878680be49339 Version: 74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf Version: c36ef6467420f8982e6d4d6f93d0634a85a5ee45 Version: 3.2.91 ≤ Version: 3.10.107 ≤ Version: 3.12.73 ≤ Version: 3.16.46 ≤ Version: 3.18.50 ≤ Version: 4.1.40 ≤ Version: 4.4.60 ≤ Version: 4.9.21 ≤ Version: 4.10.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_fifo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8bb506ffb848e3de1496a4cf23a2fd694da2a7d2",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "ae429220c7f9747579bc4682c574585230e971cc",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "dcf784abee6df2f5c47e36a1d9e400065993bc04",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "98a965cb1e767b54b6bbd831b6cea26f521a8f51",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "1c4c35fb68d520241f7d9f1c356b5e2370fd8364",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "e546128291f8d688dcb931827e2efd2aa6c0734d",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"status": "affected",
"version": "df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110",
"versionType": "git"
},
{
"status": "affected",
"version": "28e0ebdd57cd3287ac821068364b74c70af3861c",
"versionType": "git"
},
{
"status": "affected",
"version": "d4b8e8a32d74052fe292618ae19f794944ddc673",
"versionType": "git"
},
{
"status": "affected",
"version": "e91325f27c4d98d1088e9e86b3ab475f752eeb80",
"versionType": "git"
},
{
"status": "affected",
"version": "9ebfed203c0d93449a074c5c2fd5bb3e58518f0d",
"versionType": "git"
},
{
"status": "affected",
"version": "3492352e1f34673708fa7409b4b1d97545aa2f1c",
"versionType": "git"
},
{
"status": "affected",
"version": "a90d7447e4a154ad26e3b9e09a0878680be49339",
"versionType": "git"
},
{
"status": "affected",
"version": "74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf",
"versionType": "git"
},
{
"status": "affected",
"version": "c36ef6467420f8982e6d4d6f93d0634a85a5ee45",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.91",
"versionType": "semver"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.107",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.73",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.46",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.50",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.40",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.60",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.21",
"versionType": "semver"
},
{
"lessThan": "4.11",
"status": "affected",
"version": "4.10.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_fifo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.107",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: avoid stale FIFO cells during resize\n\nsnd_seq_fifo_resize() still needs to publish the replacement pool\nbefore it waits for FIFO users. A blocking snd_seq_read() holds\nf-\u003euse_lock while it sleeps, so concurrent senders must be able to\nqueue to the new pool and wake that reader instead of failing against a\nclosing old pool.\n\nHowever, snd_seq_fifo_event_in() duplicates an event before it takes\nf-\u003elock, and snd_seq_read() can dequeue a cell and later call\nsnd_seq_fifo_cell_putback() if copy_to_user() or\nsnd_seq_expand_var_event() fails. If resize swaps f-\u003epool and detaches\noldhead in between, either path can relink an old-pool cell after the\nsnapshot. That stale cell sits outside the drained oldhead list, keeps\noldpool-\u003ecounter elevated, and can leave snd_seq_pool_delete() waiting\nfor the retired pool to drain.\n\nKeep the existing swap-before-wait ordering in snd_seq_fifo_resize(),\nbut reject stale cells before any FIFO relink. Revalidate event-in cells\nunder f-\u003elock and retry them against the published replacement pool, and\nfree stale putback cells instead of linking them back into the FIFO.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nresize path: relink path:\n1. Allocate newpool. 1. Take f-\u003euse_lock.\n2. Swap f-\u003epool to newpool and 2. Duplicate or dequeue an old-pool\n detach oldhead. cell before oldpool closes.\n3. Mark oldpool closing and 3. Reach a later relink point after\n wait for FIFO users. resize published newpool.\n4. Free oldhead and delete 4. Relink the old-pool cell after\n oldpool. resize detached oldhead.\n 5. Drop f-\u003euse_lock.\n\nThe reproducer reports a resize ioctl blocked in the expected pool\nteardown path:\n\nsignal: resize iteration=98 target_pool=4 exceeded 250ms\n (elapsed=251ms)\ndiagnostic: resize_tid=651 wchan=snd_seq_pool_done\ndiagnostic: resize_tid=651 stack=\n snd_seq_pool_done+0x5b/0x140\n snd_seq_pool_delete+0x7a/0x90\n snd_seq_fifo_resize+0x193/0x1e0\n snd_seq_ioctl_set_client_pool+0x214/0x260\n snd_seq_ioctl+0x119/0x540\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nA second run with larger pools hit the same target path:\n\nsignal: resize iteration=32 target_pool=64 exceeded 250ms\n (elapsed=251ms)\ndiagnostic: resize_tid=663 wchan=snd_seq_pool_done\ndiagnostic: resize_tid=663 stack=\n snd_seq_pool_done+0x5b/0x140\n snd_seq_pool_delete+0x7a/0x90\n snd_seq_fifo_resize+0x193/0x1e0\n snd_seq_ioctl_set_client_pool+0x214/0x260\n snd_seq_ioctl+0x119/0x540\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:33.748Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8bb506ffb848e3de1496a4cf23a2fd694da2a7d2"
},
{
"url": "https://git.kernel.org/stable/c/ae429220c7f9747579bc4682c574585230e971cc"
},
{
"url": "https://git.kernel.org/stable/c/dcf784abee6df2f5c47e36a1d9e400065993bc04"
},
{
"url": "https://git.kernel.org/stable/c/98a965cb1e767b54b6bbd831b6cea26f521a8f51"
},
{
"url": "https://git.kernel.org/stable/c/1c4c35fb68d520241f7d9f1c356b5e2370fd8364"
},
{
"url": "https://git.kernel.org/stable/c/e546128291f8d688dcb931827e2efd2aa6c0734d"
}
],
"title": "ALSA: seq: avoid stale FIFO cells during resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74261",
"datePublished": "2026-08-15T05:57:38.311Z",
"dateReserved": "2026-08-15T05:44:03.877Z",
"dateUpdated": "2026-10-30T12:29:33.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99009 (GCVE-0-2026-99009)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
An RFCOMM connect() issued while a BR/EDR link is being authenticated
makes lockdep report a circular dependency, and the reported cycle is a
real AB/BA between rfcomm_mutex and hdev->lock.
rfcomm_security_cfm() is called from the HCI event path, which already
holds hdev->lock:
hci_rx_work()
hci_event_packet()
hci_cc_read_enc_key_size() [hdev->lock]
hci_encrypt_cfm() [hci_cb_list_lock]
rfcomm_security_cfm() [rfcomm_mutex]
while an RFCOMM connect() from userspace takes the same two locks the
other way round:
rfcomm_sock_connect()
rfcomm_dlc_open() [rfcomm_mutex]
__rfcomm_dlc_open()
rfcomm_session_create()
kernel_connect()
l2cap_sock_connect()
l2cap_chan_connect() [hdev->lock]
WARNING: possible circular locking dependency detected
kworker/u131:1/1128 is trying to acquire lock:
rfcomm_mutex, at: rfcomm_security_cfm+0x31/0x3e0 [rfcomm]
but task is already holding lock:
hci_cb_list_lock, at: hci_cc_read_enc_key_size+0x1d2/0xcc0
Chain exists of:
rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock
hci_auth_complete_evt() and hci_encrypt_change_evt() reach the callback
the same way.
Both orders have to be seen in the same boot, which is why a BR/EDR
connection alone is not enough to show it: a session set up by the
remote side is created by rfcomm_accept_connection() in krfcommd, which
calls kernel_accept() and never takes hdev->lock under rfcomm_mutex.
Connecting a device that authenticates and encrypts the link and then
calling connect() on an RFCOMM socket towards any address - the connect
does not have to succeed, the order is recorded before the page timeout
- reports it every time.
Only the session socket has to be connected with the lock held, and it
does not: nothing else can see the socket before it is put on the
session list. So connect it first and take rfcomm_mutex afterwards,
which removes the rfcomm_mutex -> hdev->lock order for good, rather
than keeping the HCI event path out of rfcomm_mutex.
rfcomm_session_create() becomes rfcomm_session_connect(), which returns
the connected socket without touching the session list, and
rfcomm_dlc_open() adds the session once it holds the lock again. If
another opener added a session for the same pair while this socket was
connecting, that session is used and this socket is dropped.
__rfcomm_dlc_open() now takes the session it should use, and its state
check runs after the lock is re-acquired, so a DLC that was opened or
closed in the meantime is still handled.
Over an existing ACL link the connection can complete before the
session reaches the list, and the wakeup from the socket callback is
then lost, so krfcommd is woken once the session is visible.
Connecting without the lock opens a window in which the socket can be
closed. The DLC is not on a session yet, so rfcomm_dlc_close() finds
nothing to do and returns without touching it, and rfcomm_dlc_open()
would then attach a DLC whose owner is gone. rfcomm_dlc_close() now
marks such a DLC with RFCOMM_CLOSED, and rfcomm_dlc_open() checks the
mark once it holds rfcomm_mutex again and drops the socket instead of
attaching the DLC. The mark is cleared when an open starts, so a DLC
that is reused is not affected. This covers both callers of
rfcomm_dlc_open(), the socket and the tty layer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 62ce8b33eb238cf18c15207332fbdc26d858f592 Version: 3873f3449701b3dc98cba577923be6493598e7a1 Version: 7ded3264106418c6456ccceaafd9fda596ce12c3 Version: 82425b14f0fb22e46cfddc56d6465570f5ed0ce6 Version: 1b7841ffad08e911e8c4b9470f3fa08423568940 Version: 946d76db77ee5f922968ce558629ae47b381e3fc Version: fbf7961964a6e93360179f64712320ae9a1e9577 Version: 759c185d0bbdb131357408f50b8735e04ed3caff |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/rfcomm.h",
"net/bluetooth/rfcomm/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d7a3bf6f55ab77d465206b25fe3418091c3d4b92",
"status": "affected",
"version": "62ce8b33eb238cf18c15207332fbdc26d858f592",
"versionType": "git"
},
{
"lessThan": "172b152119643018a2ed792e5096f33a4491c7de",
"status": "affected",
"version": "3873f3449701b3dc98cba577923be6493598e7a1",
"versionType": "git"
},
{
"lessThan": "caf78390f78a005d5cdc1db2eb467b2794bbf020",
"status": "affected",
"version": "7ded3264106418c6456ccceaafd9fda596ce12c3",
"versionType": "git"
},
{
"lessThan": "4dc3d5a004b8fd59f3c905631dbb18cb601b1b41",
"status": "affected",
"version": "82425b14f0fb22e46cfddc56d6465570f5ed0ce6",
"versionType": "git"
},
{
"lessThan": "d2206e8c78be69d21d4f5343c3e99fbaeef41cbb",
"status": "affected",
"version": "1b7841ffad08e911e8c4b9470f3fa08423568940",
"versionType": "git"
},
{
"lessThan": "cc7732b8549ecb6f02457edeb8db1f6d255e381c",
"status": "affected",
"version": "946d76db77ee5f922968ce558629ae47b381e3fc",
"versionType": "git"
},
{
"lessThan": "f492de11b325446b0b11bc2eb86e1f546eaa61b6",
"status": "affected",
"version": "fbf7961964a6e93360179f64712320ae9a1e9577",
"versionType": "git"
},
{
"lessThan": "ac022970e9fb0a5f7e7d1f6c8e104c1ed924dd1c",
"status": "affected",
"version": "759c185d0bbdb131357408f50b8735e04ed3caff",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/rfcomm.h",
"net/bluetooth/rfcomm/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5.10.273",
"status": "affected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThan": "5.15.224",
"status": "affected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThan": "6.18.58",
"status": "affected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThan": "7.2.11",
"status": "affected",
"version": "7.2.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.10.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.109",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.18.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "7.2.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: connect the session socket without rfcomm_mutex\n\nAn RFCOMM connect() issued while a BR/EDR link is being authenticated\nmakes lockdep report a circular dependency, and the reported cycle is a\nreal AB/BA between rfcomm_mutex and hdev-\u003elock.\n\nrfcomm_security_cfm() is called from the HCI event path, which already\nholds hdev-\u003elock:\n\n hci_rx_work()\n hci_event_packet()\n hci_cc_read_enc_key_size() [hdev-\u003elock]\n hci_encrypt_cfm() [hci_cb_list_lock]\n rfcomm_security_cfm() [rfcomm_mutex]\n\nwhile an RFCOMM connect() from userspace takes the same two locks the\nother way round:\n\n rfcomm_sock_connect()\n rfcomm_dlc_open() [rfcomm_mutex]\n __rfcomm_dlc_open()\n rfcomm_session_create()\n kernel_connect()\n l2cap_sock_connect()\n l2cap_chan_connect() [hdev-\u003elock]\n\n WARNING: possible circular locking dependency detected\n kworker/u131:1/1128 is trying to acquire lock:\n rfcomm_mutex, at: rfcomm_security_cfm+0x31/0x3e0 [rfcomm]\n but task is already holding lock:\n hci_cb_list_lock, at: hci_cc_read_enc_key_size+0x1d2/0xcc0\n Chain exists of:\n rfcomm_mutex --\u003e \u0026hdev-\u003elock --\u003e hci_cb_list_lock\n\nhci_auth_complete_evt() and hci_encrypt_change_evt() reach the callback\nthe same way.\n\nBoth orders have to be seen in the same boot, which is why a BR/EDR\nconnection alone is not enough to show it: a session set up by the\nremote side is created by rfcomm_accept_connection() in krfcommd, which\ncalls kernel_accept() and never takes hdev-\u003elock under rfcomm_mutex.\nConnecting a device that authenticates and encrypts the link and then\ncalling connect() on an RFCOMM socket towards any address - the connect\ndoes not have to succeed, the order is recorded before the page timeout\n- reports it every time.\n\nOnly the session socket has to be connected with the lock held, and it\ndoes not: nothing else can see the socket before it is put on the\nsession list. So connect it first and take rfcomm_mutex afterwards,\nwhich removes the rfcomm_mutex -\u003e hdev-\u003elock order for good, rather\nthan keeping the HCI event path out of rfcomm_mutex.\n\nrfcomm_session_create() becomes rfcomm_session_connect(), which returns\nthe connected socket without touching the session list, and\nrfcomm_dlc_open() adds the session once it holds the lock again. If\nanother opener added a session for the same pair while this socket was\nconnecting, that session is used and this socket is dropped.\n__rfcomm_dlc_open() now takes the session it should use, and its state\ncheck runs after the lock is re-acquired, so a DLC that was opened or\nclosed in the meantime is still handled.\n\nOver an existing ACL link the connection can complete before the\nsession reaches the list, and the wakeup from the socket callback is\nthen lost, so krfcommd is woken once the session is visible.\n\nConnecting without the lock opens a window in which the socket can be\nclosed. The DLC is not on a session yet, so rfcomm_dlc_close() finds\nnothing to do and returns without touching it, and rfcomm_dlc_open()\nwould then attach a DLC whose owner is gone. rfcomm_dlc_close() now\nmarks such a DLC with RFCOMM_CLOSED, and rfcomm_dlc_open() checks the\nmark once it holds rfcomm_mutex again and drops the socket instead of\nattaching the DLC. The mark is cleared when an open starts, so a DLC\nthat is reused is not affected. This covers both callers of\nrfcomm_dlc_open(), the socket and the tty layer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:54.430Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d7a3bf6f55ab77d465206b25fe3418091c3d4b92"
},
{
"url": "https://git.kernel.org/stable/c/172b152119643018a2ed792e5096f33a4491c7de"
},
{
"url": "https://git.kernel.org/stable/c/caf78390f78a005d5cdc1db2eb467b2794bbf020"
},
{
"url": "https://git.kernel.org/stable/c/4dc3d5a004b8fd59f3c905631dbb18cb601b1b41"
},
{
"url": "https://git.kernel.org/stable/c/d2206e8c78be69d21d4f5343c3e99fbaeef41cbb"
},
{
"url": "https://git.kernel.org/stable/c/cc7732b8549ecb6f02457edeb8db1f6d255e381c"
},
{
"url": "https://git.kernel.org/stable/c/f492de11b325446b0b11bc2eb86e1f546eaa61b6"
},
{
"url": "https://git.kernel.org/stable/c/ac022970e9fb0a5f7e7d1f6c8e104c1ed924dd1c"
}
],
"title": "Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99009",
"datePublished": "2026-10-23T12:20:34.301Z",
"dateReserved": "2026-09-25T10:25:14.385Z",
"dateUpdated": "2026-10-30T12:40:54.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53297 (GCVE-0-2026-53297)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mana: Guard mana_remove against double invocation
If PM resume fails (e.g., mana_attach() returns an error), mana_probe()
calls mana_remove(), which tears down the device and sets
gd->gdma_context = NULL and gd->driver_data = NULL.
However, a failed resume callback does not automatically unbind the
driver. When the device is eventually unbound, mana_remove() is invoked
a second time. Without a NULL check, it dereferences gc->dev with
gc == NULL, causing a kernel panic.
Add an early return if gdma_context or driver_data is NULL so the second
invocation is harmless. Move the dev = gc->dev assignment after the
guard so it cannot dereference NULL.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 635096a86edb067d55a1e04b4a918f5c6dac0c51 Version: 635096a86edb067d55a1e04b4a918f5c6dac0c51 Version: 635096a86edb067d55a1e04b4a918f5c6dac0c51 Version: 635096a86edb067d55a1e04b4a918f5c6dac0c51 Version: 635096a86edb067d55a1e04b4a918f5c6dac0c51 Version: 635096a86edb067d55a1e04b4a918f5c6dac0c51 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:26:02.492170Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:19.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/mana_en.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f63a6d2e4167703611f5c2602eaa1a23f635430f",
"status": "affected",
"version": "635096a86edb067d55a1e04b4a918f5c6dac0c51",
"versionType": "git"
},
{
"lessThan": "793bf1f4e469c51d0e39199823da5e1de85a2741",
"status": "affected",
"version": "635096a86edb067d55a1e04b4a918f5c6dac0c51",
"versionType": "git"
},
{
"lessThan": "8ee85b75a72216c857c39457f6595709c4c9f856",
"status": "affected",
"version": "635096a86edb067d55a1e04b4a918f5c6dac0c51",
"versionType": "git"
},
{
"lessThan": "a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6",
"status": "affected",
"version": "635096a86edb067d55a1e04b4a918f5c6dac0c51",
"versionType": "git"
},
{
"lessThan": "bbe5c3c570645a4ceb120979d3ee203a1583d775",
"status": "affected",
"version": "635096a86edb067d55a1e04b4a918f5c6dac0c51",
"versionType": "git"
},
{
"lessThan": "50271d7ec95144d26808025b508f463780517d3c",
"status": "affected",
"version": "635096a86edb067d55a1e04b4a918f5c6dac0c51",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/mana_en.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Guard mana_remove against double invocation\n\nIf PM resume fails (e.g., mana_attach() returns an error), mana_probe()\ncalls mana_remove(), which tears down the device and sets\ngd-\u003egdma_context = NULL and gd-\u003edriver_data = NULL.\n\nHowever, a failed resume callback does not automatically unbind the\ndriver. When the device is eventually unbound, mana_remove() is invoked\na second time. Without a NULL check, it dereferences gc-\u003edev with\ngc == NULL, causing a kernel panic.\n\nAdd an early return if gdma_context or driver_data is NULL so the second\ninvocation is harmless. Move the dev = gc-\u003edev assignment after the\nguard so it cannot dereference NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:56.822Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f63a6d2e4167703611f5c2602eaa1a23f635430f"
},
{
"url": "https://git.kernel.org/stable/c/793bf1f4e469c51d0e39199823da5e1de85a2741"
},
{
"url": "https://git.kernel.org/stable/c/8ee85b75a72216c857c39457f6595709c4c9f856"
},
{
"url": "https://git.kernel.org/stable/c/a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6"
},
{
"url": "https://git.kernel.org/stable/c/bbe5c3c570645a4ceb120979d3ee203a1583d775"
},
{
"url": "https://git.kernel.org/stable/c/50271d7ec95144d26808025b508f463780517d3c"
}
],
"title": "net: mana: Guard mana_remove against double invocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53297",
"datePublished": "2026-06-26T19:40:55.155Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-11-06T16:34:19.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99173 (GCVE-0-2026-99173)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
eventfs: Free the eventfs_inode after an rcu grace period too
tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that
dentry->d_fsdata points to, and ->d_revalidate() is called in rcu
pathwalk mode with nothing but rcu_read_lock() held. The dentry itself
stays around for such a walker, but tracefs_d_release() drops its
reference to the eventfs_inode when the dentry is killed, and
release_ei() then frees it after a grace period of eventfs_srcu. An
SRCU grace period doesn't wait for rcu_read_lock() sections, so the
walker can read an eventfs_inode that is already gone.
With a pathwalk held up in tracefs_d_revalidate() while the dentry goes
away:
BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90
Read of size 1 at addr ff1100010152d8d0 by task walker/97
Call Trace:
<TASK>
tracefs_d_revalidate+0x76/0x90
lookup_fast+0x320/0x640
path_lookupat+0x160/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
vfs_fstatat+0x4d/0x90
__do_sys_newfstatat+0xa0/0x100
do_syscall_64+0x10e/0x5e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[...]
Allocated by task 1:
__kmalloc_cache_noprof+0x249/0x560
eventfs_create_dir+0x7a/0x590
event_create_dir+0x2fb/0xcf0
trace_add_event_call+0xbf/0x150
[...]
Freed by task 11:
kfree+0x1db/0x5b0
srcu_invoke_callbacks+0x3a3/0x620
process_one_work+0x937/0x1810
worker_thread+0x4f1/0xd60
Before commit 8e556432477e ("eventfs: Use SRCU for freeing
eventfs_inodes") release_ei() used call_rcu(), which covered the walker,
while eventfs_iterate() needs the SRCU grace period. Wait for both and
chain call_rcu() from the SRCU callback.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2ef3d120d19faba3dec35b10a025b00db0284373 Version: 8e556432477e97ad6179c61b61a32bf5f1af2355 Version: 8e556432477e97ad6179c61b61a32bf5f1af2355 Version: 8e556432477e97ad6179c61b61a32bf5f1af2355 Version: 8e556432477e97ad6179c61b61a32bf5f1af2355 Version: 384f383c5aa7bfd619d9f56a513a36e533428186 Version: 6.6.46 ≤ Version: 6.10.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/tracefs/event_inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5819018dc29fb2ac2fd4865d507f9893c89c0624",
"status": "affected",
"version": "2ef3d120d19faba3dec35b10a025b00db0284373",
"versionType": "git"
},
{
"lessThan": "dd2c767814a876be0f16f0b7f98a403dc176f51e",
"status": "affected",
"version": "8e556432477e97ad6179c61b61a32bf5f1af2355",
"versionType": "git"
},
{
"lessThan": "4586ef24ce390e8becb9f3e5852d5d3978b01c33",
"status": "affected",
"version": "8e556432477e97ad6179c61b61a32bf5f1af2355",
"versionType": "git"
},
{
"lessThan": "45fcfd5d9c10e0aa977ed5b9bd445707e01bb107",
"status": "affected",
"version": "8e556432477e97ad6179c61b61a32bf5f1af2355",
"versionType": "git"
},
{
"lessThan": "2cd88c498ecff8e22bf4c397b8eb226db70ac343",
"status": "affected",
"version": "8e556432477e97ad6179c61b61a32bf5f1af2355",
"versionType": "git"
},
{
"status": "affected",
"version": "384f383c5aa7bfd619d9f56a513a36e533428186",
"versionType": "git"
},
{
"lessThan": "6.6.161",
"status": "affected",
"version": "6.6.46",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/tracefs/event_inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Free the eventfs_inode after an rcu grace period too\n\ntracefs_d_revalidate() reads -\u003eis_freed of the eventfs_inode that\ndentry-\u003ed_fsdata points to, and -\u003ed_revalidate() is called in rcu\npathwalk mode with nothing but rcu_read_lock() held. The dentry itself\nstays around for such a walker, but tracefs_d_release() drops its\nreference to the eventfs_inode when the dentry is killed, and\nrelease_ei() then frees it after a grace period of eventfs_srcu. An\nSRCU grace period doesn\u0027t wait for rcu_read_lock() sections, so the\nwalker can read an eventfs_inode that is already gone.\n\nWith a pathwalk held up in tracefs_d_revalidate() while the dentry goes\naway:\n\n BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90\n Read of size 1 at addr ff1100010152d8d0 by task walker/97\n Call Trace:\n \u003cTASK\u003e\n tracefs_d_revalidate+0x76/0x90\n lookup_fast+0x320/0x640\n path_lookupat+0x160/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n vfs_fstatat+0x4d/0x90\n __do_sys_newfstatat+0xa0/0x100\n do_syscall_64+0x10e/0x5e0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [...]\n Allocated by task 1:\n __kmalloc_cache_noprof+0x249/0x560\n eventfs_create_dir+0x7a/0x590\n event_create_dir+0x2fb/0xcf0\n trace_add_event_call+0xbf/0x150\n [...]\n Freed by task 11:\n kfree+0x1db/0x5b0\n srcu_invoke_callbacks+0x3a3/0x620\n process_one_work+0x937/0x1810\n worker_thread+0x4f1/0xd60\n\nBefore commit 8e556432477e (\"eventfs: Use SRCU for freeing\neventfs_inodes\") release_ei() used call_rcu(), which covered the walker,\nwhile eventfs_iterate() needs the SRCU grace period. Wait for both and\nchain call_rcu() from the SRCU callback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local newfstatat() pathwalk reaches lookup_fast()-\u003etracefs_d_revalidate(); concurrent invalidation invokes tracefs_d_release()-\u003eeventfs_d_release()-\u003eput_ei()-\u003erelease_ei(), the patched free path. No network or device input reaches this tracefs race.\nAC:L - The attacker can create a nonpersistent user event, instantiate its dentry, then unregister and close it while concurrent threads loop newfstatat(). This controls event teardown, dentry invalidation, and the RCU walk, making the race repeatable.\nPR:L - user_event_capable() requires CAP_PERFMON only for USER_EVENT_REG_PERSIST; ordinary DIAG_IOCSREG and DIAG_IOCSUNREG have no capable() check. A low-privilege user with delegated DAC access to user_events_data can create and auto-delete the required eventfs directory.\nUI:N - The same process registers the event, stats events/user_events/\u003cname\u003e, and unregisters or closes it to trigger auto-deletion; no victim action is required.\nS:U - The dangling d_fsdata access in tracefs_d_revalidate() and the release_ei() free both occur within the host kernel. Resulting privilege escalation does not cross a VM, IOMMU, or other security authority.\nC:H - After free_ei_rcu() frees the eventfs_inode, dentry-\u003ed_fsdata remains a dangling pointer read by tracefs_d_revalidate(). Repeated event creation permits slab grooming and attacker-influenced reuse, giving the disclosure potential of a kernel UAF.\nI:H - release_ei() permits an RCU walker to retain a pointer into a freed kmalloc object that the attacker can churn through eventfs_create_dir(). Reclaiming the object provides the heap-spraying and control-flow corruption potential of an exploitable kernel UAF.\nA:H - The reported KASAN trace demonstrates a slab-use-after-free read in tracefs_d_revalidate() after free_ei_rcu() calls kfree(). Repeatedly racing event deletion with pathwalk can therefore cause a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:40.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5819018dc29fb2ac2fd4865d507f9893c89c0624"
},
{
"url": "https://git.kernel.org/stable/c/dd2c767814a876be0f16f0b7f98a403dc176f51e"
},
{
"url": "https://git.kernel.org/stable/c/4586ef24ce390e8becb9f3e5852d5d3978b01c33"
},
{
"url": "https://git.kernel.org/stable/c/45fcfd5d9c10e0aa977ed5b9bd445707e01bb107"
},
{
"url": "https://git.kernel.org/stable/c/2cd88c498ecff8e22bf4c397b8eb226db70ac343"
}
],
"title": "eventfs: Free the eventfs_inode after an rcu grace period too",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99173",
"datePublished": "2026-10-28T10:35:28.017Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-31T12:44:40.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53277 (GCVE-0-2026-53277)
Vulnerability from cvelistv5
Published
2026-06-25 08:40
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
walk_s1() and kvm_walk_nested_s2() expect to be called while holding
kvm->srcu to guard against memslot changes. While this is generally
the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the
respective walkers without taking kvm->srcu.
Fix by acquiring kvm->srcu prior to the table walk in both instances.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.52.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Kernel-based Virtual Machine (KVM) component of the Linux kernel on arm64 architectures. This vulnerability occurs because certain page table walk operations, used in fault injection and Address Translation (AT) emulation, do not properly acquire a Sleepable Read-Copy Update (SRCU) lock. This omission could lead to inconsistencies in memory slot management, potentially causing system instability or unexpected behavior within the virtualized environment."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-820",
"description": "Missing Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:04:43.359Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53277"
},
{
"name": "RHBZ#2492725",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492725"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53277.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:64775"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:64775: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/at.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0648b375aa951cc15d9e90f9ac4de71e0b51fa45",
"status": "affected",
"version": "be04cebf3e78874627dc1042991d5d504464a5cc",
"versionType": "git"
},
{
"lessThan": "97706097f9b851cfe55c3b00b083dfc2bcf542bc",
"status": "affected",
"version": "be04cebf3e78874627dc1042991d5d504464a5cc",
"versionType": "git"
},
{
"lessThan": "ec42b4ed1b072ea2d03f086061aa67bad6d8de39",
"status": "affected",
"version": "be04cebf3e78874627dc1042991d5d504464a5cc",
"versionType": "git"
},
{
"lessThan": "f2ca45b50d4216c9cc7ffabf50d9ad1932209251",
"status": "affected",
"version": "be04cebf3e78874627dc1042991d5d504464a5cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/at.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation\n\nwalk_s1() and kvm_walk_nested_s2() expect to be called while holding\nkvm-\u003esrcu to guard against memslot changes. While this is generally\nthe case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the\nrespective walkers without taking kvm-\u003esrcu.\n\nFix by acquiring kvm-\u003esrcu prior to the table walk in both instances."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable KVM arm64 page-table walks are reached through local KVM execution paths, including `KVM_RUN` handling of trapped AT instructions and guest abort injection, not through network input. An attacker needs local ability to create/control a KVM VM or vCPU context.\nAC:L - The race is attacker-controllable because one thread can drive the vCPU path into the AT/S1PTW page-table walk while another thread mutates memslots with `KVM_SET_USER_MEMORY_REGION`. Nested virtualization support and memslot updates are reasonable KVM deployment conditions, not fragile external prerequisites.\nPR:L - The attacker needs access to KVM device/file descriptors or equivalent VM control, but the relevant ioctls do not require host root or a special capability once `/dev/kvm` access is available. This is therefore low privilege rather than high privilege.\nUI:N - No separate victim action is required after the attacker controls the KVM VM/vCPU and the racing memslot operation. The trigger is programmatic through guest execution and KVM ioctls.\nS:C - The bug is in host KVM handling of guest-controlled translation state, and exploitation can affect the host kernel/hypervisor outside the guest security boundary. KVM guest/VMM-to-host impact is a changed-scope scenario.\nC:H - The missing SRCU lock permits stale or freed memslot data to be used during `kvm_read_guest()` and descriptor updates, creating a use-after-free style memory safety issue. Under the required conservative scoring, this can support high-impact information disclosure.\nI:H - The affected walks can also update guest page-table descriptors and dirty-log state through stale memslot-derived pointers, giving a plausible kernel memory corruption/write surface. Use-after-free style corruption is scored as high integrity impact.\nA:H - At minimum, dereferencing stale memslot structures or dirty bitmap pointers can crash or oops the host kernel. A host kernel crash is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:22.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0648b375aa951cc15d9e90f9ac4de71e0b51fa45"
},
{
"url": "https://git.kernel.org/stable/c/97706097f9b851cfe55c3b00b083dfc2bcf542bc"
},
{
"url": "https://git.kernel.org/stable/c/ec42b4ed1b072ea2d03f086061aa67bad6d8de39"
},
{
"url": "https://git.kernel.org/stable/c/f2ca45b50d4216c9cc7ffabf50d9ad1932209251"
}
],
"title": "KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53277",
"datePublished": "2026-06-25T08:40:00.458Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-10-21T12:42:22.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-22109 (GCVE-0-2025-22109)
Vulnerability from cvelistv5
Published
2025-04-16 14:12
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ax25: Remove broken autobind
Binding AX25 socket by using the autobind feature leads to memory leaks
in ax25_connect() and also refcount leaks in ax25_release(). Memory
leak was detected with kmemleak:
================================================================
unreferenced object 0xffff8880253cd680 (size 96):
backtrace:
__kmalloc_node_track_caller_noprof (./include/linux/kmemleak.h:43)
kmemdup_noprof (mm/util.c:136)
ax25_rt_autobind (net/ax25/ax25_route.c:428)
ax25_connect (net/ax25/af_ax25.c:1282)
__sys_connect_file (net/socket.c:2045)
__sys_connect (net/socket.c:2064)
__x64_sys_connect (net/socket.c:2067)
do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
================================================================
When socket is bound, refcounts must be incremented the way it is done
in ax25_bind() and ax25_setsockopt() (SO_BINDTODEVICE). In case of
autobind, the refcounts are not incremented.
This bug leads to the following issue reported by Syzkaller:
================================================================
ax25_connect(): syz-executor318 uses autobind, please contact jreuter@yaina.de
------------[ cut here ]------------
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 0 PID: 5317 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31
Modules linked in:
CPU: 0 UID: 0 PID: 5317 Comm: syz-executor318 Not tainted 6.14.0-rc4-syzkaller-00278-gece144f151ac #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31
...
Call Trace:
<TASK>
__refcount_dec include/linux/refcount.h:336 [inline]
refcount_dec include/linux/refcount.h:351 [inline]
ref_tracker_free+0x6af/0x7e0 lib/ref_tracker.c:236
netdev_tracker_free include/linux/netdevice.h:4302 [inline]
netdev_put include/linux/netdevice.h:4319 [inline]
ax25_release+0x368/0x960 net/ax25/af_ax25.c:1080
__sock_release net/socket.c:647 [inline]
sock_close+0xbc/0x240 net/socket.c:1398
__fput+0x3e9/0x9f0 fs/file_table.c:464
__do_sys_close fs/open.c:1580 [inline]
__se_sys_close fs/open.c:1565 [inline]
__x64_sys_close+0x7f/0x110 fs/open.c:1565
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
</TASK>
================================================================
Considering the issues above and the comments left in the code that say:
"check if we can remove this feature. It is broken."; "autobinding in this
may or may not work"; - it is better to completely remove this feature than
to fix it because it is broken and leads to various kinds of memory bugs.
Now calling connect() without first binding socket will result in an
error (-EINVAL). Userspace software that relies on the autobind feature
might get broken. However, this feature does not seem widely used with
this specific driver as it was not reliable at any point of time, and it
is already broken anyway. E.g. ax25-tools and ax25-apps packages for
popular distributions do not use the autobind feature for AF_AX25.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ax25.h",
"net/ax25/af_ax25.c",
"net/ax25/ax25_route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7bffc5aad1e89354151150af2d4ded20b3c702a0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f364eb60987a55712bcfb9a69235bf3f31bfab5a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "064bc39c23f72efbfbf189786da711d253451033",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "61203fdd3e35519db9a98b6ff8983c620ffc4696",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2f6efbabceb6b2914ee9bafb86d9a51feae9cce8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ax25.h",
"net/ax25/af_ax25.c",
"net/ax25/ax25_route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Remove broken autobind\n\nBinding AX25 socket by using the autobind feature leads to memory leaks\nin ax25_connect() and also refcount leaks in ax25_release(). Memory\nleak was detected with kmemleak:\n\n================================================================\nunreferenced object 0xffff8880253cd680 (size 96):\nbacktrace:\n__kmalloc_node_track_caller_noprof (./include/linux/kmemleak.h:43)\nkmemdup_noprof (mm/util.c:136)\nax25_rt_autobind (net/ax25/ax25_route.c:428)\nax25_connect (net/ax25/af_ax25.c:1282)\n__sys_connect_file (net/socket.c:2045)\n__sys_connect (net/socket.c:2064)\n__x64_sys_connect (net/socket.c:2067)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n================================================================\n\nWhen socket is bound, refcounts must be incremented the way it is done\nin ax25_bind() and ax25_setsockopt() (SO_BINDTODEVICE). In case of\nautobind, the refcounts are not incremented.\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nax25_connect(): syz-executor318 uses autobind, please contact jreuter@yaina.de\n------------[ cut here ]------------\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 0 PID: 5317 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31\nModules linked in:\nCPU: 0 UID: 0 PID: 5317 Comm: syz-executor318 Not tainted 6.14.0-rc4-syzkaller-00278-gece144f151ac #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31\n...\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x6af/0x7e0 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4302 [inline]\n netdev_put include/linux/netdevice.h:4319 [inline]\n ax25_release+0x368/0x960 net/ax25/af_ax25.c:1080\n __sock_release net/socket.c:647 [inline]\n sock_close+0xbc/0x240 net/socket.c:1398\n __fput+0x3e9/0x9f0 fs/file_table.c:464\n __do_sys_close fs/open.c:1580 [inline]\n __se_sys_close fs/open.c:1565 [inline]\n __x64_sys_close+0x7f/0x110 fs/open.c:1565\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n \u003c/TASK\u003e\n================================================================\n\nConsidering the issues above and the comments left in the code that say:\n\"check if we can remove this feature. It is broken.\"; \"autobinding in this\nmay or may not work\"; - it is better to completely remove this feature than\nto fix it because it is broken and leads to various kinds of memory bugs.\n\nNow calling connect() without first binding socket will result in an\nerror (-EINVAL). Userspace software that relies on the autobind feature\nmight get broken. However, this feature does not seem widely used with\nthis specific driver as it was not reliable at any point of time, and it\nis already broken anyway. E.g. ax25-tools and ax25-apps packages for\npopular distributions do not use the autobind feature for AF_AX25.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered by a local `connect(2)` syscall on an AF_AX25 socket followed by `close(2)`; a remote packet-radio peer cannot drive the socket API. The freed object is subsequently consumed by the frame-receive path, but the trigger itself is local.\nAC:L - A single deterministic connect()+close() sequence on an unbound AF_AX25 socket unbalances both refcounts \u2014 no race, no memory-layout dependency, and it can be repeated at will. On the realistic deployment for this subsystem (a configured AX.25 node with a port and route), the attacker triggers it reliably every time.\nPR:L - `ax25_create()` requires no capability for SOCK_SEQPACKET/SOCK_DGRAM (only SOCK_RAW checks CAP_NET_RAW), and the autobind CAP_NET_BIND_SERVICE check is disabled by the default `ax25_uid_policy=0`, so any unprivileged local account suffices. The socket family also autoloads the module via MODULE_ALIAS_NETPROTO(PF_AX25).\nUI:N - The entire sequence is performed by the attacker\u0027s own process with no victim action required.\nS:U - The refcount underflow and resulting memory corruption stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The premature `kfree_rcu()` of `ax25_dev` leaves a freed object still reachable for reads via `dev-\u003eax25_ptr` in `ax25_rcv()`, via the `ax25_dev_list` walk, and \u2014 critically \u2014 via the world-readable `/proc/sys/net/ax25/\u003cdev\u003e/*` entries whose `.data` points into the freed slab, giving a direct read window onto whatever object is reallocated there.\nI:H - The same UAF is a write primitive: the registered sysctl table writes ints directly into the freed `ax25_dev-\u003evalues[]`, and the RX path mutates the freed object, so heap spraying yields controlled corruption of an attacker-chosen replacement object; the additional `netdev_put()` underflow can free a still-registered `net_device`.\nA:H - The unbalanced puts produce an immediate `refcount_warn_saturate()` WARN and a use-after-free that panics on the next received AX.25 frame, `bind()`, sysctl access, or DAMA timer fire; it is repeatable and also permanently corrupts the netdev refcount."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:14.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7bffc5aad1e89354151150af2d4ded20b3c702a0"
},
{
"url": "https://git.kernel.org/stable/c/f364eb60987a55712bcfb9a69235bf3f31bfab5a"
},
{
"url": "https://git.kernel.org/stable/c/064bc39c23f72efbfbf189786da711d253451033"
},
{
"url": "https://git.kernel.org/stable/c/61203fdd3e35519db9a98b6ff8983c620ffc4696"
},
{
"url": "https://git.kernel.org/stable/c/2f6efbabceb6b2914ee9bafb86d9a51feae9cce8"
}
],
"title": "ax25: Remove broken autobind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-22109",
"datePublished": "2025-04-16T14:12:56.405Z",
"dateReserved": "2024-12-29T08:45:45.820Z",
"dateUpdated": "2026-10-30T12:21:14.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68233 (GCVE-0-2026-68233)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Shut down BO cache timer before teardown
The BO cache timer callback schedules time_work, and time_work can rearm
the timer through vc4_bo_cache_free_old().
vc4_bo_cache_destroy() deletes the timer and then cancels the work, which
does not break that cycle: the work being cancelled can rearm the timer,
and the timer then queues work again after teardown.
Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the
cycle ends with cancel_work_sync().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c826a6e1064419f78855463cf29ce9e8b9d25bf4 Version: c826a6e1064419f78855463cf29ce9e8b9d25bf4 Version: c826a6e1064419f78855463cf29ce9e8b9d25bf4 Version: c826a6e1064419f78855463cf29ce9e8b9d25bf4 Version: c826a6e1064419f78855463cf29ce9e8b9d25bf4 Version: c826a6e1064419f78855463cf29ce9e8b9d25bf4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_bo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "948cd4876dafbfab826384516df19fe813d9f1d1",
"status": "affected",
"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4",
"versionType": "git"
},
{
"lessThan": "cf55c6f1b62a89bf365c48bf731ccf69340e3a16",
"status": "affected",
"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4",
"versionType": "git"
},
{
"lessThan": "e9264ee59bd94970b80b7548f693bccf0d4628da",
"status": "affected",
"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4",
"versionType": "git"
},
{
"lessThan": "a38f2724eb93a78ba250b01e0caf3468df4d3956",
"status": "affected",
"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4",
"versionType": "git"
},
{
"lessThan": "bac4c1a9af690b8635c6924872075c41d8763ed9",
"status": "affected",
"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4",
"versionType": "git"
},
{
"lessThan": "6273dd3ffb54ec581855b82ae77331b66028249c",
"status": "affected",
"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_bo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Shut down BO cache timer before teardown\n\nThe BO cache timer callback schedules time_work, and time_work can rearm\nthe timer through vc4_bo_cache_free_old().\n\nvc4_bo_cache_destroy() deletes the timer and then cancels the work, which\ndoes not break that cycle: the work being cancelled can rearm the timer,\nand the timer then queues work again after teardown.\n\nUse timer_shutdown_sync() instead, so the timer cannot be rearmed and the\ncycle ends with cancel_work_sync()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:09.594Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/948cd4876dafbfab826384516df19fe813d9f1d1"
},
{
"url": "https://git.kernel.org/stable/c/cf55c6f1b62a89bf365c48bf731ccf69340e3a16"
},
{
"url": "https://git.kernel.org/stable/c/e9264ee59bd94970b80b7548f693bccf0d4628da"
},
{
"url": "https://git.kernel.org/stable/c/a38f2724eb93a78ba250b01e0caf3468df4d3956"
},
{
"url": "https://git.kernel.org/stable/c/bac4c1a9af690b8635c6924872075c41d8763ed9"
},
{
"url": "https://git.kernel.org/stable/c/6273dd3ffb54ec581855b82ae77331b66028249c"
}
],
"title": "drm/vc4: Shut down BO cache timer before teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68233",
"datePublished": "2026-08-10T12:00:57.580Z",
"dateReserved": "2026-07-30T09:28:09.376Z",
"dateUpdated": "2026-10-30T12:28:09.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64513 (GCVE-0-2026-64513)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Unconditionally recompute CR8 intercept on PPR update
The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits
when the guest's virtual TPR falls under the specified threshold,
allowing KVM to inject previously masked interrupts.
KVM handles these VM exits in handle_tpr_below_threshold().
Commit eb90f3417a0c ("KVM: vmx: speed up TPR below threshold vmexits")
optimized this function by calling apic_update_ppr() instead of raising
KVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is
a pending, deliverable interrupt.
However, if there are no new interrupts pending, apic_update_ppr() does
not issue the request. Thus, kvm_lapic_update_cr8_intercept() and
vmx_update_cr8_intercept() are not called before VM entry, which results
in a high, stale TPR_THRESHOLD. This is problematic due to the following
sentence in 28.2.1.1 "VM-Execution Control Fields" in the SDM:
The following check is performed if the “use TPR shadow” VM-execution
control is 1 and the “virtualize APIC accesses” and “virtual-interrupt
delivery” VM-execution controls are both 0: the value of bits 3:0 of
the TPR threshold VM-execution control field should not be greater
than the value of bits 7:4 of VTPR.
This error condition is typically not observed when KVM runs on a bare
metal system because modern processors support APICv, which enables
virtual-interrupt delivery, and which KVM uses when possible. This
causes the processor to no longer generate TPR-below-threshold exits
and to no longer check TPR_THRESHOLD on entry. However, when running
on older platforms, or under nested virtualization on a hypervisor that
does not support virtual-interrupt delivery and enforces this check
(like Hyper-V) this can cause a VM entry failure with hardware error
0x7, as seen in [1].
Call kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not
find a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).
Remove calls to kvm_lapic_update_cr8_intercept() on paths that end up in
apic_update_ppr(), as they now become redundant. This ensures that any
path that updates the guest's PPR also figures out if KVM needs to wait
for a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7277b66511983b57e345c0fba21f1810fd07c0f",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "ff9c4c6428883182960cfe5c78928f0896d80ebc",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "bb365a506b1e6fb050c0fceaad354fe395385ef0",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Unconditionally recompute CR8 intercept on PPR update\n\nThe TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits\nwhen the guest\u0027s virtual TPR falls under the specified threshold,\nallowing KVM to inject previously masked interrupts.\n\nKVM handles these VM exits in handle_tpr_below_threshold().\nCommit eb90f3417a0c (\"KVM: vmx: speed up TPR below threshold vmexits\")\noptimized this function by calling apic_update_ppr() instead of raising\nKVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is\na pending, deliverable interrupt.\n\nHowever, if there are no new interrupts pending, apic_update_ppr() does\nnot issue the request. Thus, kvm_lapic_update_cr8_intercept() and\nvmx_update_cr8_intercept() are not called before VM entry, which results\nin a high, stale TPR_THRESHOLD. This is problematic due to the following\nsentence in 28.2.1.1 \"VM-Execution Control Fields\" in the SDM:\n\n The following check is performed if the \u201cuse TPR shadow\u201d VM-execution\n control is 1 and the \u201cvirtualize APIC accesses\u201d and \u201cvirtual-interrupt\n delivery\u201d VM-execution controls are both 0: the value of bits 3:0 of\n the TPR threshold VM-execution control field should not be greater\n than the value of bits 7:4 of VTPR.\n\nThis error condition is typically not observed when KVM runs on a bare\nmetal system because modern processors support APICv, which enables\nvirtual-interrupt delivery, and which KVM uses when possible. This\ncauses the processor to no longer generate TPR-below-threshold exits\nand to no longer check TPR_THRESHOLD on entry. However, when running\non older platforms, or under nested virtualization on a hypervisor that\ndoes not support virtual-interrupt delivery and enforces this check\n(like Hyper-V) this can cause a VM entry failure with hardware error\n0x7, as seen in [1].\n\nCall kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not\nfind a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).\nRemove calls to kvm_lapic_update_cr8_intercept() on paths that end up in\napic_update_ppr(), as they now become redundant. This ensures that any\npath that updates the guest\u0027s PPR also figures out if KVM needs to wait\nfor a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:24.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7277b66511983b57e345c0fba21f1810fd07c0f"
},
{
"url": "https://git.kernel.org/stable/c/ff9c4c6428883182960cfe5c78928f0896d80ebc"
},
{
"url": "https://git.kernel.org/stable/c/8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df"
},
{
"url": "https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"
}
],
"title": "KVM: x86: Unconditionally recompute CR8 intercept on PPR update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64513",
"datePublished": "2026-07-25T08:52:05.119Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-10-21T12:43:24.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-23135 (GCVE-0-2025-23135)
Vulnerability from cvelistv5
Published
2025-04-16 14:13
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Teardown riscv specific bits after kvm_exit
During a module removal, kvm_exit invokes arch specific disable
call which disables AIA. However, we invoke aia_exit before kvm_exit
resulting in the following warning. KVM kernel module can't be inserted
afterwards due to inconsistent state of IRQ.
[25469.031389] percpu IRQ 31 still enabled on CPU0!
[25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150
[25469.031804] Modules linked in: kvm(-)
[25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2
[25469.031905] Hardware name: riscv-virtio,qemu (DT)
[25469.031928] epc : __free_percpu_irq+0xa2/0x150
[25469.031976] ra : __free_percpu_irq+0xa2/0x150
[25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff2000000088bd50
[25469.032241] gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff2000000088baf8
[25469.032285] t1 : fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90
[25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00
[25469.032372] a2 : 0000000000000023 a3 : 0000000000000001 a4 : ffffffff8122dbf8
[25469.032410] a5 : 0000000000000fff a6 : 0000000000000000 a7 : ffffffff8122dc10
[25469.032448] s2 : ff60000080c22eb0 s3 : 0000000200000022 s4 : 000000000000001f
[25469.032488] s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : 0000000000000000
[25469.032582] s8 : 0000000000000003 s9 : 000055556b7fb490 s10: 00007ffff0e12fa0
[25469.032621] s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7
[25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7
[25469.032698] status: 0000000200000100 badaddr: ffffffff8007db1e cause: 0000000000000003
[25469.032738] [<ffffffff8007db1e>] __free_percpu_irq+0xa2/0x150
[25469.032797] [<ffffffff8007dbfc>] free_percpu_irq+0x30/0x5e
[25469.032856] [<ffffffff013a57dc>] kvm_riscv_aia_exit+0x40/0x42 [kvm]
[25469.033947] [<ffffffff013b4e82>] cleanup_module+0x10/0x32 [kvm]
[25469.035300] [<ffffffff8009b150>] __riscv_sys_delete_module+0x18e/0x1fc
[25469.035374] [<ffffffff8000c1ca>] syscall_handler+0x3a/0x46
[25469.035456] [<ffffffff809ec9a4>] do_trap_ecall_u+0x72/0x134
[25469.035536] [<ffffffff809f5e18>] handle_exception+0x148/0x156
Invoke aia_exit and other arch specific cleanup functions after kvm_exit
so that disable gets a chance to be called first before exit.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce906c4ae572554f4ea4381d7d0a4ab39f5fca5d",
"status": "affected",
"version": "54e43320c2ba0c70258a3aea690da38c6ea3293c",
"versionType": "git"
},
{
"lessThan": "b7236c52151c91f7b83a42d6ec5728a49e06416f",
"status": "affected",
"version": "54e43320c2ba0c70258a3aea690da38c6ea3293c",
"versionType": "git"
},
{
"lessThan": "1edb2de48616b11ee05e9a65d74c70abcb6d9939",
"status": "affected",
"version": "54e43320c2ba0c70258a3aea690da38c6ea3293c",
"versionType": "git"
},
{
"lessThan": "1521cc04f0b6e737ff30105aa57fa9dde8493231",
"status": "affected",
"version": "54e43320c2ba0c70258a3aea690da38c6ea3293c",
"versionType": "git"
},
{
"lessThan": "2d117e67f318303f6ab699a5511d1fac3f170545",
"status": "affected",
"version": "54e43320c2ba0c70258a3aea690da38c6ea3293c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.13.*",
"status": "unaffected",
"version": "6.13.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Teardown riscv specific bits after kvm_exit\n\nDuring a module removal, kvm_exit invokes arch specific disable\ncall which disables AIA. However, we invoke aia_exit before kvm_exit\nresulting in the following warning. KVM kernel module can\u0027t be inserted\nafterwards due to inconsistent state of IRQ.\n\n[25469.031389] percpu IRQ 31 still enabled on CPU0!\n[25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150\n[25469.031804] Modules linked in: kvm(-)\n[25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2\n[25469.031905] Hardware name: riscv-virtio,qemu (DT)\n[25469.031928] epc : __free_percpu_irq+0xa2/0x150\n[25469.031976] ra : __free_percpu_irq+0xa2/0x150\n[25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff2000000088bd50\n[25469.032241] gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff2000000088baf8\n[25469.032285] t1 : fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90\n[25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00\n[25469.032372] a2 : 0000000000000023 a3 : 0000000000000001 a4 : ffffffff8122dbf8\n[25469.032410] a5 : 0000000000000fff a6 : 0000000000000000 a7 : ffffffff8122dc10\n[25469.032448] s2 : ff60000080c22eb0 s3 : 0000000200000022 s4 : 000000000000001f\n[25469.032488] s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : 0000000000000000\n[25469.032582] s8 : 0000000000000003 s9 : 000055556b7fb490 s10: 00007ffff0e12fa0\n[25469.032621] s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7\n[25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7\n[25469.032698] status: 0000000200000100 badaddr: ffffffff8007db1e cause: 0000000000000003\n[25469.032738] [\u003cffffffff8007db1e\u003e] __free_percpu_irq+0xa2/0x150\n[25469.032797] [\u003cffffffff8007dbfc\u003e] free_percpu_irq+0x30/0x5e\n[25469.032856] [\u003cffffffff013a57dc\u003e] kvm_riscv_aia_exit+0x40/0x42 [kvm]\n[25469.033947] [\u003cffffffff013b4e82\u003e] cleanup_module+0x10/0x32 [kvm]\n[25469.035300] [\u003cffffffff8009b150\u003e] __riscv_sys_delete_module+0x18e/0x1fc\n[25469.035374] [\u003cffffffff8000c1ca\u003e] syscall_handler+0x3a/0x46\n[25469.035456] [\u003cffffffff809ec9a4\u003e] do_trap_ecall_u+0x72/0x134\n[25469.035536] [\u003cffffffff809f5e18\u003e] handle_exception+0x148/0x156\n\nInvoke aia_exit and other arch specific cleanup functions after kvm_exit\nso that disable gets a chance to be called first before exit."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:21.571Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce906c4ae572554f4ea4381d7d0a4ab39f5fca5d"
},
{
"url": "https://git.kernel.org/stable/c/b7236c52151c91f7b83a42d6ec5728a49e06416f"
},
{
"url": "https://git.kernel.org/stable/c/1edb2de48616b11ee05e9a65d74c70abcb6d9939"
},
{
"url": "https://git.kernel.org/stable/c/1521cc04f0b6e737ff30105aa57fa9dde8493231"
},
{
"url": "https://git.kernel.org/stable/c/2d117e67f318303f6ab699a5511d1fac3f170545"
}
],
"title": "RISC-V: KVM: Teardown riscv specific bits after kvm_exit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-23135",
"datePublished": "2025-04-16T14:13:15.795Z",
"dateReserved": "2025-01-11T14:28:41.511Z",
"dateUpdated": "2026-10-21T12:36:21.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93216 (GCVE-0-2026-93216)
Vulnerability from cvelistv5
Published
2026-09-24 15:10
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the
start to guard against tail pages and NULL data. However, it later
re-reads page->memcg_data locklessly in two places:
1: page_memcg_check(page)
2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes
VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)
If the page is concurrently freed and reallocated as a THP tail page or
slab page between these calls, the VM_BUG_ON assertions can trigger on
CONFIG_DEBUG_VM=y builds, crashing the kernel.
Fix both TOCTOU issues by using the memcg_data snapshot throughout.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/page_owner.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7c1923c5f30a6953f0540e3171d882ec17b05d3",
"status": "affected",
"version": "fcf8935832b86d3437f00e732c6d0d4d2819d6a9",
"versionType": "git"
},
{
"lessThan": "a4c940ab3f794f221a338c9431ad1ce0d73a2bea",
"status": "affected",
"version": "fcf8935832b86d3437f00e732c6d0d4d2819d6a9",
"versionType": "git"
},
{
"lessThan": "46761406e14381dc35f498c247a87565b87ea2ef",
"status": "affected",
"version": "fcf8935832b86d3437f00e732c6d0d4d2819d6a9",
"versionType": "git"
},
{
"lessThan": "90f095b816e25c6a9e4446d299bac5007fdcb3df",
"status": "affected",
"version": "fcf8935832b86d3437f00e732c6d0d4d2819d6a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/page_owner.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()\n\nprint_page_owner_memcg() reads page-\u003ememcg_data via READ_ONCE() at the\nstart to guard against tail pages and NULL data. However, it later\nre-reads page-\u003ememcg_data locklessly in two places:\n\n1: page_memcg_check(page)\n\n2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes\n VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)\n\nIf the page is concurrently freed and reallocated as a THP tail page or\nslab page between these calls, the VM_BUG_ON assertions can trigger on\nCONFIG_DEBUG_VM=y builds, crashing the kernel.\n\nFix both TOCTOU issues by using the memcg_data snapshot throughout."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:21.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7c1923c5f30a6953f0540e3171d882ec17b05d3"
},
{
"url": "https://git.kernel.org/stable/c/a4c940ab3f794f221a338c9431ad1ce0d73a2bea"
},
{
"url": "https://git.kernel.org/stable/c/46761406e14381dc35f498c247a87565b87ea2ef"
},
{
"url": "https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df"
}
],
"title": "mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93216",
"datePublished": "2026-09-24T15:10:38.702Z",
"dateReserved": "2026-09-17T16:02:15.093Z",
"dateUpdated": "2026-10-21T12:52:21.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74506 (GCVE-0-2026-74506)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix UAF when sending a message
In afs_make_call(), there's a race with async call reception and
destruction. If a call is dispatched that doesn't have call->write_iter
set (used to specify the data content for FS.StoreData), then the first
rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr.
Once rxrpc_send_data() queues the last request packet, the response could
come in at any time and cause the call to be completed and put. However,
afs_make_call() will look at the call again to see it ->write_iter should
be handled - something it's only allowed to do if it has its own ref on the
call. Whilst this is the case for synchronous calls, it isn't true for
async calls such as FS.FetchData.
There's also a potential UAF in afs_make_call() in the event that an
asynchronous call is being sent, but the call fails in some way (e.g. it
gets aborted from the server). The problem there is that afs_make_call()
tries to abort a call if the rxrpc send fails, but the asynchronous
notification from rxrpc may have caused the afs_call to be torn down.
generic/650 plays games with randomly taking CPUs offline, and can
interject a significant delay such that the call is deallocated before
afs_make_call() gets to check call->write_iter - and a UAF ensues (caught
by KASAN).
BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs]
Read of size 8 at addr ffff888035e050e8 by task fsstress/1409
Fix this by making afs_make_op_call() give the op->call its own ref rather
than transferring the caller's ref to it and then dropping the ref when
afs_make_call() returns.
This also means that the afs_make_call() func never loses its ref on the
call now.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74506",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:26.910727Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:50.889Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/afs/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cbb0d3da042c01082f40166fdc99bf1752db72be",
"status": "affected",
"version": "e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2",
"versionType": "git"
},
{
"lessThan": "c0d3b81f703b2a9e37fe1347610a50cdf0078c27",
"status": "affected",
"version": "e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2",
"versionType": "git"
},
{
"lessThan": "daaa726b14fc3026a6b328614d312b698f62f391",
"status": "affected",
"version": "e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2",
"versionType": "git"
},
{
"lessThan": "4af1ec68d54b3871155914d584fb10669c41a861",
"status": "affected",
"version": "e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/afs/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix UAF when sending a message\n\nIn afs_make_call(), there\u0027s a race with async call reception and\ndestruction. If a call is dispatched that doesn\u0027t have call-\u003ewrite_iter\nset (used to specify the data content for FS.StoreData), then the first\nrxrpc_kernel_send_data() will not set MSG_MORE in the msghdr.\n\nOnce rxrpc_send_data() queues the last request packet, the response could\ncome in at any time and cause the call to be completed and put. However,\nafs_make_call() will look at the call again to see it -\u003ewrite_iter should\nbe handled - something it\u0027s only allowed to do if it has its own ref on the\ncall. Whilst this is the case for synchronous calls, it isn\u0027t true for\nasync calls such as FS.FetchData.\n\nThere\u0027s also a potential UAF in afs_make_call() in the event that an\nasynchronous call is being sent, but the call fails in some way (e.g. it\ngets aborted from the server). The problem there is that afs_make_call()\ntries to abort a call if the rxrpc send fails, but the asynchronous\nnotification from rxrpc may have caused the afs_call to be torn down.\n\ngeneric/650 plays games with randomly taking CPUs offline, and can\ninterject a significant delay such that the call is deallocated before\nafs_make_call() gets to check call-\u003ewrite_iter - and a UAF ensues (caught\nby KASAN).\n\n BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs]\n Read of size 8 at addr ffff888035e050e8 by task fsstress/1409\n\nFix this by making afs_make_op_call() give the op-\u003ecall its own ref rather\nthan transferring the caller\u0027s ref to it and then dropping the ref when\nafs_make_call() returns.\n\nThis also means that the afs_make_call() func never loses its ref on the\ncall now."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in kAFS client afs_make_call() during outbound FS.FetchData/YFS.FetchData RPCs, reached via local VFS read or readahead on an afs-mounted file (read_iter \u2192 afs_issue_read \u2192 afs_fs_fetch_data \u2192 afs_make_op_call), not from unsolicited remote packet processing alone.\nAC:L - The attacker controls both sides of the race: concurrent reads/readahead (as in xfstests generic/650 fsstress) while a fast or malicious AFS server reply completes and frees the async afs_call before afs_make_call() re-checks call-\u003ewrite_iter; no uncontrolled memory layout is required.\nPR:L - Any unprivileged local user with read permission on an already-mounted AFS volume can trigger async FetchData; mounting requires admin, but exercising the vulnerable read path needs only normal file access, matching the unprivileged fsstress reproducer.\nUI:N - No victim interaction is required; the attacker or local stress tool initiates the reads that dispatch the vulnerable async RPC, and AFS being mounted is an environmental precondition rather than interactive user action.\nS:U - The slab use-after-free in the kernel AFS client may enable local privilege escalation but does not cross a VM, container runtime, or IOMMU security boundary.\nC:H - KASAN reports slab-use-after-free with an 8-byte read of call-\u003ewrite_iter after async completion frees the afs_call; UAF over attacker-influenceable freed slab memory enables arbitrary kernel memory read primitives.\nI:H - The same use-after-free in afs_make_call() can be leveraged via heap grooming and spraying to obtain arbitrary kernel write or control-flow hijack, not merely a benign crash.\nA:H - The bug reliably triggers KASAN failures and kernel oops during normal async FetchData I/O, and UAF races can panic or wedge the system even before full exploit development."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:42.783Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cbb0d3da042c01082f40166fdc99bf1752db72be"
},
{
"url": "https://git.kernel.org/stable/c/c0d3b81f703b2a9e37fe1347610a50cdf0078c27"
},
{
"url": "https://git.kernel.org/stable/c/daaa726b14fc3026a6b328614d312b698f62f391"
},
{
"url": "https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861"
}
],
"title": "afs: Fix UAF when sending a message",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74506",
"datePublished": "2026-08-15T12:27:30.057Z",
"dateReserved": "2026-08-15T05:44:03.908Z",
"dateUpdated": "2026-10-21T12:45:42.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80662 (GCVE-0-2026-80662)
Vulnerability from cvelistv5
Published
2026-08-28 06:49
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58
bytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing
64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512,
eight times the actual on-device size.
header_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the
RAS capability iomap, overrunning the 88-byte mapping by 448 bytes.
The cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE
(512) bytes from its source. For the CPER caller the source is
struct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a
stack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes
of kernel stack into the trace event ring buffer where userspace can
read it via tracefs.
Set CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it,
bringing all iomap readers into agreement on 16 dwords. Userspace tools
such as rasdaemon have grown a dependency on the buggy 512-byte (128 u32)
header_log layout in the cxl_aer_uncorrectable_error trace event. Add
CXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event
__array and its memcpy to preserve that ABI. Both callers now pass a
zero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only
the first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware;
the remaining 112 u32s are zero-padded, keeping the 512-byte trace ring
buffer layout intact.
[ dj: Replaced 64 with SZ_64 per RichardC ]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/ras.c",
"drivers/cxl/core/trace.h",
"drivers/cxl/cxl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d031617045dc743764ea574432e5c2a3757b4e57",
"status": "affected",
"version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
"versionType": "git"
},
{
"lessThan": "e3e8f3b760bcf6a4b3aec412015b74b578729006",
"status": "affected",
"version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
"versionType": "git"
},
{
"lessThan": "6fc1919a6f2ed541484dd1f6cd93374044f8fd3d",
"status": "affected",
"version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
"versionType": "git"
},
{
"lessThan": "fc5eb0962a5e50d64e711817cc24d67df2d90528",
"status": "affected",
"version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
"versionType": "git"
},
{
"lessThan": "c268f949e219f9e179558e836f457f6c5fbec416",
"status": "affected",
"version": "2905cb5236cba63a5dc8a83752dcc31f3cc819f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/ras.c",
"drivers/cxl/core/trace.h",
"drivers/cxl/cxl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size\n\nThe CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58\nbytes (CXL_RAS_CAPABILITY_LENGTH); the Header Log occupies the trailing\n64 bytes at offset 0x18. CXL_HEADERLOG_SIZE was defined as SZ_512,\neight times the actual on-device size.\n\nheader_log_copy() reads CXL_HEADERLOG_SIZE_U32 (128) dwords from the\nRAS capability iomap, overrunning the 88-byte mapping by 448 bytes.\nThe cxl_aer_uncorrectable_error trace event memcpy()s CXL_HEADERLOG_SIZE\n(512) bytes from its source. For the CPER caller the source is\nstruct cxl_ras_capability_regs::header_log[16] (64 bytes) embedded in a\nstack-local cxl_cper_prot_err_work_data, so the memcpy reads 448 bytes\nof kernel stack into the trace event ring buffer where userspace can\nread it via tracefs.\n\nSet CXL_HEADERLOG_SIZE to 64 and derive CXL_HEADERLOG_SIZE_U32 from it,\nbringing all iomap readers into agreement on 16 dwords. Userspace tools\nsuch as rasdaemon have grown a dependency on the buggy 512-byte (128 u32)\nheader_log layout in the cxl_aer_uncorrectable_error trace event. Add\nCXL_HEADERLOG_TRACE_SIZE_U32 = 128 and use it for the trace event\n__array and its memcpy to preserve that ABI. Both callers now pass a\nzero-filled u32[CXL_HEADERLOG_TRACE_SIZE_U32] staging buffer with only\nthe first CXL_HEADERLOG_SIZE_U32 (16) entries populated from hardware;\nthe remaining 112 u32s are zero-padded, keeping the 512-byte trace ring\nbuffer layout intact.\n\n[ dj: Replaced 64 with SZ_64 per RichardC ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is only reached in kernel CXL RAS error handling (cxl_handle_ras via PCI AER cxl_error_detected, and CPER paths cxl_cper_post_prot_err/extlog_cxl_cper_handle_prot_err). Disclosure requires reading tracefs; there is no network, adjacent-radio, or direct physical-bus syscall entry to the vulnerable memcpy/readl sites.\nAC:L - With CAP_SYS_ADMIN, ACPI/CXL EINJ via debugfs einj_inject deterministically injects uncorrectable CXL protocol errors that traverse cxl_cper_handle_prot_err/cxl_handle_ras. Without root, a tracing-group member on CXL servers running rasdaemon can reliably capture the leak whenever organic uncorrectable RAS events occur.\nPR:L - Exploitation requires reading cxl_aer_uncorrectable_error data from tracefs (TRACE_MODE_READ 0440), routinely granted to tracing-group/rasdaemon service accounts on CXL/RAS deployments. Triggering on demand uses debugfs EINJ (root) or natural hardware errors; no init-namespace-only capability beyond tracefs DAC is needed for the stack leak.\nUI:N - Once CXL tracepoints are enabled (as rasdaemon does automatically), uncorrectable RAS/CPER processing copies the overlong header_log during kernel error handling. No victim mount, login, or interactive action is required beyond the attacker (or environment) having tracefs access when an error fires.\nS:U - The flaw leaks kernel stack/MMIO data into the trace ring buffer within the host kernel. Impact stays in the same OS security authority (local privilege/information gain) and does not cross guest/host, IOMMU, or container hardware trust boundaries.\nC:H - TP_fast_assign memcpy() copies 512 bytes from a 64-byte ras_cap.header_log on the stack, leaking 448 bytes of kernel stack into tracefs. header_log_copy() also readl()s 128 dwords from an 88-byte RAS iomap, an out-of-bounds read of adjacent MMIO/device memory.\nI:N - Both failure modes are out-of-bounds reads only (stack and MMIO). The trace event stores leaked bytes in the ring buffer but does not corrupt attacker-controlled memory or provide a direct arbitrary-write primitive.\nA:H - header_log_copy() performs 448 bytes of MMIO reads past the devm_ioremap() RAS window (0x58 bytes), which can provoke CPU/MMU faults or platform errors on out-of-range readl(). Uncorrectable-error handling itself can disable CXL.mem devices and force resets, impacting availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:49.254Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d031617045dc743764ea574432e5c2a3757b4e57"
},
{
"url": "https://git.kernel.org/stable/c/e3e8f3b760bcf6a4b3aec412015b74b578729006"
},
{
"url": "https://git.kernel.org/stable/c/6fc1919a6f2ed541484dd1f6cd93374044f8fd3d"
},
{
"url": "https://git.kernel.org/stable/c/fc5eb0962a5e50d64e711817cc24d67df2d90528"
},
{
"url": "https://git.kernel.org/stable/c/c268f949e219f9e179558e836f457f6c5fbec416"
}
],
"title": "cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80662",
"datePublished": "2026-08-28T06:49:06.277Z",
"dateReserved": "2026-08-26T14:34:25.781Z",
"dateUpdated": "2026-10-21T12:46:49.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74538 (GCVE-0-2026-74538)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: lock sk in iso_connect_ind
Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the
"ev3" part of iso_connect_ind. It may also be NULL if socket has
transitioned away from the LISTEN/CONNECT states before locking.
Fix by adding lock/release. Recheck hcon is valid after lock acquire
where needed.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb Version: 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb Version: 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb Version: 168d9bf9c7f01df71e6404cfff66d9c2a8e968fb Version: 489efc9ae36f164423f5fa7ace772a7ab8131cd8 Version: 6.8.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:35.716308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:54.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e830354c120954ccb9ca15880245912722c4031",
"status": "affected",
"version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
"versionType": "git"
},
{
"lessThan": "e8e9cff6d80eeec28dec4cf7cc18662986945391",
"status": "affected",
"version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
"versionType": "git"
},
{
"lessThan": "9bee7e476534f27e830658dad962d85da9edf6bf",
"status": "affected",
"version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
"versionType": "git"
},
{
"lessThan": "4311fd6f429065a8ba208660360a895627a00cf3",
"status": "affected",
"version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
"versionType": "git"
},
{
"status": "affected",
"version": "489efc9ae36f164423f5fa7ace772a7ab8131cd8",
"versionType": "git"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_connect_ind\n\nAccessing iso_pi(sk)-\u003econn requires lock_sock, which is not taken in the\n\"ev3\" part of iso_connect_ind. It may also be NULL if socket has\ntransitioned away from the LISTEN/CONNECT states before locking.\n\nFix by adding lock/release. Recheck hcon is valid after lock acquire\nwhere needed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is hit in hci_le_per_adv_report_evt when the controller delivers HCI_EV_LE_PER_ADV_REPORT from in-range LE periodic advertising; this is the Bluetooth ISO broadcast-sink path on phones/headsets in public spaces, not a local-only syscall entry point.\nAC:L - Exploitation is a socket-lock race where the attacker can repeatedly deliver PA reports and concurrently close or tear down the matching ISO listen socket (or race automatic teardown), controlling both sides rather than depending on uncontrollable memory layout.\nPR:N - An adjacent Bluetooth attacker needs no account or capabilities on the victim; they only need the device to be using LE Audio broadcast reception while they transmit periodic advertising that drives the vulnerable HCI handler.\nUI:N - Once a broadcast sink socket is active, triggering the flaw does not require the victim to perform a specific one-off action at exploit time; the attacker can flood PA reports and race normal stack teardown without user prompts.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; there is no VM escape, IOMMU bypass, or cross-authority scope change.\nC:H - Missing lock_sock allows TOCTOU/UAF on iso_pi(sk)-\u003econn and stale hci_conn pointers; per kernel guidance, this class of race on connection objects can expose freed kernel heap contents and enable information disclosure primitives.\nI:H - The handler memcpy()s attacker-controlled PA report bytes into hcon-\u003ele_per_adv_data without holding the socket lock, so a stale hcon can turn remote advertising data into an exploitable kernel heap write/control-flow corruption primitive.\nA:H - Concurrent NULL conn dereference or use of a detached hci_conn can oops/panic the kernel during PA reassembly, and the remote PA-report trigger can be repeated to cause sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:51.636Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e830354c120954ccb9ca15880245912722c4031"
},
{
"url": "https://git.kernel.org/stable/c/e8e9cff6d80eeec28dec4cf7cc18662986945391"
},
{
"url": "https://git.kernel.org/stable/c/9bee7e476534f27e830658dad962d85da9edf6bf"
},
{
"url": "https://git.kernel.org/stable/c/4311fd6f429065a8ba208660360a895627a00cf3"
}
],
"title": "Bluetooth: ISO: lock sk in iso_connect_ind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74538",
"datePublished": "2026-08-15T12:27:50.271Z",
"dateReserved": "2026-08-15T05:44:03.913Z",
"dateUpdated": "2026-10-21T12:45:51.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90328 (GCVE-0-2026-90328)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: steam: Reject short reads
Steam Controller FEATURE reports encode the size of the message in the
message itself. Previously we were trusting that the size reported matched
the size we actually read, leading to a potential issue with short reads.
Instead, we should actually verify the length of the read.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c164d6abf3841ffacfdb757c10616f9cb1f67276 Version: c164d6abf3841ffacfdb757c10616f9cb1f67276 Version: c164d6abf3841ffacfdb757c10616f9cb1f67276 Version: c164d6abf3841ffacfdb757c10616f9cb1f67276 Version: c164d6abf3841ffacfdb757c10616f9cb1f67276 Version: c164d6abf3841ffacfdb757c10616f9cb1f67276 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-steam.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "304b24432c7ab40d63cd698729a7305c3b8eada2",
"status": "affected",
"version": "c164d6abf3841ffacfdb757c10616f9cb1f67276",
"versionType": "git"
},
{
"lessThan": "37cb84b992718924dc334ce584c703333a6a4217",
"status": "affected",
"version": "c164d6abf3841ffacfdb757c10616f9cb1f67276",
"versionType": "git"
},
{
"lessThan": "cbcc9b0ccbbd33125ffc9479fb8f69ac969fe55c",
"status": "affected",
"version": "c164d6abf3841ffacfdb757c10616f9cb1f67276",
"versionType": "git"
},
{
"lessThan": "f694ea0ead544080949e409a7c6885ee1fc77a98",
"status": "affected",
"version": "c164d6abf3841ffacfdb757c10616f9cb1f67276",
"versionType": "git"
},
{
"lessThan": "93c5cc35bcd9f62db589a21945b49691dccdd99d",
"status": "affected",
"version": "c164d6abf3841ffacfdb757c10616f9cb1f67276",
"versionType": "git"
},
{
"lessThan": "33ff7b49c38b39b1f3d27db508ac0720fb25c08a",
"status": "affected",
"version": "c164d6abf3841ffacfdb757c10616f9cb1f67276",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-steam.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Reject short reads\n\nSteam Controller FEATURE reports encode the size of the message in the\nmessage itself. Previously we were trusting that the size reported matched\nthe size we actually read, leading to a potential issue with short reads.\nInstead, we should actually verify the length of the read."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:11.051Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/304b24432c7ab40d63cd698729a7305c3b8eada2"
},
{
"url": "https://git.kernel.org/stable/c/37cb84b992718924dc334ce584c703333a6a4217"
},
{
"url": "https://git.kernel.org/stable/c/cbcc9b0ccbbd33125ffc9479fb8f69ac969fe55c"
},
{
"url": "https://git.kernel.org/stable/c/f694ea0ead544080949e409a7c6885ee1fc77a98"
},
{
"url": "https://git.kernel.org/stable/c/93c5cc35bcd9f62db589a21945b49691dccdd99d"
},
{
"url": "https://git.kernel.org/stable/c/33ff7b49c38b39b1f3d27db508ac0720fb25c08a"
}
],
"title": "HID: steam: Reject short reads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90328",
"datePublished": "2026-09-17T16:08:42.642Z",
"dateReserved": "2026-09-11T19:38:34.802Z",
"dateUpdated": "2026-10-30T12:35:11.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99134 (GCVE-0-2026-99134)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mac802154: fix data race and NULL deref on local->assoc_dev
local->assoc_dev is shared between the association path and the
association-response worker without common synchronization.
mac802154_perform_association() stores the coordinator pointer and waits
for a response. Its timeout and error paths clear the pointer and return
to mac802154_associate(), which may then free the coordinator object.
Meanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit
and enter mac802154_process_association_resp(), which dereferences
assoc_dev.
The worker's bit test and the handler's pointer dereference are not
atomic with respect to cleanup. Cleanup can clear assoc_dev between them,
causing a NULL dereference, or free the coordinator while the response
handler still uses the pointer.
The recorded result is exposed to the same window. assoc_status and
assoc_addr are written by the handler but read by the association path
while the associating bit is still set, so a second response for the same
request - a malicious one, for instance - can replace them between those
reads and leave the caller with an incoherent status and address pair.
The response handler only needs the coordinator extended address.
Replace assoc_dev with a cached address, removing the pointer lifetime
dependency. Protect the cached address and the associating bit with a
dedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee
an atomic __le64 access on all 32-bit architectures.
wpan_dev->association_lock cannot be reused here: nl802154_associate()
holds it across rdev_associate(), hence for the whole of
mac802154_perform_association() including the wait for the response.
A response handler taking that lock would only get it once the
association has already given up.
Reset the completion, publish the cached address, and set the associating
bit while holding the lock. The response handler takes the lock, rechecks
the bit and the cached address, records the response, clears the bit, and
only then completes the waiter. Thus cleanup cannot pass the handler
between its state check and completion, and the cached 64-bit value
cannot tear.
The handler clears the bit before completing, not the woken waiter:
otherwise complete() is issued under the lock and a second (e.g.
malicious) response can reacquire it before the waiter and replace the
result. So a wait that returns success implies the bit is already clear,
and the success and negative-response paths return directly. The
transmit-error and timeout paths still clear it under assoc_lock, which
serializes any racing response against the cleanup while the call returns
the error it already selected. Both paths snapshot assoc_status and
assoc_addr under the same lock.
Both users run in process context, so a plain spinlock is sufficient.
The lock is not held while waiting for the completion.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac802154/ieee802154_i.h",
"net/mac802154/main.c",
"net/mac802154/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfbb59fb0bc8ec82d98189a4df66ccc03d159386",
"status": "affected",
"version": "fefd19807fe9c65002366c749e809996a1ca4e68",
"versionType": "git"
},
{
"lessThan": "3cdd8b1abddebbae2582e90294c77b61d5f5aee7",
"status": "affected",
"version": "fefd19807fe9c65002366c749e809996a1ca4e68",
"versionType": "git"
},
{
"lessThan": "a585901bb8cd2cd60d678be8a56ca6a4e1a6946c",
"status": "affected",
"version": "fefd19807fe9c65002366c749e809996a1ca4e68",
"versionType": "git"
},
{
"lessThan": "c037915f80c4db47f7d061d68e703ffd551b1a34",
"status": "affected",
"version": "fefd19807fe9c65002366c749e809996a1ca4e68",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac802154/ieee802154_i.h",
"net/mac802154/main.c",
"net/mac802154/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix data race and NULL deref on local-\u003eassoc_dev\n\nlocal-\u003eassoc_dev is shared between the association path and the\nassociation-response worker without common synchronization.\n\nmac802154_perform_association() stores the coordinator pointer and waits\nfor a response. Its timeout and error paths clear the pointer and return\nto mac802154_associate(), which may then free the coordinator object.\nMeanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit\nand enter mac802154_process_association_resp(), which dereferences\nassoc_dev.\n\nThe worker\u0027s bit test and the handler\u0027s pointer dereference are not\natomic with respect to cleanup. Cleanup can clear assoc_dev between them,\ncausing a NULL dereference, or free the coordinator while the response\nhandler still uses the pointer.\n\nThe recorded result is exposed to the same window. assoc_status and\nassoc_addr are written by the handler but read by the association path\nwhile the associating bit is still set, so a second response for the same\nrequest - a malicious one, for instance - can replace them between those\nreads and leave the caller with an incoherent status and address pair.\n\nThe response handler only needs the coordinator extended address.\nReplace assoc_dev with a cached address, removing the pointer lifetime\ndependency. Protect the cached address and the associating bit with a\ndedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee\nan atomic __le64 access on all 32-bit architectures.\n\nwpan_dev-\u003eassociation_lock cannot be reused here: nl802154_associate()\nholds it across rdev_associate(), hence for the whole of\nmac802154_perform_association() including the wait for the response.\nA response handler taking that lock would only get it once the\nassociation has already given up.\n\nReset the completion, publish the cached address, and set the associating\nbit while holding the lock. The response handler takes the lock, rechecks\nthe bit and the cached address, records the response, clears the bit, and\nonly then completes the waiter. Thus cleanup cannot pass the handler\nbetween its state check and completion, and the cached 64-bit value\ncannot tear.\n\nThe handler clears the bit before completing, not the woken waiter:\notherwise complete() is issued under the lock and a second (e.g.\nmalicious) response can reacquire it before the waiter and replace the\nresult. So a wait that returns success implies the bit is already clear,\nand the success and negative-response paths return directly. The\ntransmit-error and timeout paths still clear it under assoc_lock, which\nserializes any racing response against the cleanup while the call returns\nthe error it already selected. Both paths snapshot assoc_status and\nassoc_addr under the same lock.\n\nBoth users run in process context, so a plain spinlock is sufficient.\nThe lock is not held while waiting for the completion."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:07.557Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfbb59fb0bc8ec82d98189a4df66ccc03d159386"
},
{
"url": "https://git.kernel.org/stable/c/3cdd8b1abddebbae2582e90294c77b61d5f5aee7"
},
{
"url": "https://git.kernel.org/stable/c/a585901bb8cd2cd60d678be8a56ca6a4e1a6946c"
},
{
"url": "https://git.kernel.org/stable/c/c037915f80c4db47f7d061d68e703ffd551b1a34"
}
],
"title": "mac802154: fix data race and NULL deref on local-\u003eassoc_dev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99134",
"datePublished": "2026-10-28T10:34:47.193Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:07.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93272 (GCVE-0-2026-93272)
Vulnerability from cvelistv5
Published
2026-09-24 15:52
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
The changes introduced to handle single power domain platforms have
swapped the info pointer increment from num_pd_vregs to num_pds, which
would shift the info pointer past the end of the array for pronto-v3,
which does not list power domain regulators in vregs.
This showed up as a difference between GCC- and LLVM-compiled kernels
on SDM632 devices, where only with LLVM one would get the
"regulator request with no identifier" error, because the out-of-bounds
memory ended up being zeroed. Fix by skipping the increment when there
are more power domains than regulators.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8d0d4c11cace475f1b07f98ee3d2bd334590e17b Version: fef1e1487dea81c2b4560e393ba4b0be57e28d01 Version: 69bb5b3ae348040e385113efba5bdc76396644d0 Version: 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 Version: 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 Version: 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 Version: 654c295f9079d2c7875172142022168e34c4e34e Version: 04a89c98810d2dba8187120c07fdb732aa40ca14 Version: 6.1.141 ≤ Version: 6.6.93 ≤ Version: 6.12.31 ≤ Version: 5.15.185 ≤ Version: 6.14.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/qcom_wcnss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d5deaa0b6d91b1063055415fc53f75c40c2a077d",
"status": "affected",
"version": "8d0d4c11cace475f1b07f98ee3d2bd334590e17b",
"versionType": "git"
},
{
"lessThan": "7abab59d6c99ba2b8101d6f44ad25159b1510724",
"status": "affected",
"version": "fef1e1487dea81c2b4560e393ba4b0be57e28d01",
"versionType": "git"
},
{
"lessThan": "e572cbb513cde53d90fb4729cad75056cd647ce3",
"status": "affected",
"version": "69bb5b3ae348040e385113efba5bdc76396644d0",
"versionType": "git"
},
{
"lessThan": "2e7e39bb81913feaac463b7add46bafdca06fbde",
"status": "affected",
"version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71",
"versionType": "git"
},
{
"lessThan": "bce6b48af3abf7468d12ef4933f21bd8c1d822e9",
"status": "affected",
"version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71",
"versionType": "git"
},
{
"lessThan": "3dbc90b9c22ea96e37bf55f6011e63b5123ec668",
"status": "affected",
"version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71",
"versionType": "git"
},
{
"status": "affected",
"version": "654c295f9079d2c7875172142022168e34c4e34e",
"versionType": "git"
},
{
"status": "affected",
"version": "04a89c98810d2dba8187120c07fdb732aa40ca14",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.31",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.185",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/qcom_wcnss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3\n\nThe changes introduced to handle single power domain platforms have\nswapped the info pointer increment from num_pd_vregs to num_pds, which\nwould shift the info pointer past the end of the array for pronto-v3,\nwhich does not list power domain regulators in vregs.\n\nThis showed up as a difference between GCC- and LLVM-compiled kernels\non SDM632 devices, where only with LLVM one would get the\n\"regulator request with no identifier\" error, because the out-of-bounds\nmemory ended up being zeroed. Fix by skipping the increment when there\nare more power domains than regulators."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:37.528Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d5deaa0b6d91b1063055415fc53f75c40c2a077d"
},
{
"url": "https://git.kernel.org/stable/c/7abab59d6c99ba2b8101d6f44ad25159b1510724"
},
{
"url": "https://git.kernel.org/stable/c/e572cbb513cde53d90fb4729cad75056cd647ce3"
},
{
"url": "https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde"
},
{
"url": "https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9"
},
{
"url": "https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668"
}
],
"title": "remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93272",
"datePublished": "2026-09-24T15:52:14.274Z",
"dateReserved": "2026-09-17T16:02:15.098Z",
"dateUpdated": "2026-10-30T12:36:37.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80884 (GCVE-0-2026-80884)
Vulnerability from cvelistv5
Published
2026-09-04 16:49
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntb: Store original DMA address for future release
The DMA API requires that dma_free_attrs receive the exact dma_handle
originally returned by the allocation function. Do not modify it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 Version: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 Version: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 Version: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 Version: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 Version: fc5d1829f9bf3d8275322727c0e9a8baf268b7c6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05a4585f76fd7bbec41bb7bf07a4d2ee2ba607d0",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
},
{
"lessThan": "2b9ddb7311c79e8af2410abd97765fffd9ddf586",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
},
{
"lessThan": "a4a046f668c7c7d0df9510cc426678563fff1b03",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
},
{
"lessThan": "0f035333e19944f8ea7a423681f161eb1b2db21c",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
},
{
"lessThan": "10662aafce4acd52278c942d0a5b3993594017b9",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
},
{
"lessThan": "da6d997ac556479c112554ab5d95cbd04683eb11",
"status": "affected",
"version": "fc5d1829f9bf3d8275322727c0e9a8baf268b7c6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/ntb_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: Store original DMA address for future release\n\nThe DMA API requires that dma_free_attrs receive the exact dma_handle\noriginally returned by the allocation function. Do not modify it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:23.382Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05a4585f76fd7bbec41bb7bf07a4d2ee2ba607d0"
},
{
"url": "https://git.kernel.org/stable/c/2b9ddb7311c79e8af2410abd97765fffd9ddf586"
},
{
"url": "https://git.kernel.org/stable/c/a4a046f668c7c7d0df9510cc426678563fff1b03"
},
{
"url": "https://git.kernel.org/stable/c/0f035333e19944f8ea7a423681f161eb1b2db21c"
},
{
"url": "https://git.kernel.org/stable/c/10662aafce4acd52278c942d0a5b3993594017b9"
},
{
"url": "https://git.kernel.org/stable/c/da6d997ac556479c112554ab5d95cbd04683eb11"
}
],
"title": "ntb: Store original DMA address for future release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80884",
"datePublished": "2026-09-04T16:49:31.751Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-10-30T12:31:23.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98062 (GCVE-0-2026-98062)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark signal tracepoint siginfo arguments as scalar
The signal_generate and signal_deliver tracepoints declare their info
argument as a struct kernel_siginfo pointer. btf_ctx_access() therefore
treats it as a trusted pointer for tp_btf programs.
Signal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special
values for this argument. Those values are zero and one respectively,
and are not pointers. A tp_btf program can currently dereference either
value and fault the kernel. In particular, signal_generate can run from
timer interrupt context, turning the fault into a kernel panic.
Record both tracepoints in raw_tp_null_args[] and mark argument one as
a non-pointer. This preserves scalar access to the cookie while rejecting
direct and helper-mediated pointer use. Merely marking it nullable would
not suffice because SEND_SIG_PRIV is nonzero.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05757377fa0447163d07c43a119f81abe1eef8dc",
"status": "affected",
"version": "b2fc4b17fc13810ef440fb323fad3981cd174985",
"versionType": "git"
},
{
"lessThan": "0e78cb242a57e481061fcb542fed4d51afba25c4",
"status": "affected",
"version": "838a10bd2ebfe11a60dd67687533a7cfc220cc86",
"versionType": "git"
},
{
"lessThan": "d2eaea3599bcce659ce91862254dc91bcbdb6351",
"status": "affected",
"version": "838a10bd2ebfe11a60dd67687533a7cfc220cc86",
"versionType": "git"
},
{
"lessThan": "77515ab12e4983e6416f8c35039a3f0c0822ac70",
"status": "affected",
"version": "838a10bd2ebfe11a60dd67687533a7cfc220cc86",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark signal tracepoint siginfo arguments as scalar\n\nThe signal_generate and signal_deliver tracepoints declare their info\nargument as a struct kernel_siginfo pointer. btf_ctx_access() therefore\ntreats it as a trusted pointer for tp_btf programs.\n\nSignal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special\nvalues for this argument. Those values are zero and one respectively,\nand are not pointers. A tp_btf program can currently dereference either\nvalue and fault the kernel. In particular, signal_generate can run from\ntimer interrupt context, turning the fault into a kernel panic.\n\nRecord both tracepoints in raw_tp_null_args[] and mark argument one as\na non-pointer. This preserves scalar access to the cookie while rejecting\ndirect and helper-mediated pointer use. Merely marking it nullable would\nnot suffice because SEND_SIG_PRIV is nonzero."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:20.506Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05757377fa0447163d07c43a119f81abe1eef8dc"
},
{
"url": "https://git.kernel.org/stable/c/0e78cb242a57e481061fcb542fed4d51afba25c4"
},
{
"url": "https://git.kernel.org/stable/c/d2eaea3599bcce659ce91862254dc91bcbdb6351"
},
{
"url": "https://git.kernel.org/stable/c/77515ab12e4983e6416f8c35039a3f0c0822ac70"
}
],
"title": "bpf: Mark signal tracepoint siginfo arguments as scalar",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98062",
"datePublished": "2026-09-25T10:24:06.597Z",
"dateReserved": "2026-09-25T10:19:56.073Z",
"dateUpdated": "2026-10-21T12:54:20.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74273 (GCVE-0-2026-74273)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl/region: Block region delete during region creation
Expand the range lock, rename it "regions_lock", to disable region deletion
in the critical period between construct_region() and attach_target(), as
well as the period between device_add() and registering the remove actions.
Otherwise, userspace can confuse the kernel. It can violate the assumption
the region stays registered through the completion of cxl_add_to_region().
It can violate the assumption that devm_add_action_or_reset() is working
with a live 'struct cxl_region'.
It is ok for the region to disappear outside of those windows as that
mirrors device hotplug flows where the proper locks are held.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/port.c",
"drivers/cxl/core/region.c",
"drivers/cxl/cxl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8efa9fcc1d31b29b31e0ac4efe48624a729796bc",
"status": "affected",
"version": "a32320b71f085f8d82afedcf285f1682c8c00aed",
"versionType": "git"
},
{
"lessThan": "ecc86a28dc27509da511bb3f8c309750233e3177",
"status": "affected",
"version": "a32320b71f085f8d82afedcf285f1682c8c00aed",
"versionType": "git"
},
{
"lessThan": "98c7e206af48b4433b2192cc1a538db2acc49876",
"status": "affected",
"version": "a32320b71f085f8d82afedcf285f1682c8c00aed",
"versionType": "git"
},
{
"lessThan": "b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8",
"status": "affected",
"version": "a32320b71f085f8d82afedcf285f1682c8c00aed",
"versionType": "git"
},
{
"lessThan": "d91feb88692e81b00cd22f0125cfcd04970b4a0b",
"status": "affected",
"version": "a32320b71f085f8d82afedcf285f1682c8c00aed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/port.c",
"drivers/cxl/core/region.c",
"drivers/cxl/cxl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Block region delete during region creation\n\nExpand the range lock, rename it \"regions_lock\", to disable region deletion\nin the critical period between construct_region() and attach_target(), as\nwell as the period between device_add() and registering the remove actions.\n\nOtherwise, userspace can confuse the kernel. It can violate the assumption\nthe region stays registered through the completion of cxl_add_to_region().\nIt can violate the assumption that devm_add_action_or_reset() is working\nwith a live \u0027struct cxl_region\u0027.\n\nIt is ok for the region to disappear outside of those windows as that\nmirrors device hotplug flows where the proper locks are held."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:15.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8efa9fcc1d31b29b31e0ac4efe48624a729796bc"
},
{
"url": "https://git.kernel.org/stable/c/ecc86a28dc27509da511bb3f8c309750233e3177"
},
{
"url": "https://git.kernel.org/stable/c/98c7e206af48b4433b2192cc1a538db2acc49876"
},
{
"url": "https://git.kernel.org/stable/c/b0b6a9c65cb72c901fdcc6ae83d7afd70cdca1b8"
},
{
"url": "https://git.kernel.org/stable/c/d91feb88692e81b00cd22f0125cfcd04970b4a0b"
}
],
"title": "cxl/region: Block region delete during region creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74273",
"datePublished": "2026-08-15T05:57:46.134Z",
"dateReserved": "2026-08-15T05:44:03.879Z",
"dateUpdated": "2026-10-21T12:45:15.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74533 (GCVE-0-2026-74533)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
hci_conn::iso_data is accessed and modified without lock or RCU.
This leads to a race
[Task hdev->workqueue] [Task 2]
iso_recv iso_conn_put(conn)
conn = LOAD hcon->iso_data iso_conn_free(conn)
iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL
kfree(conn)
kref_get_unless_zero(&conn->ref) /* UAF */
and also to races in iso_conn_add() vs. iso_conn_free().
Fix by adding spinlock hci_conn::proto_lock and using it to guard
hci_conn::iso_data.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74533",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:22.174830Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:53.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/hci_core.h",
"net/bluetooth/hci_conn.c",
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08ac98f18c8d24cc037858dd6fba2670155e4e84",
"status": "affected",
"version": "a58d0f5dac322e16cc75334d000666512341bde5",
"versionType": "git"
},
{
"lessThan": "876a3e94c70d0859d1dad1c986112d4f0d99eba8",
"status": "affected",
"version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
"versionType": "git"
},
{
"lessThan": "af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c",
"status": "affected",
"version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
"versionType": "git"
},
{
"status": "affected",
"version": "f53e7489273dc2bb307bf50f319b3762d45534f0",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/hci_core.h",
"net/bluetooth/hci_conn.c",
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix race of kfree vs kref_get_unless_zero\n\nhci_conn::iso_data is accessed and modified without lock or RCU.\nThis leads to a race\n\n [Task hdev-\u003eworkqueue] \t[Task 2]\n iso_recv iso_conn_put(conn)\n conn = LOAD hcon-\u003eiso_data iso_conn_free(conn)\n iso_conn_hold_unless_zero(conn) hcon-\u003eiso_data = NULL\n kfree(conn)\n kref_get_unless_zero(\u0026conn-\u003eref) /* UAF */\n\nand also to races in iso_conn_add() vs. iso_conn_free().\n\nFix by adding spinlock hci_conn::proto_lock and using it to guard\nhci_conn::iso_data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in Bluetooth ISO receive handling (iso_recv in net/bluetooth/iso.c), reached when HCI processes ISO data packets from an adjacent BLE CIS/BIS/LE Audio peer via hci_recv_frame and hdev-\u003eworkqueue; per kernel guidance Bluetooth radio reachability is Adjacent.\nAC:L - The race is between iso_recv loading hcon-\u003eiso_data and iso_conn_free kfree-ing the same iso_conn; an attacker controls both sides by concurrently sending ISO HCI data while disconnecting or closing the ISO socket, without relying on uncontrollable memory layout.\nPR:N - BTPROTO_ISO sockets require no CAP_NET_ADMIN or CAP_NET_RAW; an unprivileged local process can open and tear down ISO connections, and an adjacent Bluetooth peer can drive iso_recv and hci disconnect events without any credentials on the victim host.\nUI:N - No victim interaction is needed during exploitation of an active ISO session; a remote peer can race incoming ISO packets against link teardown, and a local attacker can close its own ISO socket while receiving data without opening files or mounts.\nS:U - The UAF corrupts kernel heap memory in the Bluetooth ISO subsystem on the host, enabling standard local privilege escalation within the kernel boundary rather than crossing VM, container, or IOMMU isolation.\nC:H - iso_conn_hold_unless_zero calls kref_get_unless_zero on a freed iso_conn slab object after iso_conn_free kfree, and iso_recv then dereferences conn fields, a classic use-after-free enabling arbitrary kernel memory disclosure.\nI:H - The UAF on iso_conn (kref, spinlock, sk_buff and socket pointers) permits heap spraying and corruption of conn-\u003erx_skb/rx_len, providing primitives chainable to arbitrary kernel writes and control-flow hijacking.\nA:H - The use-after-free in iso_conn_hold_unless_zero during concurrent iso_recv and iso_conn_put reliably causes kernel oops or panic on freed slab memory, meeting High availability impact per kernel CVSS guidance for UAF crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:49.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08ac98f18c8d24cc037858dd6fba2670155e4e84"
},
{
"url": "https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8"
},
{
"url": "https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c"
}
],
"title": "Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74533",
"datePublished": "2026-08-15T12:27:47.219Z",
"dateReserved": "2026-08-15T05:44:03.912Z",
"dateUpdated": "2026-10-21T12:45:49.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45940 (GCVE-0-2026-45940)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-11-06 16:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix oops when split header is enabled
For GMAC4, when split header is enabled, in some rare cases, the
hardware does not fill buf2 of the first descriptor with payload.
Thus we cannot assume buf2 is always fully filled if it is not
the last descriptor. Otherwise, the length of buf2 of the second
descriptor will be calculated wrong and cause an oops:
Unable to handle kernel paging request at virtual address ffff00019246bfc0
...
x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000
Call trace:
dcache_inval_poc+0x28/0x58 (P)
dma_direct_sync_single_for_cpu+0x38/0x6c
__dma_sync_single_for_cpu+0x34/0x6c
stmmac_napi_poll_rx+0x8f0/0xb60
__napi_poll.constprop.0+0x30/0x144
net_rx_action+0x160/0x274
handle_softirqs+0x1b8/0x1fc
...
To fix this, the PL bit-field in RDES3 register is used for all
descriptors, whether it is the last descriptor or not.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ec222003bd948de8f3ffbca522d328af1a8452ad Version: ec222003bd948de8f3ffbca522d328af1a8452ad Version: ec222003bd948de8f3ffbca522d328af1a8452ad Version: ec222003bd948de8f3ffbca522d328af1a8452ad Version: ec222003bd948de8f3ffbca522d328af1a8452ad Version: ec222003bd948de8f3ffbca522d328af1a8452ad |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:02:28.444778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:03:15.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7fe1d75e087862bc4087f3fcdfd5e291b9d9caa",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "107e169f963920b11fa3c1bb384c077fe7330696",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "92b45c99311ac4f3857cccee47059c4fb067fd4d",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "36f81cb7d82e9614a7058da6abdf2e3a03993df1",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "babab1b42ed68877ef669a08384becf281ad2582",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix oops when split header is enabled\n\nFor GMAC4, when split header is enabled, in some rare cases, the\nhardware does not fill buf2 of the first descriptor with payload.\nThus we cannot assume buf2 is always fully filled if it is not\nthe last descriptor. Otherwise, the length of buf2 of the second\ndescriptor will be calculated wrong and cause an oops:\n\nUnable to handle kernel paging request at virtual address ffff00019246bfc0\n...\nx2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000\nCall trace:\n dcache_inval_poc+0x28/0x58 (P)\n dma_direct_sync_single_for_cpu+0x38/0x6c\n __dma_sync_single_for_cpu+0x34/0x6c\n stmmac_napi_poll_rx+0x8f0/0xb60\n __napi_poll.constprop.0+0x30/0x144\n net_rx_action+0x160/0x274\n handle_softirqs+0x1b8/0x1fc\n...\n\nTo fix this, the PL bit-field in RDES3 register is used for all\ndescriptors, whether it is the last descriptor or not."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:45.615Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7fe1d75e087862bc4087f3fcdfd5e291b9d9caa"
},
{
"url": "https://git.kernel.org/stable/c/107e169f963920b11fa3c1bb384c077fe7330696"
},
{
"url": "https://git.kernel.org/stable/c/92b45c99311ac4f3857cccee47059c4fb067fd4d"
},
{
"url": "https://git.kernel.org/stable/c/b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609"
},
{
"url": "https://git.kernel.org/stable/c/36f81cb7d82e9614a7058da6abdf2e3a03993df1"
},
{
"url": "https://git.kernel.org/stable/c/babab1b42ed68877ef669a08384becf281ad2582"
}
],
"title": "net: stmmac: fix oops when split header is enabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45940",
"datePublished": "2026-05-27T12:17:56.350Z",
"dateReserved": "2026-05-13T15:03:33.087Z",
"dateUpdated": "2026-11-06T16:03:15.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74385 (GCVE-0-2026-74385)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
The return value of nvmet_tcp_set_queue_sock() is currently ignored in
nvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket
not being in TCP_ESTABLISHED state), the socket callbacks will not be
properly set, leading to queue and socket leakage.
Fix this by capturing the return value and calling
nvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:01.310630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:36.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41b63ff99e3ef37d08f3693413dae5ede5e79fe1",
"status": "affected",
"version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
"versionType": "git"
},
{
"lessThan": "cba2ee57fd302727aea7d41e9d9cd0969f5df0fb",
"status": "affected",
"version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
"versionType": "git"
},
{
"lessThan": "22aa70f9a0544643ec37d442b6fcb1833d804462",
"status": "affected",
"version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
"versionType": "git"
},
{
"lessThan": "7ef789703e2b91775dcb36b2efa46325be31a2a0",
"status": "affected",
"version": "675b453e024154dd547921c6e6d5b58747ba7e0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check return value of nvmet_tcp_set_queue_sock\n\nThe return value of nvmet_tcp_set_queue_sock() is currently ignored in\nnvmet_tcp_tls_handshake_done(). If it fails (e.g., due to the socket\nnot being in TCP_ESTABLISHED state), the socket callbacks will not be\nproperly set, leading to queue and socket leakage.\n\nFix this by capturing the return value and calling\nnvmet_tcp_schedule_release_queue() on failure to ensure proper cleanup."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in nvmet-tcp, an in-kernel NVMe-over-TCP target that accepts remote TCP connections; the bug triggers in nvmet_tcp_tls_handshake_done() after tls_server_hello_psk() completes, reachable from any network peer that can connect to an exposed NVMe-oF TLS port (typical cloud/storage-server deployment).\nAC:L - An attacker controls both sides of the race by completing the TLS handshake and then closing or resetting the TCP connection so the socket is no longer TCP_ESTABLISHED when nvmet_tcp_set_queue_sock() runs; this is reliably repeatable across new connections without conditions outside attacker control.\nPR:N - Exploitation requires only network reachability to the NVMe-oF TCP target port; no Linux credentials, capabilities, or init-namespace root are needed, and the vulnerable path runs after TCP accept but before NVMe Connect, host NQN allow-list, or DH-HMAC-CHAP in-band authentication.\nUI:N - No victim user action is required; the attacker programmatically opens TLS connections to the NVMe target and times disconnects to hit the failure path, with no need for local users to mount filesystems or perform other interactive steps.\nS:U - Impact is confined to kernel resource exhaustion within the host running the NVMe target; leaked queues and sockets do not cross VM, container, or IOMMU security boundaries and do not constitute privilege escalation beyond the target kernel itself.\nC:N - The defect is a missed cleanup that leaks queue structures, sockets, and TLS key references; there is no use-after-free, out-of-bounds access, or other memory corruption that could expose kernel data to the attacker.\nI:N - No memory corruption, arbitrary write, or code-execution primitive is introduced; the bug only leaves queue and socket objects allocated without installing socket callbacks or scheduling proper teardown.\nA:H - Each successful trigger permanently leaks an nvmet_tcp_queue, socket/file reference, and IDA slot with no automatic recovery; repeated unauthenticated connections can exhaust kernel memory and socket resources, denying NVMe-oF service on internet-facing storage nodes until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:33.852Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41b63ff99e3ef37d08f3693413dae5ede5e79fe1"
},
{
"url": "https://git.kernel.org/stable/c/cba2ee57fd302727aea7d41e9d9cd0969f5df0fb"
},
{
"url": "https://git.kernel.org/stable/c/22aa70f9a0544643ec37d442b6fcb1833d804462"
},
{
"url": "https://git.kernel.org/stable/c/7ef789703e2b91775dcb36b2efa46325be31a2a0"
}
],
"title": "nvmet-tcp: check return value of nvmet_tcp_set_queue_sock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74385",
"datePublished": "2026-08-15T05:59:01.113Z",
"dateReserved": "2026-08-15T05:44:03.890Z",
"dateUpdated": "2026-10-21T12:45:33.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99192 (GCVE-0-2026-99192)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: unshare the skb before writing the control block
bcmgenet stores first_cb, last_cb and bytes_sent in the skb control
block and reads them back on completion to free the skb and credit BQL.
ether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit
a shared skb that is still in the ring. The next transmit overwrites
last_cb, so the earlier slots complete without crediting their bytes
and BQL stalls the queue until the watchdog resets it.
Unshare the skb before writing the control block.
Reproduce with pktgen in clone_skb mode, which hands the driver the same
skb while earlier copies are still in the ring:
modprobe pktgen
pg=/proc/net/pktgen
echo "add_device eth0" > $pg/kpktgend_0
echo "dst_mac AA:BB:CC:DD:EE:FF" > $pg/eth0
echo "dst 192.0.2.1" > $pg/eth0
echo "clone_skb 8" > $pg/eth0
echo "count 0" > $pg/eth0
echo start > $pg/pgctrl &
sleep 5
echo stop > $pg/pgctrl
wait
cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight
inflight stays nonzero on the now idle queue. clone_skb 0 leaves it at
zero.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f48bed16a756f5bc0244acd581f61968f7d7c2a4 Version: f48bed16a756f5bc0244acd581f61968f7d7c2a4 Version: f48bed16a756f5bc0244acd581f61968f7d7c2a4 Version: f48bed16a756f5bc0244acd581f61968f7d7c2a4 Version: f48bed16a756f5bc0244acd581f61968f7d7c2a4 Version: f48bed16a756f5bc0244acd581f61968f7d7c2a4 Version: fb4ca2b4bc6712a6ad635df5b9b41131846589f9 Version: 3.16.50 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c13d43c92bc89f494592a60e624a7c0c42218d36",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "e5aa07c62e4fda1206d314c9ea36d67cd6b95cad",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "2e5fb9dd3aca0da534793ad8123b81deff396efe",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "40c04abcbc34e3afe338f41dae851ecbd72852ac",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "7939ad3b4db9eadf45a64f0524f38337a9494672",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "89771ce4f8f67dcffae561b2ccac95c0f6e3aa01",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"status": "affected",
"version": "fb4ca2b4bc6712a6ad635df5b9b41131846589f9",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.50",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.50",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the driver the same\nskb while earlier copies are still in the ring:\n\n modprobe pktgen\n pg=/proc/net/pktgen\n echo \"add_device eth0\" \u003e $pg/kpktgend_0\n echo \"dst_mac AA:BB:CC:DD:EE:FF\" \u003e $pg/eth0\n echo \"dst 192.0.2.1\" \u003e $pg/eth0\n echo \"clone_skb 8\" \u003e $pg/eth0\n echo \"count 0\" \u003e $pg/eth0\n echo start \u003e $pg/pgctrl \u0026\n sleep 5\n echo stop \u003e $pg/pgctrl\n wait\n cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight\n\ninflight stays nonzero on the now idle queue. clone_skb 0 leaves it at\nzero."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:50.060Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c13d43c92bc89f494592a60e624a7c0c42218d36"
},
{
"url": "https://git.kernel.org/stable/c/e5aa07c62e4fda1206d314c9ea36d67cd6b95cad"
},
{
"url": "https://git.kernel.org/stable/c/2e5fb9dd3aca0da534793ad8123b81deff396efe"
},
{
"url": "https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac"
},
{
"url": "https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672"
},
{
"url": "https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01"
}
],
"title": "net: bcmgenet: unshare the skb before writing the control block",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99192",
"datePublished": "2026-10-28T10:35:48.686Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-30T12:42:50.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43172 (GCVE-0-2026-43172)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: fix 22000 series SMEM parsing
If the firmware were to report three LMACs (which doesn't
exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is
an overrun of the array. Reject such and use IWL_FW_CHECK
instead of WARN_ON in this function.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:15:17.444168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:16:22.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/fw/smem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5cc021586420c5e13acc65da5bf73edd451e2c3e",
"status": "affected",
"version": "ebfa7f8ae155c9a0bb2e4038d6b5d8b14881c424",
"versionType": "git"
},
{
"lessThan": "b23c7cd616a6a113363be707b7b9e4bc41b18a07",
"status": "affected",
"version": "ebfa7f8ae155c9a0bb2e4038d6b5d8b14881c424",
"versionType": "git"
},
{
"lessThan": "1d49a42717bdc8de77eabeb5b7d3e88d141ffea9",
"status": "affected",
"version": "ebfa7f8ae155c9a0bb2e4038d6b5d8b14881c424",
"versionType": "git"
},
{
"lessThan": "2b4b1510aaaf5b9fb57327ecffc20c055f61f205",
"status": "affected",
"version": "ebfa7f8ae155c9a0bb2e4038d6b5d8b14881c424",
"versionType": "git"
},
{
"lessThan": "58192b9ce09b0f0f86e2036683bd542130b91a98",
"status": "affected",
"version": "ebfa7f8ae155c9a0bb2e4038d6b5d8b14881c424",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/fw/smem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix 22000 series SMEM parsing\n\nIf the firmware were to report three LMACs (which doesn\u0027t\nexist in hardware) then using \"fwrt-\u003esmem_cfg.lmac[2]\" is\nan overrun of the array. Reject such and use IWL_FW_CHECK\ninstead of WARN_ON in this function."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is in the Wi-Fi device/firmware control path during iwlwifi start/restart when the host parses a firmware-supplied SHARED_MEM_CFG_CMD response, not a routed IP service. For the affected Wi-Fi subsystem, the highest reasonable external exposure is an adjacent wireless attacker able to drive malicious firmware/device behavior.\nAC:L - There is no race or complex state requirement once a malformed response is supplied. Setting lmac_num to 3 deterministically reaches the out-of-bounds write in the 22000-series parser.\nPR:N - The malformed firmware response is parsed by the kernel driver without OS credential checks and before any Wi-Fi peer authentication boundary matters. In the adjacent attacker model, no local account or kernel privilege is required.\nUI:N - The parser runs automatically during normal Wi-Fi device start or restart. Exploitation does not require a victim to open a file, mount anything, or perform a special action.\nS:U - The corruption affects host kernel iwlwifi driver state within the same kernel security authority. It does not inherently cross a VM, IOMMU, or separate authorization boundary.\nC:H - The bug is an attacker-controlled out-of-bounds write past fwrt-\u003esmem_cfg.lmac into adjacent iwl_fw_runtime state. Kernel memory corruption is reasonably leverageable for high confidentiality impact.\nI:H - Firmware-controlled 32-bit values are written beyond the two-element LMAC array into adjacent kernel driver fields. This is an out-of-bounds write with potential for arbitrary kernel state modification or control-flow influence.\nA:H - Even without full exploitation, corrupting adjacent iwlwifi runtime/debug/workqueue state can crash or destabilize the kernel. Kernel oops, panic, or persistent Wi-Fi driver failure constitutes high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:12.169Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5cc021586420c5e13acc65da5bf73edd451e2c3e"
},
{
"url": "https://git.kernel.org/stable/c/b23c7cd616a6a113363be707b7b9e4bc41b18a07"
},
{
"url": "https://git.kernel.org/stable/c/1d49a42717bdc8de77eabeb5b7d3e88d141ffea9"
},
{
"url": "https://git.kernel.org/stable/c/2b4b1510aaaf5b9fb57327ecffc20c055f61f205"
},
{
"url": "https://git.kernel.org/stable/c/58192b9ce09b0f0f86e2036683bd542130b91a98"
}
],
"title": "wifi: iwlwifi: fix 22000 series SMEM parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43172",
"datePublished": "2026-05-06T11:27:47.358Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-10-21T12:40:12.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90336 (GCVE-0-2026-90336)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: core: clear freed pointers on uart_register_driver() failure
uart_register_driver() leaves drv->state pointing to freed memory when
tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver
also retains a pointer after its reference is dropped.
Drivers that use drv->state as an "already registered" flag can then skip
registration on the next probe and pass the freed state to
uart_add_one_port().
This issue was found with failslab on QEMU's raspi1ap board by
failing registration and binding the PL011 port again.
Clear both pointers on their failure paths, as uart_unregister_driver()
already does.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/serial_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e260edd28eddc3b92c9f578df3026fd11c710cf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a9c0ffe5930c97b352f32febfc59a6e6ae6772ee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "802e2192a9d38027730c2869c67c9131b8c8fe9f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ddf51d74ee9f9857c99477329d80408cedebda61",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "06b376432974fe5f25f2843a8e8438c6a1cf3d50",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "61a2fb25551be0375bc16ef2a70c987dfca26183",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/serial_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: clear freed pointers on uart_register_driver() failure\n\nuart_register_driver() leaves drv-\u003estate pointing to freed memory when\ntty_alloc_driver() fails. If tty_register_driver() fails, drv-\u003etty_driver\nalso retains a pointer after its reference is dropped.\n\nDrivers that use drv-\u003estate as an \"already registered\" flag can then skip\nregistration on the next probe and pass the freed state to\nuart_add_one_port().\n\nThis issue was found with failslab on QEMU\u0027s raspi1ap board by\nfailing registration and binding the PL011 port again.\n\nClear both pointers on their failure paths, as uart_unregister_driver()\nalready does."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:14.252Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e260edd28eddc3b92c9f578df3026fd11c710cf"
},
{
"url": "https://git.kernel.org/stable/c/a9c0ffe5930c97b352f32febfc59a6e6ae6772ee"
},
{
"url": "https://git.kernel.org/stable/c/802e2192a9d38027730c2869c67c9131b8c8fe9f"
},
{
"url": "https://git.kernel.org/stable/c/ddf51d74ee9f9857c99477329d80408cedebda61"
},
{
"url": "https://git.kernel.org/stable/c/06b376432974fe5f25f2843a8e8438c6a1cf3d50"
},
{
"url": "https://git.kernel.org/stable/c/61a2fb25551be0375bc16ef2a70c987dfca26183"
}
],
"title": "serial: core: clear freed pointers on uart_register_driver() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90336",
"datePublished": "2026-09-17T16:08:49.016Z",
"dateReserved": "2026-09-11T19:38:34.803Z",
"dateUpdated": "2026-10-30T12:35:14.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38140 (GCVE-0-2025-38140)
Vulnerability from cvelistv5
Published
2025-07-03 08:35
Modified
2026-11-05 20:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm: limit swapping tables for devices with zone write plugs
dm_revalidate_zones() only allowed new or previously unzoned devices to
call blk_revalidate_disk_zones(). If the device was already zoned,
disk->nr_zones would always equal md->nr_zones, so dm_revalidate_zones()
returned without doing any work. This would make the zoned settings for
the device not match the new table. If the device had zone write plug
resources, it could run into errors like bdev_zone_is_seq() reading
invalid memory because disk->conv_zones_bitmap was the wrong size.
If the device doesn't have any zone write plug resources, calling
blk_revalidate_disk_zones() will always correctly update device. If
blk_revalidate_disk_zones() fails, it can still overwrite or clear the
current disk->nr_zones value. In this case, DM must restore the previous
value of disk->nr_zones, so that the zoned settings will continue to
match the previous value that it fell back to.
If the device already has zone write plug resources,
blk_revalidate_disk_zones() will not correctly update them, if it is
called for arbitrary zoned device changes. Since there is not much need
for this ability, the easiest solution is to disallow any table reloads
that change the zoned settings, for devices that already have zone plug
resources. Specifically, if a device already has zone plug resources
allocated, it can only switch to another zoned table that also emulates
zone append. Also, it cannot change the device size or the zone size. A
device can switch to an error target.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38140",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:50:23.283043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:52:17.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-table.c",
"drivers/md/dm-zone.c",
"drivers/md/dm.c",
"drivers/md/dm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13c0425c99c67c2296f1eec61254a4f91484eac3",
"status": "affected",
"version": "bb37d77239af25cde59693dbe3fac04dd17d7b29",
"versionType": "git"
},
{
"lessThan": "ac8acb0bfd98a1c65f3ca9a3e217a766124eebd8",
"status": "affected",
"version": "bb37d77239af25cde59693dbe3fac04dd17d7b29",
"versionType": "git"
},
{
"lessThan": "121218bef4c1df165181f5cd8fc3a2246bac817e",
"status": "affected",
"version": "bb37d77239af25cde59693dbe3fac04dd17d7b29",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-table.c",
"drivers/md/dm-zone.c",
"drivers/md/dm.c",
"drivers/md/dm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: limit swapping tables for devices with zone write plugs\n\ndm_revalidate_zones() only allowed new or previously unzoned devices to\ncall blk_revalidate_disk_zones(). If the device was already zoned,\ndisk-\u003enr_zones would always equal md-\u003enr_zones, so dm_revalidate_zones()\nreturned without doing any work. This would make the zoned settings for\nthe device not match the new table. If the device had zone write plug\nresources, it could run into errors like bdev_zone_is_seq() reading\ninvalid memory because disk-\u003econv_zones_bitmap was the wrong size.\n\nIf the device doesn\u0027t have any zone write plug resources, calling\nblk_revalidate_disk_zones() will always correctly update device. If\nblk_revalidate_disk_zones() fails, it can still overwrite or clear the\ncurrent disk-\u003enr_zones value. In this case, DM must restore the previous\nvalue of disk-\u003enr_zones, so that the zoned settings will continue to\nmatch the previous value that it fell back to.\n\nIf the device already has zone write plug resources,\nblk_revalidate_disk_zones() will not correctly update them, if it is\ncalled for arbitrary zoned device changes. Since there is not much need\nfor this ability, the easiest solution is to disallow any table reloads\nthat change the zoned settings, for devices that already have zone plug\nresources. Specifically, if a device already has zone plug resources\nallocated, it can only switch to another zoned table that also emulates\nzone append. Also, it cannot change the device size or the zone size. A\ndevice can switch to an error target."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:47.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13c0425c99c67c2296f1eec61254a4f91484eac3"
},
{
"url": "https://git.kernel.org/stable/c/ac8acb0bfd98a1c65f3ca9a3e217a766124eebd8"
},
{
"url": "https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e"
}
],
"title": "dm: limit swapping tables for devices with zone write plugs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38140",
"datePublished": "2025-07-03T08:35:41.929Z",
"dateReserved": "2025-04-16T04:51:23.987Z",
"dateUpdated": "2026-11-05T20:52:17.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90260 (GCVE-0-2026-90260)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: don't clobber the extent buffer when zeroing it out
On a zoned filesystem a freed-but-still-dirty tree block is written out
as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write
pointer advancing. btree_csum_one_bio() implemented this by memzeroing
the extent buffer's own folios before submission.
That destroys the in-memory buffer while it may still be referenced. In
particular btrfs_free_tree_block() can run on it afterwards and reads
the header to add a delayed reference; once the header has been zeroed
it frees bytenr 0 and corrupts the extent tree (the
btrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an
"unable to find ref" abort). It is flaky and reproduces under fsstress,
e.g. generic/461 and generic/013.
Write the zeros to disk from the shared zero page instead and leave the
extent buffer content untouched, so any later reference - including the
delayed reference from btrfs_free_tree_block() - still sees a valid
header. end_bbio_meta_write() now clears writeback on the buffer's own
folios, as the bio no longer carries them.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/disk-io.c",
"fs/btrfs/extent_io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "efa5084d08030aa557fdefa3e4a73b2501b7d207",
"status": "affected",
"version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
"versionType": "git"
},
{
"lessThan": "92484ad014f2e2b0e0e7bbc1610951e978cf557c",
"status": "affected",
"version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
"versionType": "git"
},
{
"lessThan": "98e3747587f9f87f010d8d7e55786216249a94af",
"status": "affected",
"version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
"versionType": "git"
},
{
"lessThan": "db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c",
"status": "affected",
"version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/disk-io.c",
"fs/btrfs/extent_io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: don\u0027t clobber the extent buffer when zeroing it out\n\nOn a zoned filesystem a freed-but-still-dirty tree block is written out\nas zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write\npointer advancing. btree_csum_one_bio() implemented this by memzeroing\nthe extent buffer\u0027s own folios before submission.\n\nThat destroys the in-memory buffer while it may still be referenced. In\nparticular btrfs_free_tree_block() can run on it afterwards and reads\nthe header to add a delayed reference; once the header has been zeroed\nit frees bytenr 0 and corrupts the extent tree (the\nbtrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an\n\"unable to find ref\" abort). It is flaky and reproduces under fsstress,\ne.g. generic/461 and generic/013.\n\nWrite the zeros to disk from the shared zero page instead and leave the\nextent buffer content untouched, so any later reference - including the\ndelayed reference from btrfs_free_tree_block() - still sees a valid\nheader. end_bbio_meta_write() now clears writeback on the buffer\u0027s own\nfolios, as the bio no longer carries them."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is local VFS syscalls on a mounted zoned btrfs: unlink \u2192 btrfs_unlink() \u2192 btrfs_del_items() \u2192 btrfs_clear_buffer_dirty() sets EXTENT_BUFFER_ZONED_ZEROOUT, then fsync \u2192 btrfs_sync_file() \u2192 btree_writepages() \u2192 write_one_eb() \u2192 btree_csum_one_bio(). No network protocol carries the data that causes the clobber.\nAC:L - The attacker drives both sides: unlink/write churn that sets ZONED_ZEROOUT in btrfs_clear_buffer_dirty() while leaving DIRTY set, and fsync or btrfs_btree_balance_dirty() running btree_writepages(). lock_extent_buffer_for_io() drops the tree lock before the memzero, and btrfs_del_leaf() unlocks before btrfs_free_tree_block() reads the header.\nPR:L - btrfs_unlink() and btrfs_sync_file() have no capability check; an unprivileged user with write access on the already-mounted zoned volume can COW-free tree blocks and kick metadata writeback (fsync or the btrfs_btree_balance_dirty() at the end of btrfs_unlink()).\nUI:N - The attacker performs the unlink/write/fsync sequence themselves on files they can write; this is a runtime COW/writeback race on a legitimate zoned btrfs (reproduced by fsstress generic/461 and generic/013), not a crafted image a victim must mount.\nS:U - The clobbered extent-buffer folios and the bad delayed refs stay inside this mount\u0027s btrfs metadata in the host kernel; there is no KVM/Xen guest-to-host, IOMMU, or sandbox boundary crossing.\nC:N - btree_csum_one_bio() calls memzero_extent_buffer(eb, 0, eb-\u003elen), which memset_extent_buffer() restricts to that buffer\u0027s own folios via check_eb_range(); the overwrite is zeros, not an out-of-bounds read or kernel-pointer leak.\nI:H - After the header is zeroed, btrfs_free_tree_block() queues a BTRFS_DROP_DELAYED_REF with owning_root=btrfs_header_owner(buf)==0 and level=btrfs_header_level(buf)==0, so __btrfs_free_extent() applies a mismatched backref to the shared extent tree and corrupts metadata for every file on the volume.\nA:H - The mismatched delayed ref hits abort_and_dump() \u2192 btrfs_abort_transaction(-EUCLEAN) \u2192 __btrfs_handle_fs_error() \u2192 btrfs_set_sb_rdonly(), forcing the whole filesystem read-only; with CONFIG_BTRFS_ASSERT, ASSERT(btrfs_header_bytenr(buf) != 0) in btrfs_free_tree_block() panics."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:42.251Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/efa5084d08030aa557fdefa3e4a73b2501b7d207"
},
{
"url": "https://git.kernel.org/stable/c/92484ad014f2e2b0e0e7bbc1610951e978cf557c"
},
{
"url": "https://git.kernel.org/stable/c/98e3747587f9f87f010d8d7e55786216249a94af"
},
{
"url": "https://git.kernel.org/stable/c/db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c"
}
],
"title": "btrfs: zoned: don\u0027t clobber the extent buffer when zeroing it out",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90260",
"datePublished": "2026-09-17T16:07:58.102Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-21T12:50:42.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98147 (GCVE-0-2026-98147)
Vulnerability from cvelistv5
Published
2026-09-25 10:36
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
printk: Don't WARN on kthread_run failure.
Since __kthread_create_on_node() returns -EINTR upon SIGKILL,
we should not use WARN_ON() in order to catch kthread_run() failure.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/printk/nbcon.c",
"kernel/printk/printk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15ba35d632c38d879d182577b0af487de0f2dec4",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "0af43b52fe4b1751b731c067127fdf47cf1b700c",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "4e676279798148382497d0e38c0bd51115e64be1",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/printk/nbcon.c",
"kernel/printk/printk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Don\u0027t WARN on kthread_run failure.\n\nSince __kthread_create_on_node() returns -EINTR upon SIGKILL,\nwe should not use WARN_ON() in order to catch kthread_run() failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:41.721Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15ba35d632c38d879d182577b0af487de0f2dec4"
},
{
"url": "https://git.kernel.org/stable/c/0af43b52fe4b1751b731c067127fdf47cf1b700c"
},
{
"url": "https://git.kernel.org/stable/c/4e676279798148382497d0e38c0bd51115e64be1"
},
{
"url": "https://git.kernel.org/stable/c/72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d"
}
],
"title": "printk: Don\u0027t WARN on kthread_run failure.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98147",
"datePublished": "2026-09-25T10:36:20.926Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-10-21T12:54:41.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89537 (GCVE-0-2026-89537)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags
byte at ptr[2], and padding at ptr[3..7], then passes
ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().
None of these accesses check read_token->len first.
The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus
ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers
accept shorter tokens from the wire:
- gss_unwrap_resp_integ() enforces only an upper bound
(offset + len <= rcv_buf->len) before allocating
mic.data = kmalloc(len) and passing it to gss_verify_mic().
A malicious NFS server can therefore supply a short checksum
opaque, producing a small slab allocation that the Kerberos MIC
verifier reads past.
- gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400)
before passing the wire-supplied length to
gss_validate_seqno_mic(), which constructs a mic xdr_netobj
and calls gss_verify_mic().
- svcauth_gss_verify_header() enforces only
checksum.len >= XDR_UNIT (4 bytes) before dispatching to
gss_verify_mic().
- svcauth_gss_unwrap_integ() checks only that the checksum fits
in gsd->gsd_scratch.
Add a length guard at the top of gss_krb5_verify_mic_v2(), before any
ptr[] access or scatterlist construction. Well-formed MIC tokens from
gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +
cksum_len bytes, so valid traffic is unaffected.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: de9c17eb4a912c9028f7b470eb80815144883b26 Version: de9c17eb4a912c9028f7b470eb80815144883b26 Version: de9c17eb4a912c9028f7b470eb80815144883b26 Version: de9c17eb4a912c9028f7b470eb80815144883b26 Version: de9c17eb4a912c9028f7b470eb80815144883b26 Version: de9c17eb4a912c9028f7b470eb80815144883b26 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:23:15.980324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:41.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/gss_krb5_unseal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86c3d527303ec79805098bda3dfc4fa994757f59",
"status": "affected",
"version": "de9c17eb4a912c9028f7b470eb80815144883b26",
"versionType": "git"
},
{
"lessThan": "b2e9e10f5a536befcdce64d3e6946dff42fb823e",
"status": "affected",
"version": "de9c17eb4a912c9028f7b470eb80815144883b26",
"versionType": "git"
},
{
"lessThan": "997577c52487181226775db3755079a3ba1d52b9",
"status": "affected",
"version": "de9c17eb4a912c9028f7b470eb80815144883b26",
"versionType": "git"
},
{
"lessThan": "996dd15f60121bdd7896b4554458f8806d608063",
"status": "affected",
"version": "de9c17eb4a912c9028f7b470eb80815144883b26",
"versionType": "git"
},
{
"lessThan": "7a946b2e7207f968902f2147ab9b30726f82f7ab",
"status": "affected",
"version": "de9c17eb4a912c9028f7b470eb80815144883b26",
"versionType": "git"
},
{
"lessThan": "b94f6719dcd9f7a609bc5f459f85795900e77d25",
"status": "affected",
"version": "de9c17eb4a912c9028f7b470eb80815144883b26",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/gss_krb5_unseal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at ptr[3..7], then passes\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().\nNone of these accesses check read_token-\u003elen first.\n\nThe minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus\nctx-\u003ekrb5e-\u003ecksum_len (12-24, depending on the enctype). All callers\naccept shorter tokens from the wire:\n\n - gss_unwrap_resp_integ() enforces only an upper bound\n (offset + len \u003c= rcv_buf-\u003elen) before allocating\n mic.data = kmalloc(len) and passing it to gss_verify_mic().\n A malicious NFS server can therefore supply a short checksum\n opaque, producing a small slab allocation that the Kerberos MIC\n verifier reads past.\n\n - gss_validate() enforces only len \u003c= RPC_MAX_AUTH_SIZE (400)\n before passing the wire-supplied length to\n gss_validate_seqno_mic(), which constructs a mic xdr_netobj\n and calls gss_verify_mic().\n\n - svcauth_gss_verify_header() enforces only\n checksum.len \u003e= XDR_UNIT (4 bytes) before dispatching to\n gss_verify_mic().\n\n - svcauth_gss_unwrap_integ() checks only that the checksum fits\n in gsd-\u003egsd_scratch.\n\nAdd a length guard at the top of gss_krb5_verify_mic_v2(), before any\nptr[] access or scatterlist construction. Well-formed MIC tokens from\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +\ncksum_len bytes, so valid traffic is unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - gss_krb5_verify_mic_v2() is reached from nfsd RPCSEC_GSS on TCP/2049 (svcauth_gss_accept \u2192 svcauth_gss_verify_header/unwrap_integ) and from the NFS client processing a remote server\u0027s RPCSEC_GSS verifier or krb5i checksum, so a remote peer triggers it with crafted SUNRPC traffic.\nAC:L - A single RPCSEC_GSS Call or Reply with a MIC/checksum shorter than GSS_KRB5_TOK_HDR_LEN plus cksum_len (callers accept as little as 4 bytes) deterministically over-reads; no race or attacker-uncontrollable layout is required. Kerberized NFS is a standard enterprise deployment.\nPR:N - svcauth_gss_verify_header() is the MIC check itself and runs before credentials are verified; the only gate is an rsc-cache lookup on a cleartext, monotonically increasing 64-bit GSS handle that an unauthenticated client can sniff or enumerate. A malicious NFS server needs no privileges on the client.\nUI:N - On nfsd the over-read is triggered solely by an inbound RPCSEC_GSS message; on the client it fires from the RPC receive path once an NFS/RPCSEC_GSS mount exists. No separate victim action is required at attack time.\nS:U - The slab over-read and any resulting oops stay inside the host kernel SUNRPC/GSS code. This is ordinary same-host kernel impact, not a VM escape, IOMMU bypass, or other changed-scope boundary.\nC:H - gss_unwrap_resp_integ() kmallocs only the attacker-chosen checksum length, then gss_krb5_verify_mic_v2() reads GSS_KRB5_TOK_HDR_LEN+cksum_len (28-40) bytes via gss_krb5_mic_build_sg()/sg_pcopy_to_buffer, an out-of-bounds read of adjacent slab well beyond a few bytes.\nI:N - The defect is a read-only over-read consumed as a MIC comparison; rfc3961_verify_mic copies those bytes into a local buffer and memcmp()s them. There is no out-of-bounds write, use-after-free, or control-flow hijack primitive.\nA:H - Reading 28-40 bytes past a small kmalloc object or past an RPC receive buffer near a page boundary can oops or panic on KASAN, redzone, or unmapped next-page kernels, and the attacker can repeat the crafted RPC to deny NFS service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:04.586Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86c3d527303ec79805098bda3dfc4fa994757f59"
},
{
"url": "https://git.kernel.org/stable/c/b2e9e10f5a536befcdce64d3e6946dff42fb823e"
},
{
"url": "https://git.kernel.org/stable/c/997577c52487181226775db3755079a3ba1d52b9"
},
{
"url": "https://git.kernel.org/stable/c/996dd15f60121bdd7896b4554458f8806d608063"
},
{
"url": "https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab"
},
{
"url": "https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25"
}
],
"title": "SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89537",
"datePublished": "2026-09-11T19:44:15.216Z",
"dateReserved": "2026-09-11T19:38:34.721Z",
"dateUpdated": "2026-10-30T12:32:04.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89833 (GCVE-0-2026-89833)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
There is potential deadloop in race condition:
Thread A Thread B
- fsync
- f2fs_do_sync_file
- f2fs_fsync_node_pages
- last_fsync_dnode
- folio_get(last_folio)
- f2fs_setattr
- f2fs_truncate
- f2fs_truncate_blocks
- f2fs_do_truncate_blocks
- f2fs_truncate_inode_blocks
- truncate_dnode
- truncate_node
- invalidate_mapping_pages
- folio->mapping = NULL
- is_node_folio alwasy return false
- atomic && !marked is always true,
then goto retry
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 608514deba38c8611ad330d6a3c8e2b9a1f68e4b Version: 608514deba38c8611ad330d6a3c8e2b9a1f68e4b Version: 608514deba38c8611ad330d6a3c8e2b9a1f68e4b Version: 608514deba38c8611ad330d6a3c8e2b9a1f68e4b Version: 608514deba38c8611ad330d6a3c8e2b9a1f68e4b Version: 608514deba38c8611ad330d6a3c8e2b9a1f68e4b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "64a47dc8286ff98d8c231ae035bdfe16be1b93bf",
"status": "affected",
"version": "608514deba38c8611ad330d6a3c8e2b9a1f68e4b",
"versionType": "git"
},
{
"lessThan": "58ca9f06480457eb9c9513e1ae2b75316d4ed1e5",
"status": "affected",
"version": "608514deba38c8611ad330d6a3c8e2b9a1f68e4b",
"versionType": "git"
},
{
"lessThan": "bdc06381d590ad5833ee7a2c56b8b685d80ee9b5",
"status": "affected",
"version": "608514deba38c8611ad330d6a3c8e2b9a1f68e4b",
"versionType": "git"
},
{
"lessThan": "161513f53e4ac90fd356433bdf8e31e6adeb92af",
"status": "affected",
"version": "608514deba38c8611ad330d6a3c8e2b9a1f68e4b",
"versionType": "git"
},
{
"lessThan": "905411f6504876d268ba8dafc8e75367782da4b7",
"status": "affected",
"version": "608514deba38c8611ad330d6a3c8e2b9a1f68e4b",
"versionType": "git"
},
{
"lessThan": "ce366bfa821ec81dd45bde547ee31e659306cc61",
"status": "affected",
"version": "608514deba38c8611ad330d6a3c8e2b9a1f68e4b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()\n\nThere is potential deadloop in race condition:\n\nThread A\t\t\t\tThread B\n- fsync\n - f2fs_do_sync_file\n - f2fs_fsync_node_pages\n - last_fsync_dnode\n - folio_get(last_folio)\n\t\t\t\t\t- f2fs_setattr\n\t\t\t\t\t - f2fs_truncate\n\t\t\t\t\t - f2fs_truncate_blocks\n\t\t\t\t\t - f2fs_do_truncate_blocks\n\t\t\t\t\t - f2fs_truncate_inode_blocks\n\t\t\t\t\t - truncate_dnode\n\t\t\t\t\t - truncate_node\n\t\t\t\t\t - invalidate_mapping_pages\n\t\t\t\t\t - folio-\u003emapping = NULL\n - is_node_folio alwasy return false\n - atomic \u0026\u0026 !marked is always true,\n then goto retry"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:12.025Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/64a47dc8286ff98d8c231ae035bdfe16be1b93bf"
},
{
"url": "https://git.kernel.org/stable/c/58ca9f06480457eb9c9513e1ae2b75316d4ed1e5"
},
{
"url": "https://git.kernel.org/stable/c/bdc06381d590ad5833ee7a2c56b8b685d80ee9b5"
},
{
"url": "https://git.kernel.org/stable/c/161513f53e4ac90fd356433bdf8e31e6adeb92af"
},
{
"url": "https://git.kernel.org/stable/c/905411f6504876d268ba8dafc8e75367782da4b7"
},
{
"url": "https://git.kernel.org/stable/c/ce366bfa821ec81dd45bde547ee31e659306cc61"
}
],
"title": "f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89833",
"datePublished": "2026-09-16T10:31:05.680Z",
"dateReserved": "2026-09-11T19:38:34.769Z",
"dateUpdated": "2026-10-30T12:33:12.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74317 (GCVE-0-2026-74317)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ixgbe: do not configure xps for XDP queues
netif_set_xps_queue() should not be called for an XDP Tx queue, since such
queues are not netdev-exposed. On systems with number of CPUs >=64, on E610
adapter, netdev is configured with maximum number queue pairs being 63
(due to MSI-X assignment), but configuring XDP results in 64 XDP queues.
So, during XDP program load, when netif_set_xps_queue() is called for the
last XDP queue, we get a WARNING with a call trace and KASAN report
afterwards (if enabled).
[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668
[...]
[ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40
[ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff <0f> 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84
[ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246
[ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000
[ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488
[ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000
[ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8
[ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8
[ 2012.700065] FS: 00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000
[ 2012.700069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0
[ 2012.700077] PKRU: 55555554
[ 2012.700080] Call Trace:
[ 2012.700084] <TASK>
[ 2012.700087] ? ktime_get+0x61/0x150
[ 2012.700097] ? usleep_range_state+0x133/0x1b0
[ 2012.700108] ? __pfx_usleep_range_state+0x10/0x10
[ 2012.700114] netif_set_xps_queue+0x31/0x50
[ 2012.700119] ixgbe_configure_tx_ring+0x472/0x920 [ixgbe]
[...]
[ 2012.700486] ixgbe_xdp+0x38f/0x750 [ixgbe]
[...]
[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40
[ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668
Skip XPS configuration for XDP Tx queues.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 33fdc82f08835de4c39a00657742f5b11db00d32 Version: 33fdc82f08835de4c39a00657742f5b11db00d32 Version: 33fdc82f08835de4c39a00657742f5b11db00d32 Version: 33fdc82f08835de4c39a00657742f5b11db00d32 Version: 33fdc82f08835de4c39a00657742f5b11db00d32 Version: 33fdc82f08835de4c39a00657742f5b11db00d32 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74317",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:53:18.226836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:32.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ixgbe/ixgbe_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b7bd53d91155eeb0961f26930f0c70b6538613f",
"status": "affected",
"version": "33fdc82f08835de4c39a00657742f5b11db00d32",
"versionType": "git"
},
{
"lessThan": "ec485257ccbc787bcde0271d6f649c9018ffb363",
"status": "affected",
"version": "33fdc82f08835de4c39a00657742f5b11db00d32",
"versionType": "git"
},
{
"lessThan": "706e811380909a709332136001fe31f37575ef53",
"status": "affected",
"version": "33fdc82f08835de4c39a00657742f5b11db00d32",
"versionType": "git"
},
{
"lessThan": "f488b83a38103e8eea442cd8fa1a10f982bd60af",
"status": "affected",
"version": "33fdc82f08835de4c39a00657742f5b11db00d32",
"versionType": "git"
},
{
"lessThan": "a2a224f5e344ccb1ec3693a0735822db9214e2ca",
"status": "affected",
"version": "33fdc82f08835de4c39a00657742f5b11db00d32",
"versionType": "git"
},
{
"lessThan": "7bd4355272de34c2e90e34b72c5613736d03c32b",
"status": "affected",
"version": "33fdc82f08835de4c39a00657742f5b11db00d32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ixgbe/ixgbe_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: do not configure xps for XDP queues\n\nnetif_set_xps_queue() should not be called for an XDP Tx queue, since such\nqueues are not netdev-exposed. On systems with number of CPUs \u003e=64, on E610\nadapter, netdev is configured with maximum number queue pairs being 63\n(due to MSI-X assignment), but configuring XDP results in 64 XDP queues.\n\nSo, during XDP program load, when netif_set_xps_queue() is called for the\nlast XDP queue, we get a WARNING with a call trace and KASAN report\nafterwards (if enabled).\n\n[ 2012.699800] WARNING: net/core/dev.c:2854 at __netif_set_xps_queue+0x116a/0x1e40, CPU#36: xdpsock/103668\n[...]\n[ 2012.700029] RIP: 0010:__netif_set_xps_queue+0x116a/0x1e40\n[ 2012.700035] Code: b6 34 06 48 89 f8 83 e0 07 83 c0 01 40 38 f0 7c 09 40 84 f6 0f 85 03 0a 00 00 0f b7 44 24 40 66 43 89 44 6a 18 e9 01 fb ff ff \u003c0f\u003e 0b e9 f2 ee ff ff 44 8b 44 24 44 45 85 c0 74 50 4d 85 e4 0f 84\n[ 2012.700040] RSP: 0018:ffff8882369aeb28 EFLAGS: 00010246\n[ 2012.700046] RAX: 0000000000000000 RBX: 000000000000003f RCX: 0000000000000000\n[ 2012.700050] RDX: 1ffff1111da3d891 RSI: ffff888120e34250 RDI: ffff8888ed1ec488\n[ 2012.700054] RBP: ffff888913281560 R08: 0000000000000000 R09: ffff8888ed1ec000\n[ 2012.700058] R10: ffff8888a2e83180 R11: 0000000000000000 R12: 0000000000007fa8\n[ 2012.700061] R13: 000000000000003f R14: ffff888120e34854 R15: ffff8889132817c8\n[ 2012.700065] FS: 00007fc8ea9ff740(0000) GS:ffff88884cefe000(0000) knlGS:0000000000000000\n[ 2012.700069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2012.700073] CR2: 00007f81c8000020 CR3: 00000002299f8006 CR4: 00000000007726f0\n[ 2012.700077] PKRU: 55555554\n[ 2012.700080] Call Trace:\n[ 2012.700084] \u003cTASK\u003e\n[ 2012.700087] ? ktime_get+0x61/0x150\n[ 2012.700097] ? usleep_range_state+0x133/0x1b0\n[ 2012.700108] ? __pfx_usleep_range_state+0x10/0x10\n[ 2012.700114] netif_set_xps_queue+0x31/0x50\n[ 2012.700119] ixgbe_configure_tx_ring+0x472/0x920 [ixgbe]\n[...]\n[ 2012.700486] ixgbe_xdp+0x38f/0x750 [ixgbe]\n\n[...]\n\n[ 2012.701094] BUG: KASAN: slab-out-of-bounds in __netif_set_xps_queue+0x1ac5/0x1e40\n[ 2012.701100] Write of size 4 at addr ffff88888d43cff8 by task xdpsock/103668\n\nSkip XPS configuration for XDP Tx queues."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local kernel interfaces (bpf syscall/RTNETLINK IFLA_XDP_FD or AF_XDP setup) that attach an XDP program to an ixgbe netdev, calling ixgbe_xdp_setup() -\u003e ixgbe_configure_tx_ring() -\u003e netif_set_xps_queue(); it is not triggered by remote network packets.\nAC:L - On ixgbe with 64+ CPUs, loading any XDP program deterministically configures all XDP Tx rings including queue_index 63 while netdev-\u003enum_tx_queues stays 63, reliably triggering the out-of-bounds write in __netif_set_xps_queue() without races or attacker-uncontrollable timing.\nPR:L - Reaching ixgbe_xdp()/ndo_bpf requires CAP_NET_ADMIN to load/attach BPF_PROG_TYPE_XDP via bpf() or rtnl_setlink; per kernel CNA guidance CAP_NET_ADMIN is scored as Low because it is obtainable by unprivileged users inside a user/network namespace (unshare -Urn).\nUI:N - Exploitation requires only the attacker to load an XDP program on the ixgbe interface; no victim user action such as opening files, clicking links, or mounting filesystems is needed.\nS:U - The out-of-bounds write corrupts kernel netdev/XPS metadata in the same kernel security domain as the attacker; it does not cross VM, container, or IOMMU boundaries to impact a separate authority.\nC:H - KASAN reports a slab out-of-bounds 4-byte write in __netif_set_xps_queue() via netdev_get_tx_queue(dev, index) when index equals num_tx_queues; kernel heap corruption can be leveraged for further memory disclosure even though the immediate fault is a write.\nI:H - The vulnerability is an out-of-bounds write past the netdev-\u003e_tx[] array (writing netdev_queue-\u003enuma_node), constituting kernel memory corruption that can potentially be developed into arbitrary write or control-flow hijack primitives.\nA:H - Triggering the bug emits a kernel WARNING and KASAN slab-out-of-bounds report during XDP program load; the corrupting write can panic/oops the system or destabilize the ixgbe driver on production kernels without KASAN."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:42.265Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b7bd53d91155eeb0961f26930f0c70b6538613f"
},
{
"url": "https://git.kernel.org/stable/c/ec485257ccbc787bcde0271d6f649c9018ffb363"
},
{
"url": "https://git.kernel.org/stable/c/706e811380909a709332136001fe31f37575ef53"
},
{
"url": "https://git.kernel.org/stable/c/f488b83a38103e8eea442cd8fa1a10f982bd60af"
},
{
"url": "https://git.kernel.org/stable/c/a2a224f5e344ccb1ec3693a0735822db9214e2ca"
},
{
"url": "https://git.kernel.org/stable/c/7bd4355272de34c2e90e34b72c5613736d03c32b"
}
],
"title": "ixgbe: do not configure xps for XDP queues",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74317",
"datePublished": "2026-08-15T05:58:14.832Z",
"dateReserved": "2026-08-15T05:44:03.884Z",
"dateUpdated": "2026-10-30T12:29:42.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68312 (GCVE-0-2026-68312)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and
cifs_close_deferred_file_under_dentry(), when a pending deferred close
is cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to
add the file to the local processing list may fail under memory pressure.
The loop breaks immediately, but the cancelled work is no longer pending
(it would have called _cifsFileInfo_put()), and the cfile is never added
to file_head for processing. The cifsFileInfo reference and the open
server handle both leak.
Fix by saving the cfile that failed allocation in a local variable,
breaking as before, and calling _cifsFileInfo_put() on it after
releasing the lock. Any files later in the iteration are unaffected
since their deferred work is still pending and will fire normally.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e3fc065682ebbbd15b0ce0036800f4acbf765d46 Version: e3fc065682ebbbd15b0ce0036800f4acbf765d46 Version: e3fc065682ebbbd15b0ce0036800f4acbf765d46 Version: e3fc065682ebbbd15b0ce0036800f4acbf765d46 Version: e3fc065682ebbbd15b0ce0036800f4acbf765d46 Version: e3fc065682ebbbd15b0ce0036800f4acbf765d46 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75143abc21f627da7ee3b0336814bd702692e830",
"status": "affected",
"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46",
"versionType": "git"
},
{
"lessThan": "c968b2417f6a15d35ff4b97d534af4a126cb510b",
"status": "affected",
"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46",
"versionType": "git"
},
{
"lessThan": "7af7ec3af091f55d01f0ebe0246d10e37f358311",
"status": "affected",
"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46",
"versionType": "git"
},
{
"lessThan": "6089f561e2c31a3ba52836c75c7d2ab50d2eea41",
"status": "affected",
"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46",
"versionType": "git"
},
{
"lessThan": "32390b3f06f26e366cfb27dbac4bc0196c321535",
"status": "affected",
"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46",
"versionType": "git"
},
{
"lessThan": "c2f2e83e3bbc5483730fd4ee903182761f1ae50f",
"status": "affected",
"version": "e3fc065682ebbbd15b0ce0036800f4acbf765d46",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths\n\nIn cifs_close_deferred_file(), cifs_close_all_deferred_files(), and\ncifs_close_deferred_file_under_dentry(), when a pending deferred close\nis cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to\nadd the file to the local processing list may fail under memory pressure.\nThe loop breaks immediately, but the cancelled work is no longer pending\n(it would have called _cifsFileInfo_put()), and the cfile is never added\nto file_head for processing. The cifsFileInfo reference and the open\nserver handle both leak.\n\nFix by saving the cfile that failed allocation in a local variable,\nbreaking as before, and calling _cifsFileInfo_put() on it after\nreleasing the lock. Any files later in the iteration are unaffected\nsince their deferred work is still pending and will fire normally."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:22.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75143abc21f627da7ee3b0336814bd702692e830"
},
{
"url": "https://git.kernel.org/stable/c/c968b2417f6a15d35ff4b97d534af4a126cb510b"
},
{
"url": "https://git.kernel.org/stable/c/7af7ec3af091f55d01f0ebe0246d10e37f358311"
},
{
"url": "https://git.kernel.org/stable/c/6089f561e2c31a3ba52836c75c7d2ab50d2eea41"
},
{
"url": "https://git.kernel.org/stable/c/32390b3f06f26e366cfb27dbac4bc0196c321535"
},
{
"url": "https://git.kernel.org/stable/c/c2f2e83e3bbc5483730fd4ee903182761f1ae50f"
}
],
"title": "cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68312",
"datePublished": "2026-08-10T12:02:46.907Z",
"dateReserved": "2026-07-30T09:28:09.381Z",
"dateUpdated": "2026-10-30T12:28:22.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97928 (GCVE-0-2026-97928)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: skip the VMID 0 flush for VRAM
Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches
via its direct MC address without programming a GART window, yet the wipe
still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA
flush can wedge the engine; only flush when a GART window is actually used.
v2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,
and drive the clear and copy paths from that. (Christian)
v3: Make the vm_needs_flush output parameter mandatory instead of
allowing NULL. (Christian)
(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6593494733ccaf691db7bd13801583d188409607",
"status": "affected",
"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13",
"versionType": "git"
},
{
"lessThan": "30dacb56f07283a1acb353ce81baef31f85396b0",
"status": "affected",
"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13",
"versionType": "git"
},
{
"lessThan": "241d7450cf75969cea450eb3e740cb9682f69c2f",
"status": "affected",
"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13",
"versionType": "git"
},
{
"lessThan": "87ceb8cba73d0b3c4025ff42495bccd8164acaed",
"status": "affected",
"version": "a68c7eaa7a8ffdec9287ba1561a668d674c20a13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: skip the VMID 0 flush for VRAM\n\nClear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches\nvia its direct MC address without programming a GART window, yet the wipe\nstill forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA\nflush can wedge the engine; only flush when a GART window is actually used.\n\nv2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,\n and drive the clear and copy paths from that. (Christian)\nv3: Make the vm_needs_flush output parameter mandatory instead of\n allowing NULL. (Christian)\n\n(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:39.969Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6593494733ccaf691db7bd13801583d188409607"
},
{
"url": "https://git.kernel.org/stable/c/30dacb56f07283a1acb353ce81baef31f85396b0"
},
{
"url": "https://git.kernel.org/stable/c/241d7450cf75969cea450eb3e740cb9682f69c2f"
},
{
"url": "https://git.kernel.org/stable/c/87ceb8cba73d0b3c4025ff42495bccd8164acaed"
}
],
"title": "drm/amdgpu: skip the VMID 0 flush for VRAM",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97928",
"datePublished": "2026-09-25T10:22:45.430Z",
"dateReserved": "2026-09-25T10:18:58.203Z",
"dateUpdated": "2026-10-21T12:53:39.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99147 (GCVE-0-2026-99147)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/exec: don't immediately add prelocked obj to array of locked objs
When a contention is detected the drm_exec object grabs a reference to
the contended object, unlocks all other objects and pre-locks the
contended one before anything else.
The problem is that it is possible that this pre-locked object was about
to be destroyed and drm_exec is now holding the last reference to it.
So we never actually see this pre-locked object again to be explicitly
locked and so also never reserve a slot for a dma_fence object on it.
Should the driver now use drm_exec_for_each_locked_object() to add a new
fence to all locked objects we eventually see a warning or even a
BUG_ON() to prevent random memory corruption.
Fix this by keeping the prelocked object out of the array of locked objs
until it was explicitly mentioned by the driver again.
If the prelocked object is never mentioned again by the driver
just unlock and drop the reference at the end of the locking loop.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_exec.c",
"include/drm/drm_exec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "74b4d2370a9e2b77247063dfa05f452766102676",
"status": "affected",
"version": "09593216bff15866f95c8ad406cb7fdcec1ee40a",
"versionType": "git"
},
{
"lessThan": "9dd91a22f076a4d19f14d82a5ab790c6bbaa073e",
"status": "affected",
"version": "09593216bff15866f95c8ad406cb7fdcec1ee40a",
"versionType": "git"
},
{
"lessThan": "96d9996e5dbcfabed052c0d9377a382c95fed607",
"status": "affected",
"version": "09593216bff15866f95c8ad406cb7fdcec1ee40a",
"versionType": "git"
},
{
"lessThan": "7a10cd79c4d9a90334fece32fef3a8e5b1a9727b",
"status": "affected",
"version": "09593216bff15866f95c8ad406cb7fdcec1ee40a",
"versionType": "git"
},
{
"lessThan": "26401a4999f1596a515b2e704e7066ac09306488",
"status": "affected",
"version": "09593216bff15866f95c8ad406cb7fdcec1ee40a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_exec.c",
"include/drm/drm_exec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exec: don\u0027t immediately add prelocked obj to array of locked objs\n\nWhen a contention is detected the drm_exec object grabs a reference to\nthe contended object, unlocks all other objects and pre-locks the\ncontended one before anything else.\n\nThe problem is that it is possible that this pre-locked object was about\nto be destroyed and drm_exec is now holding the last reference to it.\n\nSo we never actually see this pre-locked object again to be explicitly\nlocked and so also never reserve a slot for a dma_fence object on it.\n\nShould the driver now use drm_exec_for_each_locked_object() to add a new\nfence to all locked objects we eventually see a warning or even a\nBUG_ON() to prevent random memory corruption.\n\nFix this by keeping the prelocked object out of the array of locked objs\nuntil it was explicitly mentioned by the driver again.\n\nIf the prelocked object is never mentioned again by the driver\njust unlock and drop the reference at the end of the locking loop."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:16.086Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/74b4d2370a9e2b77247063dfa05f452766102676"
},
{
"url": "https://git.kernel.org/stable/c/9dd91a22f076a4d19f14d82a5ab790c6bbaa073e"
},
{
"url": "https://git.kernel.org/stable/c/96d9996e5dbcfabed052c0d9377a382c95fed607"
},
{
"url": "https://git.kernel.org/stable/c/7a10cd79c4d9a90334fece32fef3a8e5b1a9727b"
},
{
"url": "https://git.kernel.org/stable/c/26401a4999f1596a515b2e704e7066ac09306488"
}
],
"title": "drm/exec: don\u0027t immediately add prelocked obj to array of locked objs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99147",
"datePublished": "2026-10-28T10:35:03.580Z",
"dateReserved": "2026-09-25T10:25:14.396Z",
"dateUpdated": "2026-10-30T12:42:16.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38359 (GCVE-0-2025-38359)
Vulnerability from cvelistv5
Published
2025-07-25 12:47
Modified
2026-11-05 21:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Fix in_atomic() handling in do_secure_storage_access()
Kernel user spaces accesses to not exported pages in atomic context
incorrectly try to resolve the page fault.
With debug options enabled call traces like this can be seen:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0
CPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39
Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT
Tainted: [W]=WARN
Hardware name: IBM 3931 A01 703 (LPAR)
Call Trace:
[<00000383e990d282>] dump_stack_lvl+0xa2/0xe8
[<00000383e99bf152>] __might_resched+0x292/0x2d0
[<00000383eaa7c374>] down_read+0x34/0x2d0
[<00000383e99432f8>] do_secure_storage_access+0x108/0x360
[<00000383eaa724b0>] __do_pgm_check+0x130/0x220
[<00000383eaa842e4>] pgm_check_handler+0x114/0x160
[<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0
([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0)
[<00000383e9c45eae>] generic_perform_write+0x16e/0x310
[<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160
[<00000383e9da0de4>] vfs_write+0x1c4/0x460
[<00000383e9da123c>] ksys_write+0x7c/0x100
[<00000383eaa7284e>] __do_syscall+0x15e/0x280
[<00000383eaa8417e>] system_call+0x6e/0x90
INFO: lockdep is turned off.
It is not allowed to take the mmap_lock while in atomic context. Therefore
handle such a secure storage access fault as if the accessed page is not
mapped: the uaccess function will return -EFAULT, and the caller has to
deal with this. Usually this means that the access is retried in process
context, which allows to resolve the page fault (or in this case export the
page).
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38359",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:55:26.378396Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:02:35.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/mm/fault.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2990e937eaff741eda531f4190455ed7f3d5c348",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
},
{
"lessThan": "9bcfbd58fc5a02777fed3e582f22503ef3289a43",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
},
{
"lessThan": "7aee3e5163cade3f4cf1cc0710dfbadb47f1ba84",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
},
{
"lessThan": "d2e317dfd2d1fe416c77315d17c5d57dbe374915",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
},
{
"lessThan": "11709abccf93b08adde95ef313c300b0d4bc28f1",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/mm/fault.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.5",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Fix in_atomic() handling in do_secure_storage_access()\n\nKernel user spaces accesses to not exported pages in atomic context\nincorrectly try to resolve the page fault.\nWith debug options enabled call traces like this can be seen:\n\nBUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39\npreempt_count: 1, expected: 0\nRCU nest depth: 0, expected: 0\nINFO: lockdep is turned off.\nPreemption disabled at:\n[\u003c00000383ea47cfa2\u003e] copy_page_from_iter_atomic+0xa2/0x8a0\nCPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39\nTainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT\nTainted: [W]=WARN\nHardware name: IBM 3931 A01 703 (LPAR)\nCall Trace:\n [\u003c00000383e990d282\u003e] dump_stack_lvl+0xa2/0xe8\n [\u003c00000383e99bf152\u003e] __might_resched+0x292/0x2d0\n [\u003c00000383eaa7c374\u003e] down_read+0x34/0x2d0\n [\u003c00000383e99432f8\u003e] do_secure_storage_access+0x108/0x360\n [\u003c00000383eaa724b0\u003e] __do_pgm_check+0x130/0x220\n [\u003c00000383eaa842e4\u003e] pgm_check_handler+0x114/0x160\n [\u003c00000383ea47d028\u003e] copy_page_from_iter_atomic+0x128/0x8a0\n([\u003c00000383ea47d016\u003e] copy_page_from_iter_atomic+0x116/0x8a0)\n [\u003c00000383e9c45eae\u003e] generic_perform_write+0x16e/0x310\n [\u003c00000383e9eb87f4\u003e] ext4_buffered_write_iter+0x84/0x160\n [\u003c00000383e9da0de4\u003e] vfs_write+0x1c4/0x460\n [\u003c00000383e9da123c\u003e] ksys_write+0x7c/0x100\n [\u003c00000383eaa7284e\u003e] __do_syscall+0x15e/0x280\n [\u003c00000383eaa8417e\u003e] system_call+0x6e/0x90\nINFO: lockdep is turned off.\n\nIt is not allowed to take the mmap_lock while in atomic context. Therefore\nhandle such a secure storage access fault as if the accessed page is not\nmapped: the uaccess function will return -EFAULT, and the caller has to\ndeal with this. Usually this means that the access is retried in process\ncontext, which allows to resolve the page fault (or in this case export the\npage)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:55.522Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2990e937eaff741eda531f4190455ed7f3d5c348"
},
{
"url": "https://git.kernel.org/stable/c/9bcfbd58fc5a02777fed3e582f22503ef3289a43"
},
{
"url": "https://git.kernel.org/stable/c/7aee3e5163cade3f4cf1cc0710dfbadb47f1ba84"
},
{
"url": "https://git.kernel.org/stable/c/d2e317dfd2d1fe416c77315d17c5d57dbe374915"
},
{
"url": "https://git.kernel.org/stable/c/11709abccf93b08adde95ef313c300b0d4bc28f1"
}
],
"title": "s390/mm: Fix in_atomic() handling in do_secure_storage_access()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38359",
"datePublished": "2025-07-25T12:47:30.441Z",
"dateReserved": "2025-04-16T04:51:24.007Z",
"dateUpdated": "2026-11-05T21:02:35.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90422 (GCVE-0-2026-90422)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
When mtk_clk_register_pllfhs function fails to register a PLL, it
unregisters all PLLs and cleans up itself in its error path before
returning, so the function callers don't need to do it.
But contrary to mtk_clk_unregister_pllfhs function, that does almost
the same sequence, it does not free the IO memory mapped on fhctl node,
leading to a leak.
Fix this leak by factorizing the cleanup sequence in a new private
function and use it both mtk_clk_register_pllfhs and
mtk_clk_unregister_pllfhs functions.
Also, change the loop index start value to avoid the -1 operation on
index at each loop.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/mediatek/clk-pllfh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e3e93bc718c4fea556d7ca5fba07ab3511c9918",
"status": "affected",
"version": "d7964de8a8ea800910fdd4e365c42a9e7d5c54aa",
"versionType": "git"
},
{
"lessThan": "111235106099019b8a8d1947dc5c2674e0329ffa",
"status": "affected",
"version": "d7964de8a8ea800910fdd4e365c42a9e7d5c54aa",
"versionType": "git"
},
{
"lessThan": "d35e45e5bad4fabcf122126402b6c6dcb4379672",
"status": "affected",
"version": "d7964de8a8ea800910fdd4e365c42a9e7d5c54aa",
"versionType": "git"
},
{
"lessThan": "fea0b4fd891a2af77b55e05b950e7ea55b5d234e",
"status": "affected",
"version": "d7964de8a8ea800910fdd4e365c42a9e7d5c54aa",
"versionType": "git"
},
{
"lessThan": "540d91480bcb1b28a62d7023aa70947ea44c55b9",
"status": "affected",
"version": "d7964de8a8ea800910fdd4e365c42a9e7d5c54aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/mediatek/clk-pllfh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path\n\nWhen mtk_clk_register_pllfhs function fails to register a PLL, it\nunregisters all PLLs and cleans up itself in its error path before\nreturning, so the function callers don\u0027t need to do it.\n\nBut contrary to mtk_clk_unregister_pllfhs function, that does almost\nthe same sequence, it does not free the IO memory mapped on fhctl node,\nleading to a leak.\n\nFix this leak by factorizing the cleanup sequence in a new private\nfunction and use it both mtk_clk_register_pllfhs and\nmtk_clk_unregister_pllfhs functions.\n\nAlso, change the loop index start value to avoid the -1 operation on\nindex at each loop."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:35.803Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e3e93bc718c4fea556d7ca5fba07ab3511c9918"
},
{
"url": "https://git.kernel.org/stable/c/111235106099019b8a8d1947dc5c2674e0329ffa"
},
{
"url": "https://git.kernel.org/stable/c/d35e45e5bad4fabcf122126402b6c6dcb4379672"
},
{
"url": "https://git.kernel.org/stable/c/fea0b4fd891a2af77b55e05b950e7ea55b5d234e"
},
{
"url": "https://git.kernel.org/stable/c/540d91480bcb1b28a62d7023aa70947ea44c55b9"
}
],
"title": "clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90422",
"datePublished": "2026-09-17T16:09:45.830Z",
"dateReserved": "2026-09-11T19:38:34.814Z",
"dateUpdated": "2026-10-21T12:51:35.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99127 (GCVE-0-2026-99127)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
page_pool: keep frag_offset aligned for odd-sized requests
page_pool_alloc_frag_netmem() rounds the requested fragment size with
size = ALIGN(size, dma_get_cache_alignment());
dma_get_cache_alignment() returns 1 unless the architecture defines
ARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not.
There the ALIGN() is a no-op and pool->frag_offset advances by the raw,
unrounded size.
A single caller asking for an odd size then leaves frag_offset misaligned
for every fragment carved out of that page afterwards. The pool is shared,
so the damage is not confined to the caller that caused it.
The per-cpu system_page_pool used by generic XDP hits this.
skb_pp_cow_data() allocates its fragments with the raw packet length:
size = min_t(u32, len, PAGE_SIZE);
truesize = size;
page = page_pool_dev_alloc(pool, &page_off, &truesize);
leaving frag_offset odd for whatever is carved out of that page next. Its
own head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus the
XDP_PACKET_HEADROOM its callers pass -- so it is a later user of the shared
pool that pays: page_pool_dev_alloc_va() returns a misaligned buffer,
napi_build_skb() installs it as skb->head, and skb_shinfo(skb) ==
skb->head + skb->end is misaligned with it.
skb_shinfo()->dataref is a 4-byte atomic_t at offset 0x20, so the
atomic_inc() in __skb_clone() straddles a cache line. On x86 with split
lock detection -- fatal for kernel split locks by default -- this panics
the machine:
Oops: Split lock detected
RIP: 0010:skb_clone+0x154/0x1e0
Call Trace:
<IRQ>
raw_local_deliver+0x1ed/0x2c0
ip_protocol_deliver_rcu+0x54/0x1c0
ip_local_deliver_finish+0x85/0x100
ip_local_deliver+0x67/0x100
__netif_receive_skb_one_core+0x85/0xa0
process_backlog+0x87/0x130
Reproduced by attaching any generic-mode XDP program to loopback and
opening a RAW IPPROTO_UDP socket, which makes raw_local_deliver() clone
every locally delivered UDP packet; ordinary DNS traffic then triggers it,
roughly once per 2500 clones. Observed on 6.12.101 and 7.1.8.
Tracing page_pool_alloc_frag_netmem() over one such run shows the
amplification -- two odd-sized requests, nine misaligned offsets:
requested size & 7: 0: 17035 5: 1 7: 1
frag_offset & 7: 0: 17028 3: 1 4: 1 5: 1 6: 1 7: 5
and skb_pp_cow_data() returning heads that were aligned on entry:
head 0xffff8f4c86aeac00 -> 0xffff8f4c53a9a9c4 (&7=4)
head 0xffff8f4d6a8a42c0 -> 0xffff8f4c4f7b7a45 (&7=5)
Round the fragment size up to at least the alignment struct skb_shared_info
requires, so fragments are always suitably aligned for the objects callers
build on them. Architectures needing a larger DMA alignment keep it.
This also makes the remainder computed in page_pool_alloc_netmem(),
*size = max_size - *offset;
aligned, since max_size is a power of two -- which fixes the matching
misalignment of skb->end.
Verified with a controlled A/B under QEMU/KVM: same tree, same config,
same compiler, same rootfs and identical traffic, differing only by this
patch. A SEC("xdp.frags") XDP_PASS program on lo plus UDP datagrams
larger than max_head_size drives skb_pp_cow_data()'s fragment loop, which
passes raw packet lengths to the pool. Measured at the return of
skb_pp_cow_data():
unpatched patched
skb_pp_cow_data calls 40800 40800
misaligned skb->head 1120 0
dataref at line offset >60 80 0
The last row counts the accesses that actually fault:
skb_shinfo()->dataref sits at head+end+0x20 and is a 4-byte atomic, so
`lock incl` splits a 64-byte cache line only when that address lands at
offset 61..63. All 80 occurrences were at offset 61; the panic reported
above was at offset 62. Eliminating the misalignment removes every one
of them.
Same class of bug as commit 3bed3cc4156e ("net: Do not allocate page
fragments t
---truncated---
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 Version: 53e0961da1c7bbdabd1abebb20de403ec237ec09 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/page_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ab058f49e801803c4a755b09fe4a920d194da7f",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
},
{
"lessThan": "31e1a71995f23446c9d9e6ba170a6b16b110d243",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
},
{
"lessThan": "ccc28e498ef1c6eaaa16e61c6edb52c32a4f14bb",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
},
{
"lessThan": "22b67b0f59f5a7f4fa1e6043a1987e167c5d06d2",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
},
{
"lessThan": "813a72beaa5d3f4bb135e0def9b3f07a3511ca0e",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
},
{
"lessThan": "dca1b51693c81eaf77e50980be373e01ae857394",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
},
{
"lessThan": "dc0df5a0c62ccea1d0e08d39a4dc9064de81d411",
"status": "affected",
"version": "53e0961da1c7bbdabd1abebb20de403ec237ec09",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/page_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: keep frag_offset aligned for odd-sized requests\n\npage_pool_alloc_frag_netmem() rounds the requested fragment size with\n\n\tsize = ALIGN(size, dma_get_cache_alignment());\n\ndma_get_cache_alignment() returns 1 unless the architecture defines\nARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not.\nThere the ALIGN() is a no-op and pool-\u003efrag_offset advances by the raw,\nunrounded size.\n\nA single caller asking for an odd size then leaves frag_offset misaligned\nfor every fragment carved out of that page afterwards. The pool is shared,\nso the damage is not confined to the caller that caused it.\n\nThe per-cpu system_page_pool used by generic XDP hits this.\nskb_pp_cow_data() allocates its fragments with the raw packet length:\n\n\tsize = min_t(u32, len, PAGE_SIZE);\n\ttruesize = size;\n\tpage = page_pool_dev_alloc(pool, \u0026page_off, \u0026truesize);\n\nleaving frag_offset odd for whatever is carved out of that page next. Its\nown head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus the\nXDP_PACKET_HEADROOM its callers pass -- so it is a later user of the shared\npool that pays: page_pool_dev_alloc_va() returns a misaligned buffer,\nnapi_build_skb() installs it as skb-\u003ehead, and skb_shinfo(skb) ==\nskb-\u003ehead + skb-\u003eend is misaligned with it.\n\nskb_shinfo()-\u003edataref is a 4-byte atomic_t at offset 0x20, so the\natomic_inc() in __skb_clone() straddles a cache line. On x86 with split\nlock detection -- fatal for kernel split locks by default -- this panics\nthe machine:\n\n Oops: Split lock detected\n RIP: 0010:skb_clone+0x154/0x1e0\n Call Trace:\n \u003cIRQ\u003e\n raw_local_deliver+0x1ed/0x2c0\n ip_protocol_deliver_rcu+0x54/0x1c0\n ip_local_deliver_finish+0x85/0x100\n ip_local_deliver+0x67/0x100\n __netif_receive_skb_one_core+0x85/0xa0\n process_backlog+0x87/0x130\n\nReproduced by attaching any generic-mode XDP program to loopback and\nopening a RAW IPPROTO_UDP socket, which makes raw_local_deliver() clone\nevery locally delivered UDP packet; ordinary DNS traffic then triggers it,\nroughly once per 2500 clones. Observed on 6.12.101 and 7.1.8.\n\nTracing page_pool_alloc_frag_netmem() over one such run shows the\namplification -- two odd-sized requests, nine misaligned offsets:\n\n requested size \u0026 7: 0: 17035 5: 1 7: 1\n frag_offset \u0026 7: 0: 17028 3: 1 4: 1 5: 1 6: 1 7: 5\n\nand skb_pp_cow_data() returning heads that were aligned on entry:\n\n head 0xffff8f4c86aeac00 -\u003e 0xffff8f4c53a9a9c4 (\u00267=4)\n head 0xffff8f4d6a8a42c0 -\u003e 0xffff8f4c4f7b7a45 (\u00267=5)\n\nRound the fragment size up to at least the alignment struct skb_shared_info\nrequires, so fragments are always suitably aligned for the objects callers\nbuild on them. Architectures needing a larger DMA alignment keep it.\n\nThis also makes the remainder computed in page_pool_alloc_netmem(),\n\n\t*size = max_size - *offset;\n\naligned, since max_size is a power of two -- which fixes the matching\nmisalignment of skb-\u003eend.\n\nVerified with a controlled A/B under QEMU/KVM: same tree, same config,\nsame compiler, same rootfs and identical traffic, differing only by this\npatch. A SEC(\"xdp.frags\") XDP_PASS program on lo plus UDP datagrams\nlarger than max_head_size drives skb_pp_cow_data()\u0027s fragment loop, which\npasses raw packet lengths to the pool. Measured at the return of\nskb_pp_cow_data():\n\n unpatched patched\n skb_pp_cow_data calls 40800 40800\n misaligned skb-\u003ehead 1120 0\n dataref at line offset \u003e60 80 0\n\nThe last row counts the accesses that actually fault:\nskb_shinfo()-\u003edataref sits at head+end+0x20 and is a 4-byte atomic, so\n`lock incl` splits a 64-byte cache line only when that address lands at\noffset 61..63. All 80 occurrences were at offset 61; the panic reported\nabove was at offset 62. Eliminating the misalignment removes every one\nof them.\n\nSame class of bug as commit 3bed3cc4156e (\"net: Do not allocate page\nfragments t\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:01.046Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ab058f49e801803c4a755b09fe4a920d194da7f"
},
{
"url": "https://git.kernel.org/stable/c/31e1a71995f23446c9d9e6ba170a6b16b110d243"
},
{
"url": "https://git.kernel.org/stable/c/ccc28e498ef1c6eaaa16e61c6edb52c32a4f14bb"
},
{
"url": "https://git.kernel.org/stable/c/22b67b0f59f5a7f4fa1e6043a1987e167c5d06d2"
},
{
"url": "https://git.kernel.org/stable/c/813a72beaa5d3f4bb135e0def9b3f07a3511ca0e"
},
{
"url": "https://git.kernel.org/stable/c/dca1b51693c81eaf77e50980be373e01ae857394"
},
{
"url": "https://git.kernel.org/stable/c/dc0df5a0c62ccea1d0e08d39a4dc9064de81d411"
}
],
"title": "page_pool: keep frag_offset aligned for odd-sized requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99127",
"datePublished": "2026-10-28T10:34:41.448Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:01.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46330 (GCVE-0-2026-46330)
Vulnerability from cvelistv5
Published
2026-06-09 12:25
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "net/smc: Introduce TCP ULP support"
This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.
As reported by Al Viro, the TCP ULP support for SMC is fundamentally
broken. The implementation attempts to convert an active TCP socket
into an SMC socket by modifying the underlying `struct file`, dentry,
and inode in-place, which violates core VFS invariants that assume
these structures are immutable for an open file, creating a risk of
use after free errors and general system instability.
Given the severity of this design flaw and the fact that cleaner
alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application
transparency, the correct course of action is to remove this feature
entirely.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 Version: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 Version: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 Version: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 Version: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 Version: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:19.770547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:59.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7cb174a1edc80fe1f75b169a57726ed46704074",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
},
{
"lessThan": "74d33525db50d9d95156c79cc874752654e66e70",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
},
{
"lessThan": "dc824ffc28e5c9d0020b6bee2651b4aceed5b2bf",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
},
{
"lessThan": "dc24e03be0e4bb2aad1a9b272c4f86de3b11969a",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
},
{
"lessThan": "6c505d95c69e27dbf28fea29dc84d2498d69515c",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
},
{
"lessThan": "df31a6b0a3057e66994ad6ccf5d95b9b9514f033",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"net/smc: Introduce TCP ULP support\"\n\nThis reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\n\nAs reported by Al Viro, the TCP ULP support for SMC is fundamentally\nbroken. The implementation attempts to convert an active TCP socket\ninto an SMC socket by modifying the underlying `struct file`, dentry,\nand inode in-place, which violates core VFS invariants that assume\nthese structures are immutable for an open file, creating a risk of\nuse after free errors and general system instability.\n\nGiven the severity of this design flaw and the fact that cleaner\nalternatives (e.g., LD_PRELOAD, BPF) exist for legacy application\ntransparency, the correct course of action is to remove this feature\nentirely."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only via the local setsockopt(TCP_ULP, \"smc\") syscall on a TCP socket owned by the caller; smc_ulp_init() is not invoked from packet receive or any remote network path. The bug is triggered exclusively through the setsockopt(2) syscall on a TCP socket owned by the attacker; smc_ulp_init() is registered as a TCP ULP handler and is invoked from do_tcp_setsockopt() \u2192 tcp_set_ulp(), not from any network packet-receive or remote protocol path.\nAC:L - On systems with CONFIG_SMC enabled, an attacker fully controls socket creation, the pre-connect setsockopt call, and subsequent close/dup/fork races needed to trigger the corrupted VFS state and resulting UAF. An attacker fully controls socket creation, the setsockopt(TCP_ULP, \"smc\") call, and subsequent lifecycle operations (close, dup, connect); once preconditions are met the VFS corruption in smc_ulp_init() is deterministic and UAF/double-free can be provoked on demand without conditions outside attacker control.\nPR:L - Any unprivileged local user who can open a TCP socket may call setsockopt(TCP_ULP); module autoload uses CAP_NET_ADMIN which is obtainable in user namespaces, and no real-root capability is required when SMC is already loaded. No real-root capability is required\u2014any unprivileged local user who can create a SOCK_STREAM TCP socket and call setsockopt on it can reach smc_ulp_init(), including via user namespaces; TCP_ULP has no CAP_NET_ADMIN gate (unlike TCP congestion control), and module autoload is only needed if SMC is not already loaded.\nUI:N - Exploitation requires no action from another user or administrator; the attacker triggers the bug directly through their own socket file descriptor. Exploitation requires no action from a victim user; a local attacker can open a socket, invoke setsockopt(TCP_ULP, \"smc\"), and trigger the corrupted VFS state through normal close/dup operations in their own process.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary, not a cross-boundary escape such as guest-to-host or IOMMU bypass. Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-security-boundary escape.\nC:H - The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The fix commit and Al Viro\u0027s report explicitly identify use-after-free risk from in-place modification of struct file, dentry, and inode on an open file descriptor, which can yield arbitrary kernel memory read primitives through corrupted inode/file reference counting.\nI:H - UAF and broken VFS reference counting on live file descriptors enable heap grooming and arbitrary kernel write/control-flow hijacking, not merely a bounded or cosmetic corruption.\nA:H - The design flaw causes use-after-free, double-free, and general system instability during file close/__fput paths, readily producing kernel oops/panic and complete denial of service on affected IBM Z/RoCE systems running SMC."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:18.431Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7cb174a1edc80fe1f75b169a57726ed46704074"
},
{
"url": "https://git.kernel.org/stable/c/74d33525db50d9d95156c79cc874752654e66e70"
},
{
"url": "https://git.kernel.org/stable/c/dc824ffc28e5c9d0020b6bee2651b4aceed5b2bf"
},
{
"url": "https://git.kernel.org/stable/c/dc24e03be0e4bb2aad1a9b272c4f86de3b11969a"
},
{
"url": "https://git.kernel.org/stable/c/6c505d95c69e27dbf28fea29dc84d2498d69515c"
},
{
"url": "https://git.kernel.org/stable/c/df31a6b0a3057e66994ad6ccf5d95b9b9514f033"
}
],
"title": "Revert \"net/smc: Introduce TCP ULP support\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46330",
"datePublished": "2026-06-09T12:25:59.413Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-10-30T12:26:18.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72367 (GCVE-0-2026-72367)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iomap: guard io_size EOF trim against concurrent truncate underflow
iomap: fix zero padding data issue in concurrent append writes
changed ioend accounting so that io_size tracks only valid data
within EOF. This trims io_size when a writeback range extends
past end_pos:
ioend->io_size += map_len;
if (ioend->io_offset + ioend->io_size > end_pos)
ioend->io_size = end_pos - ioend->io_offset;
However, if end_pos ends up below ioend->io_offset, the subtraction
becomes negative and is stored in size_t io_size, causing an unsigned
wrap to a huge value. This can happen when writeback continues past
byte-level EOF up to a block-aligned range, or when a concurrent
truncate shrinks the file after end_pos was sampled in
iomap_writeback_handle_eof().
A wrapped io_size can mislead append detection and corrupt
completion-time size handling, since filesystem end_io paths consume
io_size for decisions such as on-disk EOF updates and unwritten/COW
completion ranges.
Fix this by clamping io_size to zero when EOF has moved to or before
the ioend start offset. This preserves the original intent of trimming
io_size to valid in-EOF data while avoiding the underflow.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/iomap/ioend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc1d6af0bee27d6595908b497424f338161299fc",
"status": "affected",
"version": "82c59a86a247a8970d353d10f52a37e5564fb137",
"versionType": "git"
},
{
"lessThan": "1f38f65bf965fce9aa159d45c5347538f56c5973",
"status": "affected",
"version": "51d20d1dacbec589d459e11fc88fbca419f84a99",
"versionType": "git"
},
{
"lessThan": "7f7780abb4c0fdc9a2603aea8e985ff14ee900e0",
"status": "affected",
"version": "51d20d1dacbec589d459e11fc88fbca419f84a99",
"versionType": "git"
},
{
"lessThan": "55ec50d046c03b3724741957f7b007856e36dbe7",
"status": "affected",
"version": "51d20d1dacbec589d459e11fc88fbca419f84a99",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/iomap/ioend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: guard io_size EOF trim against concurrent truncate underflow\n\niomap: fix zero padding data issue in concurrent append writes\nchanged ioend accounting so that io_size tracks only valid data\nwithin EOF. This trims io_size when a writeback range extends\npast end_pos:\n\n ioend-\u003eio_size += map_len;\n if (ioend-\u003eio_offset + ioend-\u003eio_size \u003e end_pos)\n ioend-\u003eio_size = end_pos - ioend-\u003eio_offset;\n\nHowever, if end_pos ends up below ioend-\u003eio_offset, the subtraction\nbecomes negative and is stored in size_t io_size, causing an unsigned\nwrap to a huge value. This can happen when writeback continues past\nbyte-level EOF up to a block-aligned range, or when a concurrent\ntruncate shrinks the file after end_pos was sampled in\niomap_writeback_handle_eof().\n\nA wrapped io_size can mislead append detection and corrupt\ncompletion-time size handling, since filesystem end_io paths consume\nio_size for decisions such as on-disk EOF updates and unwritten/COW\ncompletion ranges.\n\nFix this by clamping io_size to zero when EOF has moved to or before\nthe ioend start offset. This preserves the original intent of trimming\nio_size to valid in-EOF data while avoiding the underflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On XFS/GFS2/NTFS backends exposed via nfsd or ksmbd, a remote client can trigger iomap buffered writeback by issuing concurrent WRITE and truncate/SETATTR operations over the network without local shell access.\nAC:L - The attacker controls both sides of the race by concurrently writing dirty pages and truncating the same file (local threads or parallel NFS/SMB requests); no uncontrollable memory layout or rare kernel configuration is required.\nPR:L - Exploitation requires write and truncate permission on the target file (authenticated NFS/SMB client or local unprivileged user with file write access); this is not a pre-authentication network code path.\nUI:N - No victim interaction is needed beyond the attacker\u0027s own write and truncate I/O; writeback is driven automatically by the VFS/page-cache path once pages are dirtied.\nS:U - Impact is confined to kernel/filesystem integrity within the same security authority (metadata corruption, incorrect extent completion, possible local privilege escalation), not a VM escape or cross-authority boundary.\nC:H - A wrapped io_size propagates into XFS completion paths (COW convert/end, unwritten conversion, append detection), potentially remapping or exposing unintended on-disk extents and data beyond the legitimate EOF-trimmed range.\nI:H - Huge bogus io_size drives xfs_reflink_convert_cow, xfs_reflink_end_cow, xfs_iomap_write_unwritten, and xfs_setfilesize with corrupted ranges, enabling incorrect on-disk metadata updates and file content modification.\nA:H - Corrupted ioend accounting can trigger pathological XFS extent walks, ASSERT failures, filesystem shutdown, or hung writeback during I/O completion, causing kernel oops or sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:42.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc1d6af0bee27d6595908b497424f338161299fc"
},
{
"url": "https://git.kernel.org/stable/c/1f38f65bf965fce9aa159d45c5347538f56c5973"
},
{
"url": "https://git.kernel.org/stable/c/7f7780abb4c0fdc9a2603aea8e985ff14ee900e0"
},
{
"url": "https://git.kernel.org/stable/c/55ec50d046c03b3724741957f7b007856e36dbe7"
}
],
"title": "iomap: guard io_size EOF trim against concurrent truncate underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72367",
"datePublished": "2026-08-15T05:56:04.669Z",
"dateReserved": "2026-08-09T03:40:39.922Z",
"dateUpdated": "2026-10-21T12:44:42.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43272 (GCVE-0-2026-43272)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix possible dereference of uninitialized pointer
There is a pointer head_page in rb_meta_validate_events() which is not
initialized at the beginning of a function. This pointer can be dereferenced
if there is a failure during reader page validation. In this case the control
is passed to "invalid" label where the pointer is dereferenced in a loop.
To fix the issue initialize orig_head and head_page before calling
rb_validate_buffer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a4afdff9c715af50cf6c3f2dc601932c2cea17a2",
"status": "affected",
"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55",
"versionType": "git"
},
{
"lessThan": "bc77986f3cb7476637052edf2d87137fa39f153d",
"status": "affected",
"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55",
"versionType": "git"
},
{
"lessThan": "d9942396845fef2369478c157b26738fe07142f6",
"status": "affected",
"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55",
"versionType": "git"
},
{
"lessThan": "f1547779402c4cd67755c33616b7203baa88420b",
"status": "affected",
"version": "5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix possible dereference of uninitialized pointer\n\nThere is a pointer head_page in rb_meta_validate_events() which is not\ninitialized at the beginning of a function. This pointer can be dereferenced\nif there is a failure during reader page validation. In this case the control\nis passed to \"invalid\" label where the pointer is dereferenced in a loop.\n\nTo fix the issue initialize orig_head and head_page before calling\nrb_validate_buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:28.662Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a4afdff9c715af50cf6c3f2dc601932c2cea17a2"
},
{
"url": "https://git.kernel.org/stable/c/bc77986f3cb7476637052edf2d87137fa39f153d"
},
{
"url": "https://git.kernel.org/stable/c/d9942396845fef2369478c157b26738fe07142f6"
},
{
"url": "https://git.kernel.org/stable/c/f1547779402c4cd67755c33616b7203baa88420b"
}
],
"title": "ring-buffer: Fix possible dereference of uninitialized pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43272",
"datePublished": "2026-05-06T11:28:56.162Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-10-21T12:40:28.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-37906 (GCVE-0-2025-37906)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but
we may have scheduled task work via io_uring_cmd_complete_in_task() for
dispatching request, then kernel crash can be triggered.
Fix it by not trying to canceling the command if ublk block request is
started.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/ublk_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "346b7d74c612234dae0878892682b9722e7c04c8",
"status": "affected",
"version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
"versionType": "git"
},
{
"lessThan": "fb2eb9ddf556f93fef45201e1f9d2b8674bcc975",
"status": "affected",
"version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
"versionType": "git"
},
{
"lessThan": "f40139fde5278d81af3227444fd6e76a76b9506d",
"status": "affected",
"version": "216c8f5ef0f209a3797292c487bdaa6991ab4b92",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/ublk_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd\n\nublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but\nwe may have scheduled task work via io_uring_cmd_complete_in_task() for\ndispatching request, then kernel crash can be triggered.\n\nFix it by not trying to canceling the command if ublk block request is\nstarted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The race is reached only through local interfaces \u2014 `/dev/ublk-control` and `/dev/ublkc*` io_uring passthrough commands plus block I/O to `/dev/ublkb*`. There is no remote or adjacent-network path into ublk_drv.\nAC:L - The attacker owns both sides of the race: one thread submits I/O to the ublk block device (queueing `ublk_cmd_tw_cb` task work) while another tears down the io_uring ring or issues `UBLK_CMD_STOP_DEV`, driving `ublk_cancel_cmd()`. The window can be hit repeatedly in a loop with high queue depth until it lands.\nPR:L - ublk explicitly supports `UBLK_F_UNPRIVILEGED_DEV`, where `ublk_ctrl_add_dev()` accepts non-`CAP_SYS_ADMIN` callers and all later control commands gate only on file permissions of `/dev/ublkc*`, so an ordinary local user (including inside a container) can create and drive the device. Only basic local-user access is needed, not real root.\nUI:N - The attacking process performs every step itself \u2014 creating the ublk device, issuing I/O, and triggering cancellation. No victim action or interaction is required.\nS:U - The corruption is confined to kernel heap objects (`io_kiocb`) within the same security authority; the ublk driver and io_uring both run in the kernel\u0027s own scope. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed io_uring request is dereferenced and re-completed, so an attacker who reclaims the slab object controls its contents and can have kernel data posted back through the CQE and the ublk io path. Per UAF guidance this constitutes a path to arbitrary kernel memory disclosure.\nI:H - The second `io_uring_cmd_done()` writes result fields into and relinks a freed `io_kiocb`, and the request is freed twice \u2014 a write-after-free plus double-free on a well-known io_uring slab that is a standard heap-spray target for control-flow hijack. This is high-integrity memory corruption, not a bounded write.\nA:H - The commit states plainly that \"kernel crash can be triggered,\" and the double completion corrupts io_uring\u0027s completion/task-work lists. Any unprivileged local user with a ublk device can panic the machine on demand."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:34.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/346b7d74c612234dae0878892682b9722e7c04c8"
},
{
"url": "https://git.kernel.org/stable/c/fb2eb9ddf556f93fef45201e1f9d2b8674bcc975"
},
{
"url": "https://git.kernel.org/stable/c/f40139fde5278d81af3227444fd6e76a76b9506d"
}
],
"title": "ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-37906",
"datePublished": "2025-05-20T15:21:39.633Z",
"dateReserved": "2025-04-16T04:51:23.966Z",
"dateUpdated": "2026-10-21T12:36:34.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72375 (GCVE-0-2026-72375)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix reinitialisation of the inode, in particular ->lock_work
It seems that initalising afs_vnode::lock_work a single time in the slab's
init function isn't sufficient for work_structs. This results in the
DEBUG_OBJECTS debugging stuff producing a warning occasionally when running
the generic/131 xfstest:
ODEBUG: activate not available (active state 0) object: 0000000016d8760f object type: work_struct hint: afs_lock_work+0x0/0x220
WARNING: lib/debugobjects.c:629 at debug_print_object+0x4b/0x90, CPU#3: locktest/7695
...
CPU: 3 UID: 0 PID: 7695 Comm: locktest Tainted: G S 7.1.0-build3+ #2771 PREEMPT
...
RIP: 0010:debug_print_object+0x65/0x90
...
Call Trace:
<TASK>
? __pfx_afs_lock_work+0x10/0x10
debug_object_activate+0x122/0x170
insert_work+0x25/0x60
__queue_work+0x2e0/0x340
queue_delayed_work_on+0x48/0x70
afs_fl_release_private+0x57/0x70
locks_release_private+0x5c/0xa0
locks_free_lock+0xe/0x20
posix_lock_inode+0x55f/0x5b0
locks_lock_inode_wait+0x81/0x140
? file_write_and_wait_range+0x50/0x70
afs_lock+0xcd/0x110
fcntl_setlk+0x10d/0x260
do_fcntl+0x24e/0x5b0
__do_sys_fcntl+0x6a/0x90
do_syscall_64+0x11e/0x310
entry_SYSCALL_64_after_hwframe+0x71/0x79
Fix this by reinitialising ->lock_work after allocating an inode.
Also, flush ->lock_work when the inode is being evicted to make sure it's
not still running.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e8d6c554126b830217c5e9f549e0e21f865a0a8a Version: e8d6c554126b830217c5e9f549e0e21f865a0a8a Version: e8d6c554126b830217c5e9f549e0e21f865a0a8a Version: e8d6c554126b830217c5e9f549e0e21f865a0a8a Version: e8d6c554126b830217c5e9f549e0e21f865a0a8a Version: e8d6c554126b830217c5e9f549e0e21f865a0a8a |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:48:13.426490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:20.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/afs/inode.c",
"fs/afs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1471eef04c074029e2512a36e4d37d8547ff9762",
"status": "affected",
"version": "e8d6c554126b830217c5e9f549e0e21f865a0a8a",
"versionType": "git"
},
{
"lessThan": "2e7888bb635d9bc84359491347b236cc232ca4df",
"status": "affected",
"version": "e8d6c554126b830217c5e9f549e0e21f865a0a8a",
"versionType": "git"
},
{
"lessThan": "34dff35154e2fb3987ec5e0b40def14c64eadeb1",
"status": "affected",
"version": "e8d6c554126b830217c5e9f549e0e21f865a0a8a",
"versionType": "git"
},
{
"lessThan": "63d3f283858fae097fb09ddd4ce46bb0bc1f9d01",
"status": "affected",
"version": "e8d6c554126b830217c5e9f549e0e21f865a0a8a",
"versionType": "git"
},
{
"lessThan": "ebfd13c0367adb43d7c0a72f5cd7e004e60c6b28",
"status": "affected",
"version": "e8d6c554126b830217c5e9f549e0e21f865a0a8a",
"versionType": "git"
},
{
"lessThan": "5597fbd1e7c161914f20315a726e54025b0fdadb",
"status": "affected",
"version": "e8d6c554126b830217c5e9f549e0e21f865a0a8a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/afs/inode.c",
"fs/afs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix reinitialisation of the inode, in particular -\u003elock_work\n\nIt seems that initalising afs_vnode::lock_work a single time in the slab\u0027s\ninit function isn\u0027t sufficient for work_structs. This results in the\nDEBUG_OBJECTS debugging stuff producing a warning occasionally when running\nthe generic/131 xfstest:\n\n ODEBUG: activate not available (active state 0) object: 0000000016d8760f object type: work_struct hint: afs_lock_work+0x0/0x220\n WARNING: lib/debugobjects.c:629 at debug_print_object+0x4b/0x90, CPU#3: locktest/7695\n ...\n CPU: 3 UID: 0 PID: 7695 Comm: locktest Tainted: G S 7.1.0-build3+ #2771 PREEMPT\n ...\n RIP: 0010:debug_print_object+0x65/0x90\n ...\n Call Trace:\n \u003cTASK\u003e\n ? __pfx_afs_lock_work+0x10/0x10\n debug_object_activate+0x122/0x170\n insert_work+0x25/0x60\n __queue_work+0x2e0/0x340\n queue_delayed_work_on+0x48/0x70\n afs_fl_release_private+0x57/0x70\n locks_release_private+0x5c/0xa0\n locks_free_lock+0xe/0x20\n posix_lock_inode+0x55f/0x5b0\n locks_lock_inode_wait+0x81/0x140\n ? file_write_and_wait_range+0x50/0x70\n afs_lock+0xcd/0x110\n fcntl_setlk+0x10d/0x260\n do_fcntl+0x24e/0x5b0\n __do_sys_fcntl+0x6a/0x90\n do_syscall_64+0x11e/0x310\n entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nFix this by reinitialising -\u003elock_work after allocating an inode.\n\nAlso, flush -\u003elock_work when the inode is being evicted to make sure it\u0027s\nnot still running."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via the local VFS file-locking path (fcntl/F_SETLK/F_SETLKW \u2192 afs_lock \u2192 afs_fl_release_private \u2192 queue_delayed_work on vnode-\u003elock_work), not from inbound AFS/RxRPC network packet handling.\nAC:L - An attacker can reliably drive the fault by cycling POSIX locks and inode eviction/reuse on AFS files they control; both sides of the workqueue/slab race are attacker-influenced and freely retryable, matching the intermittent generic/131 locktest reproducer.\nPR:L - On the highest-impact deployment (enterprise/university hosts with AFS already mounted), any unprivileged local user who can open files on that mount can trigger fcntl locking without real root or CAP_SYS_ADMIN in the init namespace.\nUI:N - Exploitation requires no action by another user; the attacker directly issues fcntl lock/unlock operations on file descriptors they hold on the shared AFS mount.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Stale lock_work reuse and eviction without flush_delayed_work() can leave afs_lock_work operating on freed/reallocated afs_vnode slab memory, a classic use-after-free that can disclose or corrupt adjacent kernel heap contents.\nI:H - Corrupting or re-queuing a stale delayed_work can corrupt workqueue lists and attacker-controlled vnode fields, providing primitives consistent with arbitrary kernel write and control-flow hijack, not merely a benign warning.\nA:H - Invalid work_struct state triggers kernel warnings/oops in testing and can panic the system when deferred lock work runs against an evicted inode or poisoned slab object during normal lock release."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:10.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1471eef04c074029e2512a36e4d37d8547ff9762"
},
{
"url": "https://git.kernel.org/stable/c/2e7888bb635d9bc84359491347b236cc232ca4df"
},
{
"url": "https://git.kernel.org/stable/c/34dff35154e2fb3987ec5e0b40def14c64eadeb1"
},
{
"url": "https://git.kernel.org/stable/c/63d3f283858fae097fb09ddd4ce46bb0bc1f9d01"
},
{
"url": "https://git.kernel.org/stable/c/ebfd13c0367adb43d7c0a72f5cd7e004e60c6b28"
},
{
"url": "https://git.kernel.org/stable/c/5597fbd1e7c161914f20315a726e54025b0fdadb"
}
],
"title": "afs: Fix reinitialisation of the inode, in particular -\u003elock_work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72375",
"datePublished": "2026-08-15T05:56:09.790Z",
"dateReserved": "2026-08-09T03:40:39.922Z",
"dateUpdated": "2026-10-30T12:29:10.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39933 (GCVE-0-2025-39933)
Vulnerability from cvelistv5
Published
2025-10-04 07:30
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: let recv_done verify data_offset, data_length and remaining_data_length
This is inspired by the related server fixes.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T20:40:59.041091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T18:44:07.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fdc23a47be015fba915c4f9dfd43c65ad4829a35",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "241e58de23e7c1bbb9bee526c17d9a0f2a90fbad",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "581fb78e0388b78911b0c920e4073737090c8b5f",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "f57e53ea252363234f86674db475839e5b87102e",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: let recv_done verify data_offset, data_length and remaining_data_length\n\nThis is inspired by the related server fixes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code parses `smbdirect_data_transfer` headers received directly from a remote SMB server over RDMA, and iWARP/RoCEv2 are routable over ordinary IP networks (soft-iWARP/soft-RoCE need no special hardware). A malicious, compromised, or spoofed SMB Direct peer reaches `recv_done()` purely over the network.\nAC:L - The attacker writes `data_offset`/`data_length` as plain header fields in a single crafted data-transfer message; there is no race, no memory-layout precondition, and the out-of-bounds read is deterministic and repeatable at an offset of the attacker\u0027s choosing.\nPR:N - `recv_done()` switches to `SMBDIRECT_EXPECT_DATA_TRANSFER` as soon as the unauthenticated transport-level SMBD negotiate completes, so the malformed packet is processed before SMB2 NEGOTIATE/SESSION_SETUP and before any signing or encryption is established \u2014 the peer needs no credentials on the client.\nUI:N - Once an SMB Direct mount exists (including automounts, fstab, DFS referrals, and automatic reconnects), a hostile or compromised server can send the crafted frame at any time and the client processes it automatically in its receive-completion and demultiplex paths. No administrator or user action is required at the moment of attack.\nS:U - The out-of-bounds access, the disclosed data, and the resulting fault are all confined to the client kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unvalidated 32-bit `data_offset` makes `copy_to_iter()` read from an attacker-chosen address up to 4 GiB past a ~2 KB receive-buffer slab object, and the inflated `data_length` keeps that buffer at the queue head so `offset` advances on each call \u2014 allowing a remote peer to stream out large amounts of kernel memory, which is then delivered to userspace as SMB response/file content.\nI:L - There is no out-of-bounds write, but the client assembles and parses SMB2 responses built from out-of-bounds kernel memory, so connection state, file metadata, and page-cache contents returned to applications are driven by data the attacker caused the kernel to read from outside the intended buffer.\nA:H - A large `data_offset` faults on unmapped memory or a vmalloc guard page in the demultiplex/softirq path, and an inflated `data_length` desynchronizes `reassembly.data_length` so `_get_first_reassembly()` returns NULL and is immediately dereferenced \u2014 either way an oops (full panic with `panic_on_oops`) that tears down the mount."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:38.495Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fdc23a47be015fba915c4f9dfd43c65ad4829a35"
},
{
"url": "https://git.kernel.org/stable/c/f23d5c6b7540ec9b1e73a8ea3b2ae9045248d728"
},
{
"url": "https://git.kernel.org/stable/c/241e58de23e7c1bbb9bee526c17d9a0f2a90fbad"
},
{
"url": "https://git.kernel.org/stable/c/581fb78e0388b78911b0c920e4073737090c8b5f"
},
{
"url": "https://git.kernel.org/stable/c/f57e53ea252363234f86674db475839e5b87102e"
}
],
"title": "smb: client: let recv_done verify data_offset, data_length and remaining_data_length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39933",
"datePublished": "2025-10-04T07:30:57.496Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2026-10-30T12:22:38.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80653 (GCVE-0-2026-80653)
Vulnerability from cvelistv5
Published
2026-08-28 06:49
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: hisi_sas: Add slave_destroy interface for v3 hw
WARNING is triggered when executing link reset of remote PHY and rmmod
SAS driver simultaneously. Following is the WARNING log:
WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0
Call trace:
__device_links_no_driver+0xb4/0xc0
device_links_driver_cleanup+0xb0/0xfc
__device_release_driver+0x198/0x23c
device_release_driver+0x38/0x50
bus_remove_device+0x130/0x140
device_del+0x184/0x434
__scsi_remove_device+0x118/0x150
scsi_remove_target+0x1bc/0x240
sas_rphy_remove+0x90/0x94
sas_rphy_delete+0x24/0x3c
sas_destruct_devices+0x64/0xa0 [libsas]
sas_revalidate_domain+0xe4/0x150 [libsas]
process_one_work+0x1e0/0x46c
worker_thread+0x15c/0x464
kthread+0x160/0x170
ret_from_fork+0x10/0x20
---[ end trace 71e059eb58f85d4a ]---
During SAS phy up, link->status is set to DL_STATE_AVAILABLE in
device_links_driver_bound, then this setting influences
__device_links_no_driver() before driver rmmod and caused WARNING.
Add the slave_destroy interface to make sure link is removed after flush
workque.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 16fd4a7c5917097e9a3da03b39a92381eee40724 Version: 16fd4a7c5917097e9a3da03b39a92381eee40724 Version: 16fd4a7c5917097e9a3da03b39a92381eee40724 Version: 16fd4a7c5917097e9a3da03b39a92381eee40724 Version: 16fd4a7c5917097e9a3da03b39a92381eee40724 Version: 16fd4a7c5917097e9a3da03b39a92381eee40724 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:19:22.735308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:31.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d664252d414aae17066a2831fe7bfd8f0e27b018",
"status": "affected",
"version": "16fd4a7c5917097e9a3da03b39a92381eee40724",
"versionType": "git"
},
{
"lessThan": "c305853027c04f34435ca4edace772709d70a4fe",
"status": "affected",
"version": "16fd4a7c5917097e9a3da03b39a92381eee40724",
"versionType": "git"
},
{
"lessThan": "f8bf667891e92fbe13d02671d4637775ab3118f0",
"status": "affected",
"version": "16fd4a7c5917097e9a3da03b39a92381eee40724",
"versionType": "git"
},
{
"lessThan": "cb414aff28e18e6f5cff9f87ea31376ed8af317b",
"status": "affected",
"version": "16fd4a7c5917097e9a3da03b39a92381eee40724",
"versionType": "git"
},
{
"lessThan": "4867dba229292e13fc19ed865ec1839661952ff9",
"status": "affected",
"version": "16fd4a7c5917097e9a3da03b39a92381eee40724",
"versionType": "git"
},
{
"lessThan": "67b85a88265df19f049241d8c00571a5408f4eeb",
"status": "affected",
"version": "16fd4a7c5917097e9a3da03b39a92381eee40724",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Add slave_destroy interface for v3 hw\n\nWARNING is triggered when executing link reset of remote PHY and rmmod\nSAS driver simultaneously. Following is the WARNING log:\n\nWARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0\n Call trace:\n __device_links_no_driver+0xb4/0xc0\n device_links_driver_cleanup+0xb0/0xfc\n __device_release_driver+0x198/0x23c\n device_release_driver+0x38/0x50\n bus_remove_device+0x130/0x140\n device_del+0x184/0x434\n __scsi_remove_device+0x118/0x150\n scsi_remove_target+0x1bc/0x240\n sas_rphy_remove+0x90/0x94\n sas_rphy_delete+0x24/0x3c\n sas_destruct_devices+0x64/0xa0 [libsas]\n sas_revalidate_domain+0xe4/0x150 [libsas]\n process_one_work+0x1e0/0x46c\n worker_thread+0x15c/0x464\n kthread+0x160/0x170\n ret_from_fork+0x10/0x20\n ---[ end trace 71e059eb58f85d4a ]---\n\nDuring SAS phy up, link-\u003estatus is set to DL_STATE_AVAILABLE in\ndevice_links_driver_bound, then this setting influences\n__device_links_no_driver() before driver rmmod and caused WARNING.\n\nAdd the slave_destroy interface to make sure link is removed after flush\nworkque."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached when libsas tears down SCSI devices after a remote SAS PHY link reset (sas_revalidate_domain -\u003e sas_destruct_devices) or when root unloads the hisi_sas v3 module; both require local kernel/driver activity, not remote network packets.\nAC:L - An attacker who controls a rogue SAS endpoint can repeatedly force link resets and race them against driver teardown; the failure is a deterministic missing sdev_destroy/device_link_remove on the hot path rather than a rare layout-dependent condition.\nPR:N - Triggering remote PHY link resets and SAS domain revalidation requires no Linux credentials\u2014only a malicious or misbehaving device on the SAS fabric; root is only needed for the concurrent module-unload half of the reported race, not the dangling-link defect itself.\nUI:N - Exploitation does not require a victim to open files or mount filesystems; a rogue SAS device or automated PHY error/link-reset handling can drive the vulnerable teardown while the HBA is active.\nS:U - Impact is confined to the host kernel\u0027s SCSI/SAS driver and PM-runtime device-link state on the affected HiSilicon v3 HBA; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Without sdev_destroy, managed device_links from scsi_device to hisi_hba survive consumer teardown, leaving consumer pointers to freed scsi_device memory that later hba PM-runtime or device-link walks can dereference (use-after-free read primitive).\nI:H - Stale managed device_links referencing freed scsi_devices corrupt kernel heap/link metadata and can be leveraged for further memory corruption during subsequent hba link management, matching kernel CNA guidance for lifecycle/UAF bugs.\nA:H - The reported race triggers WARN_ON in __device_links_no_driver (kernel oops under panic_on_warn) and dangling PM-runtime device_links from unfreed teardown can crash the host on later hba suspend/resume or module removal."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:53.201Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d664252d414aae17066a2831fe7bfd8f0e27b018"
},
{
"url": "https://git.kernel.org/stable/c/c305853027c04f34435ca4edace772709d70a4fe"
},
{
"url": "https://git.kernel.org/stable/c/f8bf667891e92fbe13d02671d4637775ab3118f0"
},
{
"url": "https://git.kernel.org/stable/c/cb414aff28e18e6f5cff9f87ea31376ed8af317b"
},
{
"url": "https://git.kernel.org/stable/c/4867dba229292e13fc19ed865ec1839661952ff9"
},
{
"url": "https://git.kernel.org/stable/c/67b85a88265df19f049241d8c00571a5408f4eeb"
}
],
"title": "scsi: hisi_sas: Add slave_destroy interface for v3 hw",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80653",
"datePublished": "2026-08-28T06:49:00.717Z",
"dateReserved": "2026-08-26T14:34:25.779Z",
"dateUpdated": "2026-10-30T12:30:53.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43443 (GCVE-0-2026-43443)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not
check the return values of clk_get(). This could lead to a kernel crash
when the invalid pointers are later dereferenced by clock core
functions.
Fix this by:
1. Changing clk_get() to the device-managed devm_clk_get().
2. Adding IS_ERR() checks immediately after each clock acquisition.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d4c750f2c7d44b5b39e197308bc3f510205bba4b Version: d4c750f2c7d44b5b39e197308bc3f510205bba4b Version: d4c750f2c7d44b5b39e197308bc3f510205bba4b Version: d4c750f2c7d44b5b39e197308bc3f510205bba4b Version: d4c750f2c7d44b5b39e197308bc3f510205bba4b Version: d4c750f2c7d44b5b39e197308bc3f510205bba4b |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43443",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:38:51.919763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:54.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/amd/acp/acp-mach-common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9cdfe3f94e93b606ff5d6e8e6dc405e07acce84",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
},
{
"lessThan": "a71ce398347fed9422dbd5c6458f7f8348012c64",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
},
{
"lessThan": "53682a55cac6f159311c63d04f3d7ba64a8a455a",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
},
{
"lessThan": "e0e31a7ed1191c12a28763bb70c4c7f5adadc79d",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
},
{
"lessThan": "0cee68fb7f4cf1562e067c5a82d25062a973b0d0",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
},
{
"lessThan": "30c64fb9839949f085c8eb55b979cbd8a4c51f00",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/amd/acp/acp-mach-common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-mach-common: Add missing error check for clock acquisition\n\nThe acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not\ncheck the return values of clk_get(). This could lead to a kernel crash\nwhen the invalid pointers are later dereferenced by clock core\nfunctions.\n\nFix this by:\n1. Changing clk_get() to the device-managed devm_clk_get().\n2. Adding IS_ERR() checks immediately after each clock acquisition."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:33.716Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9cdfe3f94e93b606ff5d6e8e6dc405e07acce84"
},
{
"url": "https://git.kernel.org/stable/c/a71ce398347fed9422dbd5c6458f7f8348012c64"
},
{
"url": "https://git.kernel.org/stable/c/53682a55cac6f159311c63d04f3d7ba64a8a455a"
},
{
"url": "https://git.kernel.org/stable/c/e0e31a7ed1191c12a28763bb70c4c7f5adadc79d"
},
{
"url": "https://git.kernel.org/stable/c/0cee68fb7f4cf1562e067c5a82d25062a973b0d0"
},
{
"url": "https://git.kernel.org/stable/c/30c64fb9839949f085c8eb55b979cbd8a4c51f00"
}
],
"title": "ASoC: amd: acp-mach-common: Add missing error check for clock acquisition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43443",
"datePublished": "2026-05-08T14:22:11.303Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-11-06T15:42:54.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68436 (GCVE-0-2026-68436)
Vulnerability from cvelistv5
Published
2026-08-12 00:07
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use kvzalloc to allocate struct dc
struct dc has grown large over time (most of it the two inlined
dc_scratch_space copies) and now sits close to the page allocator's 4 MiB
contiguous allocation limit. Its actual size is not fixed by the source
alone, it also depends on the compiler and the .config, so it can easily
cross 4 MiB, e.g. with a newer GCC or a config change.
dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the
request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,
so the page allocator warns and returns NULL. dc_create() then fails, DM
init fails and amdgpu probe aborts with -EINVAL:
WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380
dc_create+0x38/0x660 [amdgpu]
amdgpu_dm_init+0x2d9/0x510 [amdgpu]
dm_hw_init+0x1b/0x90 [amdgpu]
amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]
amdgpu_driver_load_kms+0x19/0x80 [amdgpu]
amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]
dc_create() then returns NULL and DM init fails, which aborts the whole
GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block
<dm> failed -22"), leaving the display unusable. The subsequent
amdgpu_irq_put() warnings during teardown are just fallout of unwinding
a half-initialized device.
struct dc is a software-only bookkeeping structure that is never handed
to hardware DMA and is only ever kept as an opaque pointer, so it does
not require physically contiguous memory. Allocate it with kvzalloc()
(and free it with kvfree()) so that the allocator can fall back to
vmalloc() when a contiguous allocation of that size is not available,
which also avoids the MAX_PAGE_ORDER warning entirely.
v2:
- Rebase to amd-staging-drm-next.
(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd8506091e9f1e111d9964f5ec2348d7d5157bf2",
"status": "affected",
"version": "d62d5551dd615f9e488b13595d69b308cd019e16",
"versionType": "git"
},
{
"lessThan": "c59a693fbd213f8f27942509b48b1a4111fdd40d",
"status": "affected",
"version": "d62d5551dd615f9e488b13595d69b308cd019e16",
"versionType": "git"
},
{
"lessThan": "dbad70d40cad9c5e7586953275287fe7531fb811",
"status": "affected",
"version": "d62d5551dd615f9e488b13595d69b308cd019e16",
"versionType": "git"
},
{
"lessThan": "75050390151a14802be433c3856ddcb483cecd24",
"status": "affected",
"version": "d62d5551dd615f9e488b13595d69b308cd019e16",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use kvzalloc to allocate struct dc\n\nstruct dc has grown large over time (most of it the two inlined\ndc_scratch_space copies) and now sits close to the page allocator\u0027s 4 MiB\ncontiguous allocation limit. Its actual size is not fixed by the source\nalone, it also depends on the compiler and the .config, so it can easily\ncross 4 MiB, e.g. with a newer GCC or a config change.\n\ndc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the\nrequest is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,\nso the page allocator warns and returns NULL. dc_create() then fails, DM\ninit fails and amdgpu probe aborts with -EINVAL:\n\n WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380\n dc_create+0x38/0x660 [amdgpu]\n amdgpu_dm_init+0x2d9/0x510 [amdgpu]\n dm_hw_init+0x1b/0x90 [amdgpu]\n amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]\n amdgpu_driver_load_kms+0x19/0x80 [amdgpu]\n amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]\n\ndc_create() then returns NULL and DM init fails, which aborts the whole\nGPU init and makes amdgpu probe fail with -EINVAL (\"hw_init of IP block\n\u003cdm\u003e failed -22\"), leaving the display unusable. The subsequent\namdgpu_irq_put() warnings during teardown are just fallout of unwinding\na half-initialized device.\n\nstruct dc is a software-only bookkeeping structure that is never handed\nto hardware DMA and is only ever kept as an opaque pointer, so it does\nnot require physically contiguous memory. Allocate it with kvzalloc()\n(and free it with kvfree()) so that the allocator can fall back to\nvmalloc() when a contiguous allocation of that size is not available,\nwhich also avoids the MAX_PAGE_ORDER warning entirely.\n\nv2:\n - Rebase to amd-staging-drm-next.\n\n(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:09.408Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd8506091e9f1e111d9964f5ec2348d7d5157bf2"
},
{
"url": "https://git.kernel.org/stable/c/c59a693fbd213f8f27942509b48b1a4111fdd40d"
},
{
"url": "https://git.kernel.org/stable/c/dbad70d40cad9c5e7586953275287fe7531fb811"
},
{
"url": "https://git.kernel.org/stable/c/75050390151a14802be433c3856ddcb483cecd24"
}
],
"title": "drm/amd/display: use kvzalloc to allocate struct dc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68436",
"datePublished": "2026-08-12T00:07:24.698Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-10-21T12:44:09.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90273 (GCVE-0-2026-90273)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
In the perf enable path, there are missing cases where
cscfg_csdev_disable_active_config() is not called:
- Branch broadcast is selected but not supported by the hardware
- etm4_enable_hw() fails
This can lead to a leak of config_desc->active_cnt.
Fix this by properly calling cscfg_csdev_disable_active_config()
in these error paths.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 810ac401db1fe432020d7936a199591000de8279 Version: 810ac401db1fe432020d7936a199591000de8279 Version: 810ac401db1fe432020d7936a199591000de8279 Version: 810ac401db1fe432020d7936a199591000de8279 Version: 810ac401db1fe432020d7936a199591000de8279 Version: 810ac401db1fe432020d7936a199591000de8279 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-etm4x-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f097b6969e9961365358fc5ba5892db2f284f020",
"status": "affected",
"version": "810ac401db1fe432020d7936a199591000de8279",
"versionType": "git"
},
{
"lessThan": "ba63c62d4252f6bc58fd2a567075c72d03332562",
"status": "affected",
"version": "810ac401db1fe432020d7936a199591000de8279",
"versionType": "git"
},
{
"lessThan": "26f9e89bad5a7e3005d3dc97a2e2fa6d6b2b8bb6",
"status": "affected",
"version": "810ac401db1fe432020d7936a199591000de8279",
"versionType": "git"
},
{
"lessThan": "d5f3dae82705d9388434892915008da3bb83c4ba",
"status": "affected",
"version": "810ac401db1fe432020d7936a199591000de8279",
"versionType": "git"
},
{
"lessThan": "7e4f2702bbadbde887a5d8897297720a7f037ee5",
"status": "affected",
"version": "810ac401db1fe432020d7936a199591000de8279",
"versionType": "git"
},
{
"lessThan": "0a47f0be6557b4a851addd430383a4dc7ee08752",
"status": "affected",
"version": "810ac401db1fe432020d7936a199591000de8279",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-etm4x-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable\n\nIn the perf enable path, there are missing cases where\ncscfg_csdev_disable_active_config() is not called:\n\n - Branch broadcast is selected but not supported by the hardware\n - etm4_enable_hw() fails\n\nThis can lead to a leak of config_desc-\u003eactive_cnt.\nFix this by properly calling cscfg_csdev_disable_active_config()\nin these error paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:02.543Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f097b6969e9961365358fc5ba5892db2f284f020"
},
{
"url": "https://git.kernel.org/stable/c/ba63c62d4252f6bc58fd2a567075c72d03332562"
},
{
"url": "https://git.kernel.org/stable/c/26f9e89bad5a7e3005d3dc97a2e2fa6d6b2b8bb6"
},
{
"url": "https://git.kernel.org/stable/c/d5f3dae82705d9388434892915008da3bb83c4ba"
},
{
"url": "https://git.kernel.org/stable/c/7e4f2702bbadbde887a5d8897297720a7f037ee5"
},
{
"url": "https://git.kernel.org/stable/c/0a47f0be6557b4a851addd430383a4dc7ee08752"
}
],
"title": "coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90273",
"datePublished": "2026-09-17T16:08:06.638Z",
"dateReserved": "2026-09-11T19:38:34.797Z",
"dateUpdated": "2026-10-30T12:35:02.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99136 (GCVE-0-2026-99136)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-crypt: fix a tiny race condition in crypt_dec_pending
crypt_dec_pending reads io->error before calling atomic_dec_and_test.
Another context, for example crypt_endio called from an interrupt, may
set io->error and drop its reference between the read and the
decrement. crypt_dec_pending then drops the last reference and completes
the bio with the stale status - so a read that failed and was never
decrypted, or a write that failed, is reported as successful.
The read was placed before the decrement by commit b35f8caa0890 ("dm
crypt: wait for endio to complete before destruction"), because that
commit freed dm_crypt_io before calling bio_endio. This is no longer the
case, dm_crypt_io lives in the per-bio data now.
Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is
fully ordered, so no additional barrier is needed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: b35f8caa0890169000fec22902290d9a15274cbd Version: 9c8f3fcd3ffd3283cc0971c8919058356f20a963 Version: 2.6.28.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-crypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "445a6883f46d3ab1ff545199a8cc1d5834936d3f",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "6f82e86471c92fd874f2630c9a6af887f4ed1a77",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "056bf8322e39a48026df352d6227ec03dd8cd032",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "d9d7069bb79139271b54dc477f07e242c445de6b",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "ac5d887ab93592fc5e3605fe30c1d8d232d609b3",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "4f16bb982b27b9f5a15301f622c318001fe521f8",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"lessThan": "148845aa1921d95ef5dc851c76e6a284f6657df6",
"status": "affected",
"version": "b35f8caa0890169000fec22902290d9a15274cbd",
"versionType": "git"
},
{
"status": "affected",
"version": "9c8f3fcd3ffd3283cc0971c8919058356f20a963",
"versionType": "git"
},
{
"lessThan": "2.6.29",
"status": "affected",
"version": "2.6.28.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-crypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.28.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io-\u003eerror before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io-\u003eerror and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destruction\"), because that\ncommit freed dm_crypt_io before calling bio_endio. This is no longer the\ncase, dm_crypt_io lives in the per-bio data now.\n\nRead io-\u003eerror after atomic_dec_and_test instead. atomic_dec_and_test is\nfully ordered, so no additional barrier is needed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local read(2) or write(2) on a file on an existing dm-crypt volume follows vfs_read/vfs_write through the filesystem, submit_bio(), dm_submit_bio(), crypt_map(), and patched crypt_dec_pending(); no network message supplies the failed bio or stale status.\nAC:H - Exploitation needs a lower read/write or crypto operation to fail and its crypt_endio() error store/decrement to land between crypt_dec_pending()\u0027s error load and atomic decrement. The caller can repeat I/O but cannot ordinarily induce the device failure or interrupt timing, so it does not control both sides.\nPR:L - An unprivileged user with ordinary read or write permission on a file backed by the mapped volume reaches crypt_map(); vfs_read/vfs_write gate this with the open mode and security_file_permission(), not a capability. CAP_SYS_ADMIN in ctl_ioctl() gates creating the dm table, not I/O on an existing mapping.\nUI:N - The attacker issues the read/write and can evict their readable file pages or repeat I/O themselves; no second user must open a file, mount attacker-supplied media, or approve an action.\nS:U - crypt_dec_pending() misreports completion of a host-kernel bio to the same host filesystem/block stack; it crosses no VM, IOMMU, or separate security-authority boundary.\nC:H - For buffered reads, stale success makes ext4 mpage_end_io()-\u003e__read_end_io() mark a fresh filemap_alloc_folio(GFP_HIGHUSER_MOVABLE) folio uptodate although the failed read never filled or decrypted it; filemap_read() then copy_folio_to_iter() exposes prior physical-page contents.\nI:H - For writes, stale success makes ext4_end_bio() and JBD2 journal_end_buffer_io_sync() skip their error paths and accept failed data, metadata, or commit-record bios as durable. This can silently lose updates and leave the encrypted filesystem persistently inconsistent.\nA:H - Because the false status prevents ext4/JBD2 from recording the I/O error or aborting the journal, continued operation after failed metadata or commit writes can leave the volume unusable; false-success metadata reads can likewise install random buffers as valid."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:39.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/445a6883f46d3ab1ff545199a8cc1d5834936d3f"
},
{
"url": "https://git.kernel.org/stable/c/6f82e86471c92fd874f2630c9a6af887f4ed1a77"
},
{
"url": "https://git.kernel.org/stable/c/6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c"
},
{
"url": "https://git.kernel.org/stable/c/056bf8322e39a48026df352d6227ec03dd8cd032"
},
{
"url": "https://git.kernel.org/stable/c/d9d7069bb79139271b54dc477f07e242c445de6b"
},
{
"url": "https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3"
},
{
"url": "https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8"
},
{
"url": "https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6"
}
],
"title": "dm-crypt: fix a tiny race condition in crypt_dec_pending",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99136",
"datePublished": "2026-10-28T10:34:48.558Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-31T12:43:39.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99203 (GCVE-0-2026-99203)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pipe: preserve existing fasync readers on writer setup failure
F_SETFL and FIOASYNC decide whether to invoke ->fasync() before
pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can
therefore both enter the callback.
fasync_helper() allocates before checking for an existing entry. If the
first enable installs both entries, a second enable can update the
reader entry and then fail the allocation for the writer entry. The
error path removes the pre-existing reader entry, clearing FASYNC while
the writer entry remains registered. __fput() then skips ->fasync(), so a
later pipe notification can dereference the freed file or its f_owner.
An unprivileged memory-pressure reproducer triggers a KASAN
slab-use-after-free in send_sigio() through this path.
Keep the reader helper's result and undo the registration only if this
call added it. The pipe mutex serializes changes to both lists, so a
failed new registration still removes its reader, while a failed
duplicate preserves the existing registrations and FASYNC. Successful
duplicate enables continue to update fa_fd as before.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed Version: 76398425bb06b07cc3a3b1ce169c67dc9d6874ed |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pipe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6041bcd185d4df051490fe166e64feae6c3b8291",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "7cdbfa22a7e270b155ddb958b1583a999c0c8abb",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "94be790dd6fbe0912f35bb711bea8ef3687eaca9",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "4c42ce499ce4b1c787e61082e3b13df4f30c4eaa",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "2259809e5b7043c4ba20af7b14ba3e471cf55521",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "40bb03d3ea6f6a915218508819ecc4d7a7fa260d",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pipe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke -\u003efasync() before\npipe_fasync() takes pipe-\u003emutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips -\u003efasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper\u0027s result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the patched pipe_fasync() only through local fcntl(fd,F_SETFL,...O_ASYNC) or ioctl(fd,FIOASYNC,...) on an O_RDWR FIFO; no protocol packet supplies the triggering state.\nAC:L - Two attacker threads control both enable calls and can retry the filp-\u003ef_flags race; fasync_cache is SLAB_ACCOUNT, and the fix reports an unprivileged memory-pressure reproducer that makes the duplicate writer allocation fail.\nPR:L - mknodat(...,S_IFIFO,...) reaches vfs_mknod() without CAP_MKNOD because that check covers only block and character nodes, and neither F_SETFL nor FIOASYNC requires a capability on the caller\u0027s FIFO descriptor.\nUI:N - The attacker creates and opens the FIFO, races asynchronous enablement, closes the stale file, and reads the retained FIFO to invoke anon_pipe_read()-\u003ekill_fasync(); no victim action is needed.\nS:U - The stale pipe fasync entry corrupts objects used by kill_fasync_rcu() and send_sigio() inside the same kernel security authority; this is ordinary local kernel privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - kill_fasync_rcu() reads fa_file-\u003ef_owner after both the file and owner can have been freed, and send_sigio() follows reclaimed fown-\u003epid and credential fields; reclaiming these slabs provides a fake-object arbitrary-read primitive.\nI:H - send_sigio() acquires fown-\u003elock and acts on fown-\u003epid through the freed, reclaimable owner, writing lock and signal/task state through attacker-shaped pointers; this UAF is exploitable memory corruption rather than a read-only stale access.\nA:H - The fix reports a reproduced KASAN slab-use-after-free in send_sigio(); the stale lock and pid dereferences during anon_pipe_read() notification can oops, panic, or hang the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:45:00.735Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291"
},
{
"url": "https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb"
},
{
"url": "https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386"
},
{
"url": "https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9"
},
{
"url": "https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6"
},
{
"url": "https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa"
},
{
"url": "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521"
},
{
"url": "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"
}
],
"title": "pipe: preserve existing fasync readers on writer setup failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99203",
"datePublished": "2026-10-28T10:35:57.589Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-31T12:45:00.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97960 (GCVE-0-2026-97960)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/intel: Prevent drain_pebs() reentry
The PEBS buffer is shared by all events on a CPU, so drain_pebs() must
not be reentered. If so, one instance may observe stale buffer state and
potentially access out-of-bound memory.
Most invocations happen in NMI context, which naturally prevents reentry.
However, drain_pebs() is also reachable from process context via
intel_pmu_drain_pebs_buffer().
In those paths, the PMU is often already disabled, but not guaranteed.
For example, __intel_pmu_pebs_disable() only disables the target counter,
so other active counters can still raise a PMI and interrupt an in-flight
drain_pebs(). Here is an example,
__perf_addr_filters_adjust()
perf_event_stop()
__perf_event_stop()
x86_pmu_stop() (event->pmu->stop)
intel_pmu_disable_event()
intel_pmu_pebs_disable()
__intel_pmu_pebs_disable()
intel_pmu_drain_large_pebs()
intel_pmu_drain_pebs_buffer()
Introduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and
use them in intel_pmu_drain_large_pebs() to disable the full PMU
around the intel_pmu_drain_pebs_buffer() call, preventing reentry.
Also add a warning in intel_pmu_drain_pebs_buffer() when the full PMU is
not disabled.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 Version: b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 Version: b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 Version: b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 Version: b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 Version: a9165207b2b07415eeb01b3ac8bb84976ec96984 Version: 6.3.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/events/intel/core.c",
"arch/x86/events/intel/ds.c",
"arch/x86/events/perf_event.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9882068ed242fcd4743f53027e8c790e88dcafff",
"status": "affected",
"version": "b752ea0c28e3f7f0aaaad6abf84f735eebc37a60",
"versionType": "git"
},
{
"lessThan": "999e482fdf89400cc1ae937680fc05096b4c915b",
"status": "affected",
"version": "b752ea0c28e3f7f0aaaad6abf84f735eebc37a60",
"versionType": "git"
},
{
"lessThan": "a5fe19dd8b3ed5fad6e5e0f0c58c7245043ee4af",
"status": "affected",
"version": "b752ea0c28e3f7f0aaaad6abf84f735eebc37a60",
"versionType": "git"
},
{
"lessThan": "c55599c0ec2aa020e41a0599c3044c56d8a2e7d9",
"status": "affected",
"version": "b752ea0c28e3f7f0aaaad6abf84f735eebc37a60",
"versionType": "git"
},
{
"lessThan": "a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c",
"status": "affected",
"version": "b752ea0c28e3f7f0aaaad6abf84f735eebc37a60",
"versionType": "git"
},
{
"status": "affected",
"version": "a9165207b2b07415eeb01b3ac8bb84976ec96984",
"versionType": "git"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/events/intel/core.c",
"arch/x86/events/intel/ds.c",
"arch/x86/events/perf_event.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Prevent drain_pebs() reentry\n\nThe PEBS buffer is shared by all events on a CPU, so drain_pebs() must\nnot be reentered. If so, one instance may observe stale buffer state and\npotentially access out-of-bound memory.\n\nMost invocations happen in NMI context, which naturally prevents reentry.\nHowever, drain_pebs() is also reachable from process context via\nintel_pmu_drain_pebs_buffer().\n\nIn those paths, the PMU is often already disabled, but not guaranteed.\nFor example, __intel_pmu_pebs_disable() only disables the target counter,\nso other active counters can still raise a PMI and interrupt an in-flight\ndrain_pebs(). Here is an example,\n\n__perf_addr_filters_adjust()\n perf_event_stop()\n __perf_event_stop()\n x86_pmu_stop() (event-\u003epmu-\u003estop)\n intel_pmu_disable_event()\n intel_pmu_pebs_disable()\n __intel_pmu_pebs_disable()\n intel_pmu_drain_large_pebs()\n intel_pmu_drain_pebs_buffer()\n\nIntroduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and\nuse them in intel_pmu_drain_large_pebs() to disable the full PMU\naround the intel_pmu_drain_pebs_buffer() call, preventing reentry.\n\nAlso add a warning in intel_pmu_drain_pebs_buffer() when the full PMU is\nnot disabled."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:50.943Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9882068ed242fcd4743f53027e8c790e88dcafff"
},
{
"url": "https://git.kernel.org/stable/c/999e482fdf89400cc1ae937680fc05096b4c915b"
},
{
"url": "https://git.kernel.org/stable/c/a5fe19dd8b3ed5fad6e5e0f0c58c7245043ee4af"
},
{
"url": "https://git.kernel.org/stable/c/c55599c0ec2aa020e41a0599c3044c56d8a2e7d9"
},
{
"url": "https://git.kernel.org/stable/c/a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c"
}
],
"title": "perf/x86/intel: Prevent drain_pebs() reentry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97960",
"datePublished": "2026-09-25T10:23:04.943Z",
"dateReserved": "2026-09-25T10:18:58.206Z",
"dateUpdated": "2026-10-21T12:53:50.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98993 (GCVE-0-2026-98993)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
namespace: don't inherit MNT_UMOUNT in clone_mnt()
MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has
taken out of its namespace. It's never cleared. __detach_mounts()
unhooks a mount that carries it instead of unmounting it.
disconnect_mount() lets an unmounted child stay attached only if its
parent carries it. propagate_umount() takes it as the sign that a mount
is going to be unmounted when it decides what else can be unmounted,
where a chain of locked mounts ends and where a for reparenting an
overmount.
clone_mnt() copies the flags of the source and only masks
MNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was
lazily unmounted but is kept alive by a file descriptor can still be
copied when its root is an nsfs or pidfs file because may_copy_tree()
accepts those before checking whether the source is mounted at all:
mount --bind /proc/self/ns/net /tmp/x
exec 3< /tmp/x
umount -l /tmp/x
mount --bind /proc/self/fd/3 /tmp/y
The mount on /tmp/y is attached to the caller's namespace with
MNT_UMOUNT already set and every copy of it inherits the flag again.
That causes a number of bugs:
- Unlink its mountpoint from a mount namespace where it isn't one.
__detach_mounts() takes it for a mount that was unmounted earlier,
unhooks it from its parent and drops the reference the namespace
holds on it. It stays in the namespace with one reference too few
and as its own parent, so it can't be unmounted through the file
descriptor anymore and the namespace never finds it again. When the
namespace goes away it's leaked and points to a freed struct
mnt_namespace that may_change_propagation() and anon_ns_root() read
on the next propagation change or mount_setattr() through the file
descriptor.
- Make it shared and unmount a peer. trace_transfers() follows the
flag from the peer into it and strips it from its peer group.
- Let a propagated umount reach it. gather_candidates() marks it with
T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the
mark is never cleared and every later propagated umount skips it. If
it's the parent of a locked mount handle_locked() takes it as the
cutoff and commits the locked child that should have stayed and
disconnect_mount() leaves that child attached to it, unmounted under
a mounted parent, which is what disconnect_mount() exists to
prevent. When the namespace goes away umount_tree() visits the child
a second time. And once __detach_mounts() has made it its own parent
reparent() never finds the end of the chain of unmounted parents.
A clone is a new mount that has never been unmounted. Add MNT_UMOUNT
to MNT_INTERNAL_FLAGS so clone_mnt() never copies it. And warn when
umount_tree() reaches a mount that already has it set.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 590ce4bcbfb4e0462a720a4ad901e84416080bba Version: 7052e71b2d085f76800115d4a212dcaf82b86262 Version: 4.0.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/namespace.c",
"include/linux/mount.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b201d59d047a5e05728c10864a56bdb67950d0b1",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "de098fb4594f8724fa286f08c7f42837bc19b478",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "fc1f3a476c35164c1beed7090fc0e630f52d778e",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "99698cfa34e493fc091219056aae446fe9442a96",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "c26c1a91ad2881a194f7af543e0b57f0870006b2",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "eecc9cd0fc07dba3f7fb0b2f844b4029435a2f7b",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "5077b52e9e4d72da53c50251296b99cd416765a1",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"lessThan": "e2c6d326216642011da318b9edfd5d57ebd5a56f",
"status": "affected",
"version": "590ce4bcbfb4e0462a720a4ad901e84416080bba",
"versionType": "git"
},
{
"status": "affected",
"version": "7052e71b2d085f76800115d4a212dcaf82b86262",
"versionType": "git"
},
{
"lessThan": "4.1",
"status": "affected",
"version": "4.0.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/namespace.c",
"include/linux/mount.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: don\u0027t inherit MNT_UMOUNT in clone_mnt()\n\nMNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has\ntaken out of its namespace. It\u0027s never cleared. __detach_mounts()\nunhooks a mount that carries it instead of unmounting it.\n\ndisconnect_mount() lets an unmounted child stay attached only if its\nparent carries it. propagate_umount() takes it as the sign that a mount\nis going to be unmounted when it decides what else can be unmounted,\nwhere a chain of locked mounts ends and where a for reparenting an\novermount.\n\nclone_mnt() copies the flags of the source and only masks\nMNT_INTERNAL_FLAGS which doesn\u0027t include MNT_UMOUNT. A mount that was\nlazily unmounted but is kept alive by a file descriptor can still be\ncopied when its root is an nsfs or pidfs file because may_copy_tree()\naccepts those before checking whether the source is mounted at all:\n\n mount --bind /proc/self/ns/net /tmp/x\n exec 3\u003c /tmp/x\n umount -l /tmp/x\n mount --bind /proc/self/fd/3 /tmp/y\n\nThe mount on /tmp/y is attached to the caller\u0027s namespace with\nMNT_UMOUNT already set and every copy of it inherits the flag again.\n\nThat causes a number of bugs:\n\n- Unlink its mountpoint from a mount namespace where it isn\u0027t one.\n __detach_mounts() takes it for a mount that was unmounted earlier,\n unhooks it from its parent and drops the reference the namespace\n holds on it. It stays in the namespace with one reference too few\n and as its own parent, so it can\u0027t be unmounted through the file\n descriptor anymore and the namespace never finds it again. When the\n namespace goes away it\u0027s leaked and points to a freed struct\n mnt_namespace that may_change_propagation() and anon_ns_root() read\n on the next propagation change or mount_setattr() through the file\n descriptor.\n\n- Make it shared and unmount a peer. trace_transfers() follows the\n flag from the peer into it and strips it from its peer group.\n\n- Let a propagated umount reach it. gather_candidates() marks it with\n T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the\n mark is never cleared and every later propagated umount skips it. If\n it\u0027s the parent of a locked mount handle_locked() takes it as the\n cutoff and commits the locked child that should have stayed and\n disconnect_mount() leaves that child attached to it, unmounted under\n a mounted parent, which is what disconnect_mount() exists to\n prevent. When the namespace goes away umount_tree() visits the child\n a second time. And once __detach_mounts() has made it its own parent\n reparent() never finds the end of the chain of unmounted parents.\n\nA clone is a new mount that has never been unmounted. Add MNT_UMOUNT\nto MNT_INTERNAL_FLAGS so clone_mnt() never copies it. And warn when\numount_tree() reaches a mount that already has it set."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - mount(2) reaches path_mount()-\u003edo_loopback()-\u003e__do_loopback()-\u003eclone_mnt(), which copies MNT_UMOUNT from an fd-pinned, lazily unmounted nsfs/pidfs mount; the causal operations are local syscalls.\nAC:L - The attacker can deterministically bind an nsfs/pidfs file, retain an fd, call umount2(MNT_DETACH), rebind /proc/self/fd/N, and unlink the mountpoint from an attacker-controlled sibling mount namespace; no uncontrollable race is required.\nPR:L - path_mount() and can_umount() use may_mount(), which checks CAP_SYS_ADMIN in the mount namespace\u0027s owning user namespace; an unprivileged user can obtain that capability with unshare(CLONE_NEWUSER|CLONE_NEWNS).\nUI:N - The attacker performs the namespace creation, bind mounts, lazy unmount, fd retention, and unlink operations without any victim action.\nS:U - clone_mnt() corrupts mount and mnt_namespace lifetime state within the same host kernel security authority; a resulting local kernel privilege escalation remains scope unchanged.\nC:H - __detach_mounts() leaves the fd-pinned mount\u0027s mnt_ns pointing to a freed struct mnt_namespace; may_change_propagation() dereferences its freed user_ns and anon_ns_root() reads freed namespace fields, creating an attacker-triggered kernel UAF.\nI:H - After the dangling mnt_ns passes may_change_propagation(), do_change_type() calls touch_mnt_namespace(), which writes ns-\u003eevent and operates on ns-\u003epoll through freed, reclaimable storage, supporting heap corruption and control-flow exploitation.\nA:H - reparent() can loop forever on the self-parented unmounted chain, umount_tree() can visit a child twice, and the dangling namespace accesses can fault, permitting a kernel hang or crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:47.019Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b201d59d047a5e05728c10864a56bdb67950d0b1"
},
{
"url": "https://git.kernel.org/stable/c/de098fb4594f8724fa286f08c7f42837bc19b478"
},
{
"url": "https://git.kernel.org/stable/c/fc1f3a476c35164c1beed7090fc0e630f52d778e"
},
{
"url": "https://git.kernel.org/stable/c/99698cfa34e493fc091219056aae446fe9442a96"
},
{
"url": "https://git.kernel.org/stable/c/c26c1a91ad2881a194f7af543e0b57f0870006b2"
},
{
"url": "https://git.kernel.org/stable/c/eecc9cd0fc07dba3f7fb0b2f844b4029435a2f7b"
},
{
"url": "https://git.kernel.org/stable/c/5077b52e9e4d72da53c50251296b99cd416765a1"
},
{
"url": "https://git.kernel.org/stable/c/e2c6d326216642011da318b9edfd5d57ebd5a56f"
}
],
"title": "namespace: don\u0027t inherit MNT_UMOUNT in clone_mnt()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98993",
"datePublished": "2026-10-23T12:20:12.266Z",
"dateReserved": "2026-09-25T10:25:14.384Z",
"dateUpdated": "2026-10-30T12:40:47.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23208 (GCVE-0-2026-23208)
Vulnerability from cvelistv5
Published
2026-02-14 16:27
Modified
2026-11-05 21:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Prevent excessive number of frames
In this case, the user constructed the parameters with maxpacksize 40
for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer
size for each data URB is maxpacksize * packets, which in this example
is 40 * 6 = 240; When the user performs a write operation to send audio
data into the ALSA PCM playback stream, the calculated number of frames
is packsize[0] * packets = 264, which exceeds the allocated URB buffer
size, triggering the out-of-bounds (OOB) issue reported by syzbot [1].
Added a check for the number of single data URB frames when calculating
the number of frames to prevent [1].
[1]
BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487
Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506
Call Trace:
copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487
prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611
prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 02c56650f3c118d3752122996d96173d26bb13aa Version: 5ef30e443e6d3654cccecec99cf481a69a0a6d3b Version: 99703c921864a318e3e8aae74fde071b1ff35bea Version: 2d50acd7dbd0682a56968ad9551341d7fc5b6eaf Version: aba41867dd66939d336fdf604e4d73b805d8039f Version: d288dc74f8cf95cb7ae0aaf245b7128627a49bf3 Version: f0bd62b64016508938df9babe47f65c2c727d25c Version: f0bd62b64016508938df9babe47f65c2c727d25c Version: f0bd62b64016508938df9babe47f65c2c727d25c Version: f0bd62b64016508938df9babe47f65c2c727d25c Version: f0bd62b64016508938df9babe47f65c2c727d25c Version: 4.4.229 ≤ Version: 4.9.229 ≤ Version: 4.14.186 ≤ Version: 4.19.130 ≤ Version: 5.4.49 ≤ Version: 5.7.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:22:29.926532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:22.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "480a1490c595a242f27493a4544b3efb21b29f6a",
"status": "affected",
"version": "02c56650f3c118d3752122996d96173d26bb13aa",
"versionType": "git"
},
{
"lessThan": "ab0b5e92fc36ee82c1bd01fe896d0f775ed5de41",
"status": "affected",
"version": "5ef30e443e6d3654cccecec99cf481a69a0a6d3b",
"versionType": "git"
},
{
"lessThan": "282aba56713bbc58155716b55ca7222b2d9cf3c8",
"status": "affected",
"version": "99703c921864a318e3e8aae74fde071b1ff35bea",
"versionType": "git"
},
{
"lessThan": "c4dc012b027c9eb101583011089dea14d744e314",
"status": "affected",
"version": "2d50acd7dbd0682a56968ad9551341d7fc5b6eaf",
"versionType": "git"
},
{
"lessThan": "e0ed5a36fb3ab9e7b9ee45cd17f09f6d5f594360",
"status": "affected",
"version": "aba41867dd66939d336fdf604e4d73b805d8039f",
"versionType": "git"
},
{
"lessThan": "d67dde02049e632ba58d3c44a164a74b6a737154",
"status": "affected",
"version": "d288dc74f8cf95cb7ae0aaf245b7128627a49bf3",
"versionType": "git"
},
{
"lessThan": "581821f4b2ecbf411027b0af82b561ee208f4ba4",
"status": "affected",
"version": "f0bd62b64016508938df9babe47f65c2c727d25c",
"versionType": "git"
},
{
"lessThan": "152fc4f7b4a8af1c0418d2722f3b2729799cc837",
"status": "affected",
"version": "f0bd62b64016508938df9babe47f65c2c727d25c",
"versionType": "git"
},
{
"lessThan": "81e4b0009f2acc841d77a24fd796528b0bf62c4e",
"status": "affected",
"version": "f0bd62b64016508938df9babe47f65c2c727d25c",
"versionType": "git"
},
{
"lessThan": "62932d9ed639a9fa71b4ac1a56766a4b43abb7e4",
"status": "affected",
"version": "f0bd62b64016508938df9babe47f65c2c727d25c",
"versionType": "git"
},
{
"lessThan": "ef5749ef8b307bf8717945701b1b79d036af0a15",
"status": "affected",
"version": "f0bd62b64016508938df9babe47f65c2c727d25c",
"versionType": "git"
},
{
"lessThan": "4.4.230",
"status": "affected",
"version": "4.4.229",
"versionType": "semver"
},
{
"lessThan": "4.9.230",
"status": "affected",
"version": "4.9.229",
"versionType": "semver"
},
{
"lessThan": "4.14.188",
"status": "affected",
"version": "4.14.186",
"versionType": "semver"
},
{
"lessThan": "4.19.132",
"status": "affected",
"version": "4.19.130",
"versionType": "semver"
},
{
"lessThan": "5.4.51",
"status": "affected",
"version": "5.4.49",
"versionType": "semver"
},
{
"lessThan": "5.7.8",
"status": "affected",
"version": "5.7.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.4.*",
"status": "unaffected",
"version": "4.4.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.230",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.132",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.7.*",
"status": "unaffected",
"version": "5.7.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.230",
"versionStartIncluding": "4.4.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.230",
"versionStartIncluding": "4.9.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.188",
"versionStartIncluding": "4.14.186",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.132",
"versionStartIncluding": "4.19.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.51",
"versionStartIncluding": "5.4.49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.8",
"versionStartIncluding": "5.7.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Prevent excessive number of frames\n\nIn this case, the user constructed the parameters with maxpacksize 40\nfor rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer\nsize for each data URB is maxpacksize * packets, which in this example\nis 40 * 6 = 240; When the user performs a write operation to send audio\ndata into the ALSA PCM playback stream, the calculated number of frames\nis packsize[0] * packets = 264, which exceeds the allocated URB buffer\nsize, triggering the out-of-bounds (OOB) issue reported by syzbot [1].\n\nAdded a check for the number of single data URB frames when calculating\nthe number of frames to prevent [1].\n\n[1]\nBUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\nWrite of size 264 at addr ffff88804337e800 by task syz.0.17/5506\nCall Trace:\n copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\n prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611\n prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:48.451Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/480a1490c595a242f27493a4544b3efb21b29f6a"
},
{
"url": "https://git.kernel.org/stable/c/ab0b5e92fc36ee82c1bd01fe896d0f775ed5de41"
},
{
"url": "https://git.kernel.org/stable/c/282aba56713bbc58155716b55ca7222b2d9cf3c8"
},
{
"url": "https://git.kernel.org/stable/c/c4dc012b027c9eb101583011089dea14d744e314"
},
{
"url": "https://git.kernel.org/stable/c/e0ed5a36fb3ab9e7b9ee45cd17f09f6d5f594360"
},
{
"url": "https://git.kernel.org/stable/c/d67dde02049e632ba58d3c44a164a74b6a737154"
},
{
"url": "https://git.kernel.org/stable/c/581821f4b2ecbf411027b0af82b561ee208f4ba4"
},
{
"url": "https://git.kernel.org/stable/c/152fc4f7b4a8af1c0418d2722f3b2729799cc837"
},
{
"url": "https://git.kernel.org/stable/c/81e4b0009f2acc841d77a24fd796528b0bf62c4e"
},
{
"url": "https://git.kernel.org/stable/c/62932d9ed639a9fa71b4ac1a56766a4b43abb7e4"
},
{
"url": "https://git.kernel.org/stable/c/ef5749ef8b307bf8717945701b1b79d036af0a15"
}
],
"title": "ALSA: usb-audio: Prevent excessive number of frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23208",
"datePublished": "2026-02-14T16:27:30.441Z",
"dateReserved": "2026-01-13T15:37:45.986Z",
"dateUpdated": "2026-11-05T21:23:22.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23017 (GCVE-0-2026-23017)
Vulnerability from cvelistv5
Published
2026-01-31 11:39
Modified
2026-11-05 21:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix error handling in the init_task on load
If the init_task fails during a driver load, we end up without vports and
netdevs, effectively failing the entire process. In that state a
subsequent reset will result in a crash as the service task attempts to
access uninitialized resources. Following trace is from an error in the
init_task where the CREATE_VPORT (op 501) is rejected by the FW:
[40922.763136] idpf 0000:83:00.0: Device HW Reset initiated
[40924.449797] idpf 0000:83:00.0: Transaction failed (op 501)
[40958.148190] idpf 0000:83:00.0: HW reset detected
[40958.161202] BUG: kernel NULL pointer dereference, address: 00000000000000a8
...
[40958.168094] Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf]
[40958.168865] RIP: 0010:idpf_vc_event_task+0x9b/0x350 [idpf]
...
[40958.177932] Call Trace:
[40958.178491] <TASK>
[40958.179040] process_one_work+0x226/0x6d0
[40958.179609] worker_thread+0x19e/0x340
[40958.180158] ? __pfx_worker_thread+0x10/0x10
[40958.180702] kthread+0x10f/0x250
[40958.181238] ? __pfx_kthread+0x10/0x10
[40958.181774] ret_from_fork+0x251/0x2b0
[40958.182307] ? __pfx_kthread+0x10/0x10
[40958.182834] ret_from_fork_asm+0x1a/0x30
[40958.183370] </TASK>
Fix the error handling in the init_task to make sure the service and
mailbox tasks are disabled if the error happens during load. These are
started in idpf_vc_core_init(), which spawns the init_task and has no way
of knowing if it failed. If the error happens on reset, following
successful driver load, the tasks can still run, as that will allow the
netdevs to attempt recovery through another reset. Stop the PTP callbacks
either way as those will be restarted by the call to idpf_vc_core_init()
during a successful reset.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:18:37.672376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:15.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f32ae3cfc976074e9c5927893ce49bcf12f53748",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
},
{
"lessThan": "a514c374edcd33581cdcccf8faa7cc606a600319",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
},
{
"lessThan": "4d792219fe6f891b5b557a607ac8a0a14eda6e38",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix error handling in the init_task on load\n\nIf the init_task fails during a driver load, we end up without vports and\nnetdevs, effectively failing the entire process. In that state a\nsubsequent reset will result in a crash as the service task attempts to\naccess uninitialized resources. Following trace is from an error in the\ninit_task where the CREATE_VPORT (op 501) is rejected by the FW:\n\n[40922.763136] idpf 0000:83:00.0: Device HW Reset initiated\n[40924.449797] idpf 0000:83:00.0: Transaction failed (op 501)\n[40958.148190] idpf 0000:83:00.0: HW reset detected\n[40958.161202] BUG: kernel NULL pointer dereference, address: 00000000000000a8\n...\n[40958.168094] Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf]\n[40958.168865] RIP: 0010:idpf_vc_event_task+0x9b/0x350 [idpf]\n...\n[40958.177932] Call Trace:\n[40958.178491] \u003cTASK\u003e\n[40958.179040] process_one_work+0x226/0x6d0\n[40958.179609] worker_thread+0x19e/0x340\n[40958.180158] ? __pfx_worker_thread+0x10/0x10\n[40958.180702] kthread+0x10f/0x250\n[40958.181238] ? __pfx_kthread+0x10/0x10\n[40958.181774] ret_from_fork+0x251/0x2b0\n[40958.182307] ? __pfx_kthread+0x10/0x10\n[40958.182834] ret_from_fork_asm+0x1a/0x30\n[40958.183370] \u003c/TASK\u003e\n\nFix the error handling in the init_task to make sure the service and\nmailbox tasks are disabled if the error happens during load. These are\nstarted in idpf_vc_core_init(), which spawns the init_task and has no way\nof knowing if it failed. If the error happens on reset, following\nsuccessful driver load, the tasks can still run, as that will allow the\nnetdevs to attempt recovery through another reset. Stop the PTP callbacks\neither way as those will be restarted by the call to idpf_vc_core_init()\nduring a successful reset."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:51.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f32ae3cfc976074e9c5927893ce49bcf12f53748"
},
{
"url": "https://git.kernel.org/stable/c/a514c374edcd33581cdcccf8faa7cc606a600319"
},
{
"url": "https://git.kernel.org/stable/c/4d792219fe6f891b5b557a607ac8a0a14eda6e38"
}
],
"title": "idpf: fix error handling in the init_task on load",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23017",
"datePublished": "2026-01-31T11:39:01.204Z",
"dateReserved": "2026-01-13T15:37:45.940Z",
"dateUpdated": "2026-11-05T21:23:15.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39859 (GCVE-0-2025-39859)
Vulnerability from cvelistv5
Published
2025-09-19 15:26
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
The ptp_ocp_detach() only shuts down the watchdog timer if it is
pending. However, if the timer handler is already running, the
timer_delete_sync() is not called. This leads to race conditions
where the devlink that contains the ptp_ocp is deallocated while
the timer handler is still accessing it, resulting in use-after-free
bugs. The following details one of the race scenarios.
(thread 1) | (thread 2)
ptp_ocp_remove() |
ptp_ocp_detach() | ptp_ocp_watchdog()
if (timer_pending(&bp->watchdog))| bp = timer_container_of()
timer_delete_sync() |
|
devlink_free(devlink) //free |
| bp-> //use
Resolve this by unconditionally calling timer_delete_sync() to ensure
the timer is reliably deactivated, preventing any access after free.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-39859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T19:22:59.022358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T19:23:13.413Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ptp/ptp_ocp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a59822a762039b6e0252f21b091245d6ad7f324b",
"status": "affected",
"version": "773bda96492153e11d21eb63ac814669b51fc701",
"versionType": "git"
},
{
"lessThan": "e2a6eabe5304a789b7d40ce2576cd80154255e51",
"status": "affected",
"version": "773bda96492153e11d21eb63ac814669b51fc701",
"versionType": "git"
},
{
"lessThan": "aad70bdfc8244616e48c434310cab241a3f17781",
"status": "affected",
"version": "773bda96492153e11d21eb63ac814669b51fc701",
"versionType": "git"
},
{
"lessThan": "f10d3c7267ac7387a5129d5506c3c5f2460cfd9b",
"status": "affected",
"version": "773bda96492153e11d21eb63ac814669b51fc701",
"versionType": "git"
},
{
"lessThan": "8bf935cf789872350b04c1a6468b0a509f67afb2",
"status": "affected",
"version": "773bda96492153e11d21eb63ac814669b51fc701",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ptp/ptp_ocp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog\n\nThe ptp_ocp_detach() only shuts down the watchdog timer if it is\npending. However, if the timer handler is already running, the\ntimer_delete_sync() is not called. This leads to race conditions\nwhere the devlink that contains the ptp_ocp is deallocated while\nthe timer handler is still accessing it, resulting in use-after-free\nbugs. The following details one of the race scenarios.\n\n(thread 1) | (thread 2)\nptp_ocp_remove() |\n ptp_ocp_detach() | ptp_ocp_watchdog()\n if (timer_pending(\u0026bp-\u003ewatchdog))| bp = timer_container_of()\n timer_delete_sync() |\n |\n devlink_free(devlink) //free |\n | bp-\u003e //use\n\nResolve this by unconditionally calling timer_delete_sync() to ensure\nthe timer is reliably deactivated, preventing any access after free."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:34.215Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a59822a762039b6e0252f21b091245d6ad7f324b"
},
{
"url": "https://git.kernel.org/stable/c/e2a6eabe5304a789b7d40ce2576cd80154255e51"
},
{
"url": "https://git.kernel.org/stable/c/aad70bdfc8244616e48c434310cab241a3f17781"
},
{
"url": "https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b"
},
{
"url": "https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2"
}
],
"title": "ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39859",
"datePublished": "2025-09-19T15:26:29.717Z",
"dateReserved": "2025-04-16T07:20:57.143Z",
"dateUpdated": "2026-10-30T12:22:34.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74264 (GCVE-0-2026-74264)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: watchdog: fix refcount tracking races
Blamed commit converted the untracked dev_hold()/dev_put() calls
in the watchdog code to use the tracked dev_hold_track()/dev_put_track()
(which were later renamed/interfaced to netdev_hold() and netdev_put()).
By introducing dev->watchdog_dev_tracker to store the
reference tracking information without adding synchronization
between netdev_watchdog_up() and dev_watchdog(), it enabled the
race condition where this pointer could be overwritten or freed
concurrently, leading to the list corruption crash syzbot reported:
list_del corruption, ffff888114a18c00->next is NULL
kernel BUG at lib/list_debug.c:52 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: events_unbound linkwatch_event
RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52
Call Trace:
<TASK>
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:246 [inline]
list_move_tail include/linux/list.h:341 [inline]
ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329
netdev_tracker_free include/linux/netdevice.h:4491 [inline]
netdev_put include/linux/netdevice.h:4508 [inline]
netdev_put include/linux/netdevice.h:4504 [inline]
netdev_watchdog_down net/sched/sch_generic.c:600 [inline]
dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363
dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397
linkwatch_do_dev net/core/link_watch.c:184 [inline]
linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166
__linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240
linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314
process_scheduled_works kernel/workqueue.c:3397 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
This patch has three coordinated parts:
1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations.
2) Remove netdev_watchdog_up() call from netif_carrier_on():
This ensures netdev_watchdog_up() is only called from process/BH context
(via linkwatch workqueue dev_activate()), allowing us to use
spin_lock_bh() for synchronization.
3) Synchronize watchdog up and watchdog timer:
Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.
Only allocate a new tracker in netdev_watchdog_up() if one is
not already present.
In dev_watchdog(), ensure we don't release the tracker if the
timer was rescheduled either by dev_watchdog() itself or concurrently
by netdev_watchdog_up().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f12bf6f3f942b37de65eeea8be25903587fec930 Version: f12bf6f3f942b37de65eeea8be25903587fec930 Version: f12bf6f3f942b37de65eeea8be25903587fec930 Version: f12bf6f3f942b37de65eeea8be25903587fec930 Version: f12bf6f3f942b37de65eeea8be25903587fec930 Version: f12bf6f3f942b37de65eeea8be25903587fec930 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:40.430593Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:28.702Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/core/dev.c",
"net/sched/sch_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fbb8e79c117adcbfafef33b81d0db853b461bdac",
"status": "affected",
"version": "f12bf6f3f942b37de65eeea8be25903587fec930",
"versionType": "git"
},
{
"lessThan": "2fc2c92320272a99e18bbb102252859b6ee50881",
"status": "affected",
"version": "f12bf6f3f942b37de65eeea8be25903587fec930",
"versionType": "git"
},
{
"lessThan": "6b2330facc90e43b6d7171a0ac12c23dfcbdc30d",
"status": "affected",
"version": "f12bf6f3f942b37de65eeea8be25903587fec930",
"versionType": "git"
},
{
"lessThan": "446fe8ce699ce0a4d702f7b0fcdb50de340b9260",
"status": "affected",
"version": "f12bf6f3f942b37de65eeea8be25903587fec930",
"versionType": "git"
},
{
"lessThan": "7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9",
"status": "affected",
"version": "f12bf6f3f942b37de65eeea8be25903587fec930",
"versionType": "git"
},
{
"lessThan": "8eed5519e496b7a07f441a0f579cb228a33189f7",
"status": "affected",
"version": "f12bf6f3f942b37de65eeea8be25903587fec930",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/core/dev.c",
"net/sched/sch_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: watchdog: fix refcount tracking races\n\nBlamed commit converted the untracked dev_hold()/dev_put() calls\nin the watchdog code to use the tracked dev_hold_track()/dev_put_track()\n(which were later renamed/interfaced to netdev_hold() and netdev_put()).\n\nBy introducing dev-\u003ewatchdog_dev_tracker to store the\nreference tracking information without adding synchronization\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the\nrace condition where this pointer could be overwritten or freed\nconcurrently, leading to the list corruption crash syzbot reported:\n\nlist_del corruption, ffff888114a18c00-\u003enext is NULL\n kernel BUG at lib/list_debug.c:52 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\nWorkqueue: events_unbound linkwatch_event\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52\nCall Trace:\n \u003cTASK\u003e\n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:246 [inline]\n list_move_tail include/linux/list.h:341 [inline]\n ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329\n netdev_tracker_free include/linux/netdevice.h:4491 [inline]\n netdev_put include/linux/netdevice.h:4508 [inline]\n netdev_put include/linux/netdevice.h:4504 [inline]\n netdev_watchdog_down net/sched/sch_generic.c:600 [inline]\n dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363\n dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397\n linkwatch_do_dev net/core/link_watch.c:184 [inline]\n linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166\n __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240\n linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314\n process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314\n process_scheduled_works kernel/workqueue.c:3397 [inline]\n worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478\n kthread+0x370/0x450 kernel/kthread.c:436\n ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nThis patch has three coordinated parts:\n\n1) Add dev-\u003ewatchdog_lock and dev-\u003ewatchdog_ref_held to serialize watchdog operations.\n\n2) Remove netdev_watchdog_up() call from netif_carrier_on():\n This ensures netdev_watchdog_up() is only called from process/BH context\n (via linkwatch workqueue dev_activate()), allowing us to use\n spin_lock_bh() for synchronization.\n\n3) Synchronize watchdog up and watchdog timer:\n Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.\n Only allocate a new tracker in netdev_watchdog_up() if one is\n not already present.\n In dev_watchdog(), ensure we don\u0027t release the tracker if the\n timer was rescheduled either by dev_watchdog() itself or concurrently\n by netdev_watchdog_up()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in net/sched netdev watchdog refcount handling, reached via local carrier/linkwatch and rtnl-driven netdev lifecycle on TX-timeout-capable interfaces (virtio_net, Ethernet NICs), not by processing remote packets.\nAC:L - An attacker controls both sides of the race by concurrently driving carrier up/down transitions and TX watchdog timer expiry; syzbot reproduced this reliably without uncontrollable timing or layout dependencies.\nPR:L - Triggering netdev carrier activation/deactivation and watchdog setup on affected interfaces requires CAP_NET_ADMIN, obtainable by unprivileged users through user/network namespaces or as administrators in cloud VMs with virtio_net.\nUI:N - No victim interaction is required; exploitation needs only attacker-initiated interface churn and concurrent watchdog timer activity.\nS:U - Impact is kernel netdev refcount/tracker corruption within kernel memory; it does not by itself cross VM, container, or IOMMU security boundaries.\nC:H - Unsynchronized watchdog_dev_tracker allows concurrent free/overwrite (use-after-free/double-free) and ref_tracker list corruption, enabling arbitrary kernel memory disclosure.\nI:H - The same refcount/list corruption provides exploitable memory corruption primitives that can be leveraged for arbitrary kernel writes and privilege escalation.\nA:H - The vulnerability provokes kernel BUG/oops panics (demonstrated list_del corruption) and can be repeatedly triggered to crash or deny service via sustained carrier/watchdog races."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:34.809Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fbb8e79c117adcbfafef33b81d0db853b461bdac"
},
{
"url": "https://git.kernel.org/stable/c/2fc2c92320272a99e18bbb102252859b6ee50881"
},
{
"url": "https://git.kernel.org/stable/c/6b2330facc90e43b6d7171a0ac12c23dfcbdc30d"
},
{
"url": "https://git.kernel.org/stable/c/446fe8ce699ce0a4d702f7b0fcdb50de340b9260"
},
{
"url": "https://git.kernel.org/stable/c/7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9"
},
{
"url": "https://git.kernel.org/stable/c/8eed5519e496b7a07f441a0f579cb228a33189f7"
}
],
"title": "net: watchdog: fix refcount tracking races",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74264",
"datePublished": "2026-08-15T05:57:40.314Z",
"dateReserved": "2026-08-15T05:44:03.877Z",
"dateUpdated": "2026-10-30T12:29:34.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68295 (GCVE-0-2026-68295)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Zero-extend signed ALU32 div/mod results
ALU32 operations write a 32-bit result and leave the upper 32 bits of
the BPF register zero. The LoongArch JIT sign-extends the result of
signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient
or remainder leaves bits 63:32 set in JITted code while the verifier
and interpreter model those bits as zero.
Keep sign-extension on the operands, which signed divide needs, and
zero-extend the ALU32 result after the divide or modulo instruction,
matching the unsigned ALU32 div/mod paths and every other ALU32
operation in this JIT.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/loongarch/net/bpf_jit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7577cca85f2d4590c9d9423ba72ef54181a713c9",
"status": "affected",
"version": "2425c9e002d2a1fdca34261b2fa6713eafef2163",
"versionType": "git"
},
{
"lessThan": "16656c3d734693be3d8a36dbf9d09142b69f3ddc",
"status": "affected",
"version": "2425c9e002d2a1fdca34261b2fa6713eafef2163",
"versionType": "git"
},
{
"lessThan": "716cb29dbed4d62e9e108950a1a82bcba4cc2d45",
"status": "affected",
"version": "2425c9e002d2a1fdca34261b2fa6713eafef2163",
"versionType": "git"
},
{
"lessThan": "dacd348b8a993373576fe2ee2d8b114740ba57a6",
"status": "affected",
"version": "2425c9e002d2a1fdca34261b2fa6713eafef2163",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/loongarch/net/bpf_jit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Zero-extend signed ALU32 div/mod results\n\nALU32 operations write a 32-bit result and leave the upper 32 bits of\nthe BPF register zero. The LoongArch JIT sign-extends the result of\nsigned ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient\nor remainder leaves bits 63:32 set in JITted code while the verifier\nand interpreter model those bits as zero.\n\nKeep sign-extension on the operands, which signed divide needs, and\nzero-extend the ALU32 result after the divide or modulo instruction,\nmatching the unsigned ALU32 div/mod paths and every other ALU32\noperation in this JIT."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in the LoongArch eBPF JIT and is reached by loading a BPF program via the bpf(BPF_PROG_LOAD) syscall, which requires local access to the system. No network-facing path emits JITted signed ALU32 div/mod on behalf of a remote peer.\nAC:L - The attacker fully controls the BPF instruction sequence and the divisor/dividend, so producing a negative signed ALU32 quotient or remainder is deterministic and repeatable with no race, timing, or memory-layout dependency.\nPR:L - Loading an eBPF program requires only an unprivileged local user where unprivileged BPF is permitted, or CAP_BPF/CAP_SYS_ADMIN which is reachable via user namespaces on many deployments; no real root in the init namespace is needed.\nUI:N - The attacker loads and runs its own BPF program; no action by any other user or administrator is required at any point.\nS:U - The verifier bypass and resulting memory corruption stay within the kernel\u0027s own security authority on the same host, giving kernel-level privilege escalation rather than crossing a VM, IOMMU, or hypervisor boundary.\nC:H - The verifier models bits 63:32 of the ALU32 result as zero while the JIT leaves them set, so a later ALU64 shift lets the verifier conclude a register is constant zero when it is really 0xFFFFFFFF; using it as a pointer offset yields an attacker-controlled out-of-bounds read of arbitrary kernel memory.\nI:H - The same verifier/JIT range mismatch produces an out-of-bounds pointer that passes verification for stores as well as loads, giving an arbitrary kernel write primitive usable for control-flow hijacking and full privilege escalation.\nA:H - Out-of-bounds accesses through the mis-tracked register readily fault on unmapped or protected kernel addresses, causing an oops or panic, and the corruption can be repeated at will to bring the system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:47.769Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7577cca85f2d4590c9d9423ba72ef54181a713c9"
},
{
"url": "https://git.kernel.org/stable/c/16656c3d734693be3d8a36dbf9d09142b69f3ddc"
},
{
"url": "https://git.kernel.org/stable/c/716cb29dbed4d62e9e108950a1a82bcba4cc2d45"
},
{
"url": "https://git.kernel.org/stable/c/dacd348b8a993373576fe2ee2d8b114740ba57a6"
}
],
"title": "LoongArch: BPF: Zero-extend signed ALU32 div/mod results",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68295",
"datePublished": "2026-08-10T12:02:28.412Z",
"dateReserved": "2026-07-30T09:28:09.380Z",
"dateUpdated": "2026-10-21T12:43:47.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68383 (GCVE-0-2026-68383)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/guc: Keep scheduler timeline name alive
The scheduler keeps a pointer to the timeline name, but q->name
is freed with the exec queue while scheduler fences can still
reference it.
Store the name in struct xe_guc_exec_queue so it shares
the scheduler's RCU-deferred lifetime.
(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b17fcce70733c211cb5dabf54f4f9491920b1d92 Version: 6bd90e700b4285e6a7541e00f969cab0d696adde Version: 6bd90e700b4285e6a7541e00f969cab0d696adde Version: 6bd90e700b4285e6a7541e00f969cab0d696adde Version: ba37807d08bae67de6139346a85650cab5f6145a Version: 683b0e397dad9f26a42dcacf6f7f545a77ce6c06 Version: 6.12.43 ≤ Version: 6.15.11 ≤ Version: 6.16.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:46.046450Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:07.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_guc_exec_queue_types.h",
"drivers/gpu/drm/xe/xe_guc_submit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eac2839585741e6c1b4af261a0b58bca0d6f5436",
"status": "affected",
"version": "b17fcce70733c211cb5dabf54f4f9491920b1d92",
"versionType": "git"
},
{
"lessThan": "88c38ff74f8345fcf8852549f94025754019b037",
"status": "affected",
"version": "6bd90e700b4285e6a7541e00f969cab0d696adde",
"versionType": "git"
},
{
"lessThan": "77fd62412431e8c80ef2ad61466bc76fe425f80a",
"status": "affected",
"version": "6bd90e700b4285e6a7541e00f969cab0d696adde",
"versionType": "git"
},
{
"lessThan": "299bc6d50b1bed7d1f408391736712f01a0855e2",
"status": "affected",
"version": "6bd90e700b4285e6a7541e00f969cab0d696adde",
"versionType": "git"
},
{
"status": "affected",
"version": "ba37807d08bae67de6139346a85650cab5f6145a",
"versionType": "git"
},
{
"status": "affected",
"version": "683b0e397dad9f26a42dcacf6f7f545a77ce6c06",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_guc_exec_queue_types.h",
"drivers/gpu/drm/xe/xe_guc_submit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Keep scheduler timeline name alive\n\nThe scheduler keeps a pointer to the timeline name, but q-\u003ename\nis freed with the exec queue while scheduler fences can still\nreference it.\n\nStore the name in struct xe_guc_exec_queue so it shares\nthe scheduler\u0027s RCU-deferred lifetime.\n\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires ioctls on the local DRM render node (/dev/dri/renderD128) plus a sync_file fd held by the attacker\u0027s process; there is no remote or adjacent-network path into the xe exec-queue lifecycle.\nAC:L - No race is needed \u2014 once __xe_exec_queue_free() kfree()s the queue, sched-\u003ename is permanently dangling, so the attacker performs create-queue, export fence, destroy queue, groom the slab, then read, and can retry indefinitely.\nPR:L - XE_EXEC_QUEUE_CREATE/DESTROY, XE_EXEC, SYNCOBJ_EXPORT_SYNC_FILE and SYNC_IOC_FILE_INFO are all DRM_RENDER_ALLOW with no DRM_AUTH or capability gate, so any local user with render-node access (default for desktop sessions, Android/ChromeOS apps, GPU-passthrough containers) qualifies.\nUI:N - The attacker drives the whole sequence inside its own process using its own exec queue and its own exported fence; no victim action or configuration change is required.\nS:U - The use-after-free is on kernel slab memory and its impact stays inside the kernel\u0027s own security authority; no VM, IOMMU or hypervisor boundary is crossed.\nC:H - sync_fill_fence_info() strscpy()s from the freed q-\u003ename and copy_to_user()s the result, so after reallocating the freed xe_exec_queue slot the attacker reads back kernel heap contents (pointers, residual data) repeatably \u2014 a kernel memory disclosure primitive.\nI:H - This is a use-after-free on a kfree()d slab object whose contents the attacker grooms; the stale pointer is dereferenced as a string by kernel and tracepoint consumers, and UAF of an attacker-controllable slot is leverageable for corruption and control-flow influence.\nA:H - Dereferencing the dangling name pointer after the slab page is returned to the buddy allocator, or scanning for a NUL past the freed object, faults in kernel context and oopses the machine, which any unprivileged render-node user can trigger at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:54.357Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eac2839585741e6c1b4af261a0b58bca0d6f5436"
},
{
"url": "https://git.kernel.org/stable/c/88c38ff74f8345fcf8852549f94025754019b037"
},
{
"url": "https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a"
},
{
"url": "https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2"
}
],
"title": "drm/xe/guc: Keep scheduler timeline name alive",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68383",
"datePublished": "2026-08-10T12:04:02.230Z",
"dateReserved": "2026-07-30T09:28:09.387Z",
"dateUpdated": "2026-10-21T12:43:54.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46272 (GCVE-0-2026-46272)
Vulnerability from cvelistv5
Published
2026-06-03 15:50
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
coresight: tmc-etr: Fix race condition between sysfs and perf mode
When trying to run perf and sysfs mode simultaneously, the WARN_ON()
in tmc_etr_enable_hw() is triggered sometimes:
WARNING: CPU: 42 PID: 3911571 at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc]
[..snip..]
Call trace:
tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P)
tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L)
tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc]
coresight_enable_path+0x1c8/0x218 [coresight]
coresight_enable_sysfs+0xa4/0x228 [coresight]
enable_source_store+0x58/0xa8 [coresight]
dev_attr_store+0x20/0x40
sysfs_kf_write+0x4c/0x68
kernfs_fop_write_iter+0x120/0x1b8
vfs_write+0x2c8/0x388
ksys_write+0x74/0x108
__arm64_sys_write+0x24/0x38
el0_svc_common.constprop.0+0x64/0x148
do_el0_svc+0x24/0x38
el0_svc+0x3c/0x130
el0t_64_sync_handler+0xc8/0xd0
el0t_64_sync+0x1ac/0x1b0
---[ end trace 0000000000000000 ]---
Since the enablement of sysfs mode is separeted into two critical regions,
one for sysfs buffer allocation and another for hardware enablement, it's
possible to race with the perf mode. Fix this by double check whether
the perf mode's been used before enabling the hardware in sysfs mode.
mode:
[sysfs mode] [perf mode]
tmc_etr_get_sysfs_buffer()
spin_lock(&drvdata->spinlock)
[sysfs buffer allocation]
spin_unlock(&drvdata->spinlock)
spin_lock(&drvdata->spinlock)
tmc_etr_enable_hw()
drvdata->etr_buf = etr_perf->etr_buf
spin_unlock(&drvdata->spinlock)
spin_lock(&drvdata->spinlock)
tmc_etr_enable_hw()
WARN_ON(drvdata->etr_buf) // WARN sicne etr_buf initialized at
the perf side
spin_unlock(&drvdata->spinlock)
With this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf.
This ensures we verify whether the perf mode's already running before we
actually allocate the buffer. Then we can save the time of
allocating/freeing the sysfs buffer if race with the perf mode.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-tmc-etr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e8cdf184646c28c5ea5fba754d24a3b29068739",
"status": "affected",
"version": "296b01fd106e787d4463974a7f42d286a5df08cd",
"versionType": "git"
},
{
"lessThan": "206b6f672613d08b33e951a744d0a1c6ac5ad8ad",
"status": "affected",
"version": "296b01fd106e787d4463974a7f42d286a5df08cd",
"versionType": "git"
},
{
"lessThan": "38a07194bbcddb18d77dad40ba9978d994c0b74c",
"status": "affected",
"version": "296b01fd106e787d4463974a7f42d286a5df08cd",
"versionType": "git"
},
{
"lessThan": "6906aa70d4fc5900b954136e20e27c2be6d1acab",
"status": "affected",
"version": "296b01fd106e787d4463974a7f42d286a5df08cd",
"versionType": "git"
},
{
"lessThan": "e6e43e82c79c97917cbe356c07e8a6f3f982ab53",
"status": "affected",
"version": "296b01fd106e787d4463974a7f42d286a5df08cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-tmc-etr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: tmc-etr: Fix race condition between sysfs and perf mode\n\nWhen trying to run perf and sysfs mode simultaneously, the WARN_ON()\nin tmc_etr_enable_hw() is triggered sometimes:\n\n WARNING: CPU: 42 PID: 3911571 at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc]\n [..snip..]\n Call trace:\n tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc]\n coresight_enable_path+0x1c8/0x218 [coresight]\n coresight_enable_sysfs+0xa4/0x228 [coresight]\n enable_source_store+0x58/0xa8 [coresight]\n dev_attr_store+0x20/0x40\n sysfs_kf_write+0x4c/0x68\n kernfs_fop_write_iter+0x120/0x1b8\n vfs_write+0x2c8/0x388\n ksys_write+0x74/0x108\n __arm64_sys_write+0x24/0x38\n el0_svc_common.constprop.0+0x64/0x148\n do_el0_svc+0x24/0x38\n el0_svc+0x3c/0x130\n el0t_64_sync_handler+0xc8/0xd0\n el0t_64_sync+0x1ac/0x1b0\n ---[ end trace 0000000000000000 ]---\n\nSince the enablement of sysfs mode is separeted into two critical regions,\none for sysfs buffer allocation and another for hardware enablement, it\u0027s\npossible to race with the perf mode. Fix this by double check whether\nthe perf mode\u0027s been used before enabling the hardware in sysfs mode.\n\n mode:\n [sysfs mode] [perf mode]\n tmc_etr_get_sysfs_buffer()\n spin_lock(\u0026drvdata-\u003espinlock)\n [sysfs buffer allocation]\n spin_unlock(\u0026drvdata-\u003espinlock)\n spin_lock(\u0026drvdata-\u003espinlock)\n tmc_etr_enable_hw()\n drvdata-\u003eetr_buf = etr_perf-\u003eetr_buf\n spin_unlock(\u0026drvdata-\u003espinlock)\n spin_lock(\u0026drvdata-\u003espinlock)\n tmc_etr_enable_hw()\n WARN_ON(drvdata-\u003eetr_buf) // WARN sicne etr_buf initialized at\n the perf side\n spin_unlock(\u0026drvdata-\u003espinlock)\n\nWith this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf.\nThis ensures we verify whether the perf mode\u0027s already running before we\nactually allocate the buffer. Then we can save the time of\nallocating/freeing the sysfs buffer if race with the perf mode."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:33.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e8cdf184646c28c5ea5fba754d24a3b29068739"
},
{
"url": "https://git.kernel.org/stable/c/206b6f672613d08b33e951a744d0a1c6ac5ad8ad"
},
{
"url": "https://git.kernel.org/stable/c/38a07194bbcddb18d77dad40ba9978d994c0b74c"
},
{
"url": "https://git.kernel.org/stable/c/6906aa70d4fc5900b954136e20e27c2be6d1acab"
},
{
"url": "https://git.kernel.org/stable/c/e6e43e82c79c97917cbe356c07e8a6f3f982ab53"
}
],
"title": "coresight: tmc-etr: Fix race condition between sysfs and perf mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46272",
"datePublished": "2026-06-03T15:50:14.618Z",
"dateReserved": "2026-05-13T15:03:33.109Z",
"dateUpdated": "2026-10-21T12:41:33.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92503 (GCVE-0-2026-92503)
Vulnerability from cvelistv5
Published
2026-09-17 16:10
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
Syzbot/stress-ng reported an ABBA deadlock in ext4 when exercising
concurrent xattr workloads (using the ea_inode mount/format option).
The deadlock occurs between the running transaction and the eviction
thread:
- Task 1 (stress-ng): Holds a reference to a shared mbcache_entry (ce)
and calls ext4_xattr_inode_cache_find() -> ext4_iget() to retrieve
the corresponding EA inode. Since the EA inode is currently being
evicted, ext4_iget() blocks in __wait_on_freeing_inode() waiting for
eviction to complete.
- Task 2 (eviction thread): Currently evicting the same EA inode in
ext4_evict_ea_inode(). It calls mb_cache_entry_wait_unused(oe) which
blocks waiting for Task 1 to release the reference to the mbcache_entry.
To break this deadlock, implement a new ext4_iget() configuration flag
named EXT4_IGET_NOWAIT. When set, perform a non-blocking lookup of the
inode via VFS's find_inode_nowait() API.
If the inode is currently being evicted (marked with I_FREEING or
I_WILL_FREE) or created (I_CREATING), or if it is not present in the VFS
inode cache (cache miss), simply skip it (returning -ENOENT) rather than
waiting for eviction/creation to complete, breaking the ABBA cycle.
Since we return -ENOENT immediately on a cache miss, we never attempt to
allocate a new inode or call iget_locked(), completely eliminating any
TOCTOU race window.
If the returned inode is I_NEW, wait for its initialization to clear via
wait_on_new_inode(). If initialization fails and the inode is unhashed
during wait_on_new_inode() waking up (e.g., due to an I/O read error in
another thread), safely drop the reference and return -ENOENT. This
unhashed check is executed unconditionally on all cache-hit pathways to
properly handle concurrent initialization failures.
Finally, standard validation checks (including is_bad_inode,
EXT4_EA_INODE_FL, file_acl, and xattr flags) are executed as normal inside
check_igot_inode() to fully guarantee VFS-layer safety.
In ext4_xattr_inode_cache_find(), invoke ext4_iget() with the new
EXT4_IGET_NOWAIT flag to perform the non-blocking cache search.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0752e7fb549d90c33b4d4186f11cfd25a556d1dd Version: 737fb7853acd5bc8984f6f42e4bfba3334be8ae1 Version: 0a46ef234756dca04623b7591e8ebb3440622f0b Version: 0a46ef234756dca04623b7591e8ebb3440622f0b Version: 0a46ef234756dca04623b7591e8ebb3440622f0b Version: 0a46ef234756dca04623b7591e8ebb3440622f0b Version: 111103907234bffd0a34fba070ad9367de058752 Version: 6.1.107 ≤ Version: 6.6.47 ≤ Version: 6.9.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/inode.c",
"fs/ext4/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5e883ffe5230320060ea613a1acf750f3161c95",
"status": "affected",
"version": "0752e7fb549d90c33b4d4186f11cfd25a556d1dd",
"versionType": "git"
},
{
"lessThan": "29a2a166450a3e89f61a486033b10cf170fde8b0",
"status": "affected",
"version": "737fb7853acd5bc8984f6f42e4bfba3334be8ae1",
"versionType": "git"
},
{
"lessThan": "d3b19b318e0e0483180d15f1d9f5e807a1fb59d5",
"status": "affected",
"version": "0a46ef234756dca04623b7591e8ebb3440622f0b",
"versionType": "git"
},
{
"lessThan": "074d0620401974cbfa9b63684cdfae99c7b2059c",
"status": "affected",
"version": "0a46ef234756dca04623b7591e8ebb3440622f0b",
"versionType": "git"
},
{
"lessThan": "7720fddd1fe344d14be258a2028f74ebf1569511",
"status": "affected",
"version": "0a46ef234756dca04623b7591e8ebb3440622f0b",
"versionType": "git"
},
{
"lessThan": "03438084a7b8621fb5c762dd3d04cff5f2630fb2",
"status": "affected",
"version": "0a46ef234756dca04623b7591e8ebb3440622f0b",
"versionType": "git"
},
{
"status": "affected",
"version": "111103907234bffd0a34fba070ad9367de058752",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.107",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.47",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/inode.c",
"fs/ext4/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.107",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix ABBA deadlock in ext4_xattr_inode_cache_find()\n\nSyzbot/stress-ng reported an ABBA deadlock in ext4 when exercising\nconcurrent xattr workloads (using the ea_inode mount/format option).\n\nThe deadlock occurs between the running transaction and the eviction\nthread:\n- Task 1 (stress-ng): Holds a reference to a shared mbcache_entry (ce)\n and calls ext4_xattr_inode_cache_find() -\u003e ext4_iget() to retrieve\n the corresponding EA inode. Since the EA inode is currently being\n evicted, ext4_iget() blocks in __wait_on_freeing_inode() waiting for\n eviction to complete.\n- Task 2 (eviction thread): Currently evicting the same EA inode in\n ext4_evict_ea_inode(). It calls mb_cache_entry_wait_unused(oe) which\n blocks waiting for Task 1 to release the reference to the mbcache_entry.\n\nTo break this deadlock, implement a new ext4_iget() configuration flag\nnamed EXT4_IGET_NOWAIT. When set, perform a non-blocking lookup of the\ninode via VFS\u0027s find_inode_nowait() API.\n\nIf the inode is currently being evicted (marked with I_FREEING or\nI_WILL_FREE) or created (I_CREATING), or if it is not present in the VFS\ninode cache (cache miss), simply skip it (returning -ENOENT) rather than\nwaiting for eviction/creation to complete, breaking the ABBA cycle.\n\nSince we return -ENOENT immediately on a cache miss, we never attempt to\nallocate a new inode or call iget_locked(), completely eliminating any\nTOCTOU race window.\n\nIf the returned inode is I_NEW, wait for its initialization to clear via\nwait_on_new_inode(). If initialization fails and the inode is unhashed\nduring wait_on_new_inode() waking up (e.g., due to an I/O read error in\nanother thread), safely drop the reference and return -ENOENT. This\nunhashed check is executed unconditionally on all cache-hit pathways to\nproperly handle concurrent initialization failures.\n\nFinally, standard validation checks (including is_bad_inode,\nEXT4_EA_INODE_FL, file_acl, and xattr flags) are executed as normal inside\ncheck_igot_inode() to fully guarantee VFS-layer safety.\n\nIn ext4_xattr_inode_cache_find(), invoke ext4_iget() with the new\nEXT4_IGET_NOWAIT flag to perform the non-blocking cache search."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:43.123Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5e883ffe5230320060ea613a1acf750f3161c95"
},
{
"url": "https://git.kernel.org/stable/c/29a2a166450a3e89f61a486033b10cf170fde8b0"
},
{
"url": "https://git.kernel.org/stable/c/d3b19b318e0e0483180d15f1d9f5e807a1fb59d5"
},
{
"url": "https://git.kernel.org/stable/c/074d0620401974cbfa9b63684cdfae99c7b2059c"
},
{
"url": "https://git.kernel.org/stable/c/7720fddd1fe344d14be258a2028f74ebf1569511"
},
{
"url": "https://git.kernel.org/stable/c/03438084a7b8621fb5c762dd3d04cff5f2630fb2"
}
],
"title": "ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-92503",
"datePublished": "2026-09-17T16:10:16.062Z",
"dateReserved": "2026-09-16T12:21:13.872Z",
"dateUpdated": "2026-10-30T12:35:43.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99044 (GCVE-0-2026-99044)
Vulnerability from cvelistv5
Published
2026-10-23 12:22
Modified
2026-10-23 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix use-after-free in dynamic port cleanup
ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic
port from pf->dyn_ports. However, it frees the VSI before reading the
index for the erase, resulting in a use-after-free.
Follow the reverse of the allocation order in ice_alloc_dynamic_port()
by erasing the xarray entry before freeing the VSI.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/devlink/port.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c1344df1ae0579f57b97647e5203b06496ce10c",
"status": "affected",
"version": "eda69d654c7edae21312f731e0308941cb2ee2a9",
"versionType": "git"
},
{
"lessThan": "ca8a6285b11d01e5a279b1aa7fb55b1a02ecebb1",
"status": "affected",
"version": "eda69d654c7edae21312f731e0308941cb2ee2a9",
"versionType": "git"
},
{
"lessThan": "b98eb58ba2f8fe8e9bba1b8a3b94fa5602c6de84",
"status": "affected",
"version": "eda69d654c7edae21312f731e0308941cb2ee2a9",
"versionType": "git"
},
{
"lessThan": "1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff",
"status": "affected",
"version": "eda69d654c7edae21312f731e0308941cb2ee2a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/devlink/port.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix use-after-free in dynamic port cleanup\n\nice_dealloc_dynamic_port() uses dyn_port-\u003evsi-\u003eidx to erase the dynamic\nport from pf-\u003edyn_ports. However, it frees the VSI before reading the\nindex for the erase, resulting in a use-after-free.\n\nFollow the reverse of the allocation order in ice_alloc_dynamic_port()\nby erasing the xarray entry before freeing the VSI."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:22:08.328Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c1344df1ae0579f57b97647e5203b06496ce10c"
},
{
"url": "https://git.kernel.org/stable/c/ca8a6285b11d01e5a279b1aa7fb55b1a02ecebb1"
},
{
"url": "https://git.kernel.org/stable/c/b98eb58ba2f8fe8e9bba1b8a3b94fa5602c6de84"
},
{
"url": "https://git.kernel.org/stable/c/1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff"
}
],
"title": "ice: fix use-after-free in dynamic port cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99044",
"datePublished": "2026-10-23T12:22:08.328Z",
"dateReserved": "2026-09-25T10:25:14.387Z",
"dateUpdated": "2026-10-23T12:22:08.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90142 (GCVE-0-2026-90142)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix resize of the RX ring
When a AF_XDP socket is attached, the virtnet_rx_resize
should resize the rq->xsk_buffs XSK buffer array. Otherwise,
when the size grows, the virtnet_rx_resume() causes a write
past the end of the array. This is easily reproducable with
ethtool -G ens3 rx 32
./xdpsock -i eth0 -q 0 -r -z &
ethtool -G eth0 rx 256
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c941b5d989a15cdaa987a2c602fb168461c6186",
"status": "affected",
"version": "e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568",
"versionType": "git"
},
{
"lessThan": "5235abdb760bbd7a6fcecf1890b5160b7a75a9ce",
"status": "affected",
"version": "e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568",
"versionType": "git"
},
{
"lessThan": "8344c9233c8f77017174d9e280c5a26034d068b6",
"status": "affected",
"version": "e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568",
"versionType": "git"
},
{
"lessThan": "d09c98a6da215bce2173a292e4b95c8de6ea5d51",
"status": "affected",
"version": "e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix resize of the RX ring\n\nWhen a AF_XDP socket is attached, the virtnet_rx_resize\nshould resize the rq-\u003exsk_buffs XSK buffer array. Otherwise,\nwhen the size grows, the virtnet_rx_resume() causes a write\npast the end of the array. This is easily reproducable with\n\n ethtool -G ens3 rx 32\n ./xdpsock -i eth0 -q 0 -r -z \u0026\n ethtool -G eth0 rx 256"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow is driven by ring-\u003erx_pending passed to virtnet_set_ringparam() from SIOCETHTOOL ETHTOOL_SRINGPARAM (ethtool_set_ringparam) or ETHTOOL_MSG_RINGS_SET (ethnl_set_rings), after virtnet_xsk_pool_enable() sized rq-\u003exsk_buffs from AF_XDP bind(); received packets never supply the new vring length.\nAC:L - The reporter\u0027s sequence (ethtool -G rx 32, xdpsock -z, ethtool -G rx 256) deterministically grows the vring while leaving xsk_buffs at the old size; virtnet_rx_resume()-\u003etry_fill_recv()-\u003evirtnet_add_recvbuf_xsk() then passes rq-\u003evq-\u003enum_free to xsk_buff_alloc_batch(). The attacker controls both sizes and the UMEM fill ring; there is no race.\nPR:L - ETHTOOL_MSG_RINGS_SET is GENL_UNS_ADMIN_PERM (netlink_ns_capable CAP_NET_ADMIN) and the ioctl path checks ns_capable(net-\u003euser_ns, CAP_NET_ADMIN); AF_XDP socket() checks ns_capable(net-\u003euser_ns, CAP_NET_RAW) in xsk_create(). Both are available in a user-owned netns that holds the virtio_net device, not init-namespace root.\nUI:N - The attacker themselves issues the ethtool ring-resize ioctl/netlink and bind()s the AF_XDP zero-copy socket (xdpsock -z) that calls virtnet_xsk_pool_enable(); no separate victim action such as mounting media is required.\nS:U - virtnet_add_recvbuf_xsk() overflows rq-\u003exsk_buffs in the same kernel that hosts the virtio_net frontend. That is guest-kernel heap corruption, not a KVM/vhost guest-to-host escape or IOMMU bypass.\nC:H - After virtqueue_resize(), xsk_buff_alloc_batch() writes up to the new vring\u0027s num_free xdp_buff* values past the old xsk_buffs kvzalloc, corrupting adjacent heap objects with kernel pointers that can be turned into an arbitrary read.\nI:H - The same out-of-bounds xdp_buff* write, and the virtqueue_add_inbuf_premapped() loop that then consumes xsk_buffs[i] through that overflowed range, is kernel heap corruption usable for an arbitrary write or control-flow hijack.\nA:H - The heap overflow in virtnet_add_recvbuf_xsk() during virtnet_rx_resume() after virtqueue_resize() is a kernel memory-safety violation that oopses or panics even without a full exploit, matching the commit\u0027s write-past-end."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:02.541Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c941b5d989a15cdaa987a2c602fb168461c6186"
},
{
"url": "https://git.kernel.org/stable/c/5235abdb760bbd7a6fcecf1890b5160b7a75a9ce"
},
{
"url": "https://git.kernel.org/stable/c/8344c9233c8f77017174d9e280c5a26034d068b6"
},
{
"url": "https://git.kernel.org/stable/c/d09c98a6da215bce2173a292e4b95c8de6ea5d51"
}
],
"title": "virtio_net: Fix resize of the RX ring",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90142",
"datePublished": "2026-09-17T16:06:39.122Z",
"dateReserved": "2026-09-11T19:38:34.789Z",
"dateUpdated": "2026-10-21T12:50:02.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31579 (GCVE-0-2026-31579)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-11-05 21:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
wg_netns_pre_exit() manually acquires rtnl_lock() inside the
pernet .pre_exit callback. This causes a hung task when another
thread holds rtnl_mutex - the cleanup_net workqueue (or the
setup_net failure rollback path) blocks indefinitely in
wg_netns_pre_exit() waiting to acquire the lock.
Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net:
Add ->exit_rtnl() hook to struct pernet_operations."), where the
framework already holds RTNL and batches all callbacks under a
single rtnl_lock()/rtnl_unlock() pair, eliminating the contention
window.
The rcu_assign_pointer(wg->creating_net, NULL) is safe to move
from .pre_exit to .exit_rtnl (which runs after synchronize_rcu())
because all RCU readers of creating_net either use maybe_get_net()
- which returns NULL for a dying namespace with zero refcount - or
access net->user_ns which remains valid throughout the entire
ops_undo_list sequence.
[ Jason: added __net_exit and __read_mostly annotations that were missing. ]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 900575aa33a3eaaef802b31de187a85c4a4b4bd0 Version: 900575aa33a3eaaef802b31de187a85c4a4b4bd0 Version: 900575aa33a3eaaef802b31de187a85c4a4b4bd0 Version: 900575aa33a3eaaef802b31de187a85c4a4b4bd0 Version: 900575aa33a3eaaef802b31de187a85c4a4b4bd0 Version: 363cc6efdbb54bb06cd5034a69b41aae974a736f Version: 5.7.7 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:39:40.854579Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:45:09.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireguard/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "707607db2193591b68c0e70f814133472c185b1e",
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"versionType": "git"
},
{
"lessThan": "9a9e69155b2091b8297afaf1533b8d68a3096841",
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"versionType": "git"
},
{
"lessThan": "1c52ef00e391144334f10995985c2f256d4be982",
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"versionType": "git"
},
{
"lessThan": "a1d0f6cbb962af29586e3e65a4bced1a5e39221f",
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"versionType": "git"
},
{
"lessThan": "60a25ef8dacb3566b1a8c4de00572a498e2a3bf9",
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"versionType": "git"
},
{
"status": "affected",
"version": "363cc6efdbb54bb06cd5034a69b41aae974a736f",
"versionType": "git"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireguard/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback. This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd -\u003eexit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg-\u003ecreating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net-\u003euser_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:33.170Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"
},
{
"url": "https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"
},
{
"url": "https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"
},
{
"url": "https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"
},
{
"url": "https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"
}
],
"title": "wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31579",
"datePublished": "2026-04-24T14:42:10.208Z",
"dateReserved": "2026-03-09T15:48:24.119Z",
"dateUpdated": "2026-11-05T21:45:09.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93148 (GCVE-0-2026-93148)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject MEM_ALLOC BTF accesses past object bounds
BTF struct walks relax the struct-size check for accesses through a
trailing flexible array. That is valid for ordinary BTF type walking, but
PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static
BTF type size.
When walking a MEM_ALLOC object, reject the access before applying the
flexible-array relaxation if the access range extends past the struct size.
Apply the same policy to struct ID matching so kfunc and kptr type checks
do not walk past the allocated object bounds either.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h",
"kernel/bpf/btf.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94033c193bc38794511b2ebfa3dc0287d3b2bf60",
"status": "affected",
"version": "958cf2e273f0929c66169e0788031310e8118722",
"versionType": "git"
},
{
"lessThan": "90d36e825da4fadeede64784ceda975ab7b31dab",
"status": "affected",
"version": "958cf2e273f0929c66169e0788031310e8118722",
"versionType": "git"
},
{
"lessThan": "cf08ff2255de98cfcbc8bf7236fbeb38f0d5b4f1",
"status": "affected",
"version": "958cf2e273f0929c66169e0788031310e8118722",
"versionType": "git"
},
{
"lessThan": "e626a50d07d43421cbf7bfb5a084b33a5e276b6e",
"status": "affected",
"version": "958cf2e273f0929c66169e0788031310e8118722",
"versionType": "git"
},
{
"lessThan": "9c9ee0324c774490ae953162aaaf4561d222bd93",
"status": "affected",
"version": "958cf2e273f0929c66169e0788031310e8118722",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h",
"kernel/bpf/btf.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject MEM_ALLOC BTF accesses past object bounds\n\nBTF struct walks relax the struct-size check for accesses through a\ntrailing flexible array. That is valid for ordinary BTF type walking, but\nPTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static\nBTF type size.\n\nWhen walking a MEM_ALLOC object, reject the access before applying the\nflexible-array relaxation if the access range extends past the struct size.\nApply the same policy to struct ID matching so kfunc and kptr type checks\ndo not walk past the allocated object bounds either."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled input is program BTF (a struct whose last member is a 0-element array) plus LDX/STX offsets in bytecode that bpf_prog_load() copies from bpf(2) BPF_PROG_LOAD (__sys_bpf). bpf_check() then check_mem_access()-\u003echeck_ptr_to_btf_access()-\u003ebtf_struct_access()-\u003ebtf_struct_walk() on the bpf_obj_new PTR_TO_BTF_ID|MEM_ALLOC; no remote protocol carries that BTF or those offsets.\nAC:L - The attacker defines the local struct with a trailing nelems==0 array, calls bpf_obj_new (allocated at ret_t-\u003esize via bpf_mem_alloc(\u0026bpf_global_ma)), then LDX/STX at off past t-\u003esize. Pre-fix btf_struct_walk() applied the flexible-array relaxation whenever off+size \u003e t-\u003esize; no race or uninfluenced layout is required.\nPR:L - add_subprog_and_kfunc() returns -EPERM unless env-\u003ebpf_capable (bpf_token_capable(CAP_BPF)) because bpf_obj_new is a kfunc; check_ptr_to_btf_access() also needs bpf_allow_ptr_leaks() (CAP_PERFMON). BPF_PROG_TYPE_SYSCALL is not is_perfmon_prog_type(); bpf_token_capable() uses ns_capable() on a delegated token userns, not init-namespace root.\nUI:N - The attacker BPF_PROG_LOADs that program and runs it with BPF_PROG_TEST_RUN (bpf_prog_test_run_syscall) so bpf_obj_new() and the OOB LDX/STX execute in that same task. No other user must mount a filesystem, open a file, or otherwise cooperate.\nS:U - btf_struct_walk() approving the flexible-array access causes the JIT/interpreter to LDX/STX past the bpf_mem_alloc() object in bpf_global_ma in the same host kernel that loaded the program. That is in-kernel heap OOB and privilege escalation, not a KVM/Xen guest-to-host escape or IOMMU bypass.\nC:H - For a MEM_ALLOC object whose last BTF member is a 0-element int array, btf_struct_walk() returned WALK_SCALAR for any off past the FAM with no upper bound. bpf_convert_ctx_accesses() does not rewrite PTR_TO_BTF_ID|MEM_ALLOC to BPF_PROBE_MEM, so those LDXes are plain loads of adjacent bpf_mem_cache/kmalloc objects.\nI:H - check_ptr_to_btf_access() permits BPF_WRITE on type_is_ptr_alloc_obj() (PTR_TO_BTF_ID|MEM_ALLOC). The same FAM relaxation therefore approves STX past bpf_obj_new()\u0027s ret_t-\u003esize into the bpf_global_ma size-class unit (padding and the next object), a controllable kernel heap write. btf_struct_ids_match walking past those bounds can also mis-type kptr/kfunc pointers.\nA:H - Unbounded LDX/STX past the bpf_obj_new allocation in bpf_global_ma can corrupt adjacent bpf_mem_cache units or load unmapped addresses, oopsing or panicking the kernel when the program runs under bpf_prog_test_run_syscall, and the attacker can repeat that run at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:04.267Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94033c193bc38794511b2ebfa3dc0287d3b2bf60"
},
{
"url": "https://git.kernel.org/stable/c/90d36e825da4fadeede64784ceda975ab7b31dab"
},
{
"url": "https://git.kernel.org/stable/c/cf08ff2255de98cfcbc8bf7236fbeb38f0d5b4f1"
},
{
"url": "https://git.kernel.org/stable/c/e626a50d07d43421cbf7bfb5a084b33a5e276b6e"
},
{
"url": "https://git.kernel.org/stable/c/9c9ee0324c774490ae953162aaaf4561d222bd93"
}
],
"title": "bpf: Reject MEM_ALLOC BTF accesses past object bounds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93148",
"datePublished": "2026-09-17T16:11:45.457Z",
"dateReserved": "2026-09-17T16:02:15.088Z",
"dateUpdated": "2026-10-21T12:52:04.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99187 (GCVE-0-2026-99187)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix perf_pmu_migrate_context() leaving events behind
__perf_pmu_remove() walks the group leaders of a CPU and PMU with
perf_event_groups_for_cpu_pmu(), removing each one as it goes.
perf_remove_from_context() takes the leader out of the groups rbtree,
after which rb_next() on that node returns NULL, prematurely ending the
walk. Other groups stay behind in the source context.
On CPU hotplug, they are then torn down with the dying CPU. They keep
running until teardown, while the PMU's interrupt and migrated events
are on a new CPU, which drivers rely on never happening.
Walk ctx->event_list instead and pick out the PMU's events by their
pmu_ctx.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3caf006eb731e88cbb33fb5b7d1f2fdb23712bc7",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
},
{
"lessThan": "d4002e954c612dfc7e3fb5549e4a188ea281fe35",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
},
{
"lessThan": "3eb08f09bfb364051f51316da873c3bd51a839ef",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
},
{
"lessThan": "f5f0028764de322a3d04eda0d3b6389ca9847446",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
},
{
"lessThan": "e76b36b4be7160eaa14b416681e548b125702395",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pmu_migrate_context() leaving events behind\n\n__perf_pmu_remove() walks the group leaders of a CPU and PMU with\nperf_event_groups_for_cpu_pmu(), removing each one as it goes.\nperf_remove_from_context() takes the leader out of the groups rbtree,\nafter which rb_next() on that node returns NULL, prematurely ending the\nwalk. Other groups stay behind in the source context.\n\nOn CPU hotplug, they are then torn down with the dying CPU. They keep\nrunning until teardown, while the PMU\u0027s interrupt and migrated events\nare on a new CPU, which drivers rely on never happening.\n\nWalk ctx-\u003eevent_list instead and pick out the PMU\u0027s events by their\npmu_ctx."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:46.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3caf006eb731e88cbb33fb5b7d1f2fdb23712bc7"
},
{
"url": "https://git.kernel.org/stable/c/d4002e954c612dfc7e3fb5549e4a188ea281fe35"
},
{
"url": "https://git.kernel.org/stable/c/3eb08f09bfb364051f51316da873c3bd51a839ef"
},
{
"url": "https://git.kernel.org/stable/c/f5f0028764de322a3d04eda0d3b6389ca9847446"
},
{
"url": "https://git.kernel.org/stable/c/e76b36b4be7160eaa14b416681e548b125702395"
}
],
"title": "perf: Fix perf_pmu_migrate_context() leaving events behind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99187",
"datePublished": "2026-10-28T10:35:44.813Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-30T12:42:46.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53284 (GCVE-0-2026-53284)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: only release the dirty pages io tree after successful writes
[WARNING]
With extra warning on dirty extent buffers at umount (aka, the next
patch in the series), test case generic/388 can trigger the following
warning about dirty extent buffers at unmount time:
BTRFS critical (device dm-2 state E): emergency shutdown
BTRFS error (device dm-2 state E): error while writing out transaction: -30
BTRFS warning (device dm-2 state E): Skipping commit of aborted transaction.
BTRFS error (device dm-2 state EA): Transaction 9 aborted (error -30)
BTRFS: error (device dm-2 state EA) in cleanup_transaction:2068: errno=-30 Readonly filesystem
BTRFS info (device dm-2 state EA): forced readonly
BTRFS info (device dm-2 state EA): last unmount of filesystem 4fbf2e15-f941-49a0-bc7c-716315d2777c
------------[ cut here ]------------
WARNING: disk-io.c:3311 at invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs], CPU#8: umount/914368
CPU: 8 UID: 0 PID: 914368 Comm: umount Tainted: G OE 7.1.0-rc1-custom+ #372 PREEMPT(full) 2de38db8d1deae71fde295430a0ff3ab98ccf596
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs]
Call Trace:
<TASK>
close_ctree+0x52e/0x574 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]
generic_shutdown_super+0x89/0x1a0
kill_anon_super+0x16/0x40
btrfs_kill_super+0x16/0x20 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]
deactivate_locked_super+0x2d/0xb0
cleanup_mnt+0xdc/0x140
task_work_run+0x5a/0xa0
exit_to_user_mode_loop+0x123/0x4b0
do_syscall_64+0x243/0x7c0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
---[ end trace 0000000000000000 ]---
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30539776 owner 9 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30621696 owner 257 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30638080 owner 258 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30654464 owner 7 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30703616 owner 2 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30720000 owner 10 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30736384 owner 4 gen 9 refs 2 flags 0x7
BTRFS warning (device dm-2 state EA): unable to release extent buffer 30752768 owner 11 gen 9 refs 2 flags 0x7
I'm using a stripped down version, which seems to trigger the warning
more reliably:
_fsstress_pid=""
workload()
{
dmesg -C
mkfs.btrfs -f -K $dev > /dev/null
echo 1 > /sys/kernel/debug/clear_warn_once
mount $dev $mnt
$fsstress -w -n 1024 -p 4 -d $mnt &
_fsstress_pid=$!
sleep 0
$godown $mnt
pkill --echo -PIPE fsstress > /dev/null
wait $_fsstress_pid
unset _fsstress_pid
umount $mnt
if dmesg | grep -q "WARNING"; then
fail
fi
}
for (( i = 0; i < $runtime; i++ )); do
echo "=== $i/$runtime ==="
workload
done
[CAUSE]
Inside btrfs_write_and_wait_transaction(), we first try to write all
dirty ebs, then wait for them to finish.
After that we call btrfs_extent_io_tree_release() to free all
extent states from dirty_pages io tree.
However if we hit an error from btrfs_write_marked_extent(), then we
still call btrfs_extent_io_tree_release() to clear that dirty_pages io
tree, which may contain dirty records that we haven't yet submitted.
Furthermore, the later transaction cleanup path will utilize that
dirty_pages io tree to properly cleanup those dirty ebs, but since it's
already empty, no dirty ebs are properly cleaned up, thus will later
trigger the warnings inside invalidate_btree_folios().
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 663dfbb07774e0fe1049e8db3054a08500122f18 Version: 663dfbb07774e0fe1049e8db3054a08500122f18 Version: 663dfbb07774e0fe1049e8db3054a08500122f18 Version: 663dfbb07774e0fe1049e8db3054a08500122f18 Version: 663dfbb07774e0fe1049e8db3054a08500122f18 Version: 663dfbb07774e0fe1049e8db3054a08500122f18 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/disk-io.c",
"fs/btrfs/transaction.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff49321d29770e2d41bec65b43099997af5d2eaa",
"status": "affected",
"version": "663dfbb07774e0fe1049e8db3054a08500122f18",
"versionType": "git"
},
{
"lessThan": "7107b047e709ad258f7c29a342266a8e3653f370",
"status": "affected",
"version": "663dfbb07774e0fe1049e8db3054a08500122f18",
"versionType": "git"
},
{
"lessThan": "d915195c2f57794ed8ec4bf131bcead4b5dc29c1",
"status": "affected",
"version": "663dfbb07774e0fe1049e8db3054a08500122f18",
"versionType": "git"
},
{
"lessThan": "9ebb7eba1237dc198768b9c76506a79f924c82bb",
"status": "affected",
"version": "663dfbb07774e0fe1049e8db3054a08500122f18",
"versionType": "git"
},
{
"lessThan": "df03d67dc63722845cb9fe59d815d1225b04fd54",
"status": "affected",
"version": "663dfbb07774e0fe1049e8db3054a08500122f18",
"versionType": "git"
},
{
"lessThan": "4066c55e109475a06d18a1f127c939d551211956",
"status": "affected",
"version": "663dfbb07774e0fe1049e8db3054a08500122f18",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/disk-io.c",
"fs/btrfs/transaction.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: only release the dirty pages io tree after successful writes\n\n[WARNING]\nWith extra warning on dirty extent buffers at umount (aka, the next\npatch in the series), test case generic/388 can trigger the following\nwarning about dirty extent buffers at unmount time:\n\n BTRFS critical (device dm-2 state E): emergency shutdown\n BTRFS error (device dm-2 state E): error while writing out transaction: -30\n BTRFS warning (device dm-2 state E): Skipping commit of aborted transaction.\n BTRFS error (device dm-2 state EA): Transaction 9 aborted (error -30)\n BTRFS: error (device dm-2 state EA) in cleanup_transaction:2068: errno=-30 Readonly filesystem\n BTRFS info (device dm-2 state EA): forced readonly\n BTRFS info (device dm-2 state EA): last unmount of filesystem 4fbf2e15-f941-49a0-bc7c-716315d2777c\n ------------[ cut here ]------------\n WARNING: disk-io.c:3311 at invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs], CPU#8: umount/914368\n CPU: 8 UID: 0 PID: 914368 Comm: umount Tainted: G OE 7.1.0-rc1-custom+ #372 PREEMPT(full) 2de38db8d1deae71fde295430a0ff3ab98ccf596\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n RIP: 0010:invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs]\n Call Trace:\n \u003cTASK\u003e\n close_ctree+0x52e/0x574 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]\n generic_shutdown_super+0x89/0x1a0\n kill_anon_super+0x16/0x40\n btrfs_kill_super+0x16/0x20 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]\n deactivate_locked_super+0x2d/0xb0\n cleanup_mnt+0xdc/0x140\n task_work_run+0x5a/0xa0\n exit_to_user_mode_loop+0x123/0x4b0\n do_syscall_64+0x243/0x7c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30539776 owner 9 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30621696 owner 257 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30638080 owner 258 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30654464 owner 7 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30703616 owner 2 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30720000 owner 10 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30736384 owner 4 gen 9 refs 2 flags 0x7\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30752768 owner 11 gen 9 refs 2 flags 0x7\n\nI\u0027m using a stripped down version, which seems to trigger the warning\nmore reliably:\n\n _fsstress_pid=\"\"\n workload()\n {\n \tdmesg -C\n \tmkfs.btrfs -f -K $dev \u003e /dev/null\n \techo 1 \u003e /sys/kernel/debug/clear_warn_once\n \tmount $dev $mnt\n \t$fsstress -w -n 1024 -p 4 -d $mnt \u0026\n \t_fsstress_pid=$!\n \tsleep 0\n \t$godown $mnt\n \tpkill --echo -PIPE fsstress \u003e /dev/null\n \twait $_fsstress_pid\n \tunset _fsstress_pid\n \tumount $mnt\n\n \tif dmesg | grep -q \"WARNING\"; then\n \t\tfail\n \tfi\n }\n\n for (( i = 0; i \u003c $runtime; i++ )); do\n \techo \"=== $i/$runtime ===\"\n \tworkload\n done\n\n[CAUSE]\nInside btrfs_write_and_wait_transaction(), we first try to write all\ndirty ebs, then wait for them to finish.\n\nAfter that we call btrfs_extent_io_tree_release() to free all\nextent states from dirty_pages io tree.\n\nHowever if we hit an error from btrfs_write_marked_extent(), then we\nstill call btrfs_extent_io_tree_release() to clear that dirty_pages io\ntree, which may contain dirty records that we haven\u0027t yet submitted.\n\nFurthermore, the later transaction cleanup path will utilize that\ndirty_pages io tree to properly cleanup those dirty ebs, but since it\u0027s\nalready empty, no dirty ebs are properly cleaned up, thus will later\ntrigger the warnings inside invalidate_btree_folios().\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A writable Btrfs filesystem can be driven remotely when exported through kernel network file services such as nfsd or ksmbd, whose COMMIT/FLUSH/write-sync paths call VFS fsync and reach Btrfs transaction commit. This is a reasonable high-impact deployment for Btrfs-backed NAS or server shares.\nAC:L - The attacker can create dirty Btrfs metadata and force commits/syncs through normal file operations; in the highest reasonable scenario, storage/writeback failure can be induced by exhausting thin or shared backing storage. No race or precise memory layout is required.\nPR:N - There is no Btrfs capability check on the vulnerable transaction writeback path, and a remotely writable NFS/SMB export can expose it without local kernel privileges. Choosing the higher-severity case, an accessible writable export/guest-style share requires no privileges on the target host.\nUI:N - Exploitation is driven by attacker-controlled file operations and sync/flush requests. No victim user action is required beyond the system already serving or mounting the Btrfs filesystem.\nS:U - The impact remains within the kernel/filesystem security authority. It does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug prematurely drops dirty extent tracking and prevents proper cleanup; it is not a use-after-free, out-of-bounds read, or information disclosure primitive. The investigated impact does not expose kernel or filesystem data to the attacker.\nI:N - The defect does not provide an arbitrary write or controlled data modification primitive. Any failed or late metadata write is part of transaction abort/cleanup behavior rather than attacker-controlled integrity compromise.\nA:H - Leftover dirty extent buffers can later be written back during teardown after workers are stopped, leading to NULL pointer dereferences or kernel warnings/panic conditions. This can crash the kernel or make the filesystem unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:54.710Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff49321d29770e2d41bec65b43099997af5d2eaa"
},
{
"url": "https://git.kernel.org/stable/c/7107b047e709ad258f7c29a342266a8e3653f370"
},
{
"url": "https://git.kernel.org/stable/c/d915195c2f57794ed8ec4bf131bcead4b5dc29c1"
},
{
"url": "https://git.kernel.org/stable/c/9ebb7eba1237dc198768b9c76506a79f924c82bb"
},
{
"url": "https://git.kernel.org/stable/c/df03d67dc63722845cb9fe59d815d1225b04fd54"
},
{
"url": "https://git.kernel.org/stable/c/4066c55e109475a06d18a1f127c939d551211956"
}
],
"title": "btrfs: only release the dirty pages io tree after successful writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53284",
"datePublished": "2026-06-26T19:40:45.444Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-10-30T12:26:54.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90324 (GCVE-0-2026-90324)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ublk: check import_ubuf() return value
import_ubuf() can fail if the address range (provided by the userspace
ublk server) is outside the allowed user address space. Return that 0
bytes were copied if import_ubuf() fails rather than passing an
uninitialized struct iov_iter to ublk_copy_user_pages().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/ublk_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7f97c762b5f6e0005c5c7d040ded73bf7fb3587e",
"status": "affected",
"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648",
"versionType": "git"
},
{
"lessThan": "27ff6e8703f7a7160c728501da2f8ef8e7bb6b2f",
"status": "affected",
"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648",
"versionType": "git"
},
{
"lessThan": "0121c84adb6a4cd6f7560b5895bd88f9899bbc1f",
"status": "affected",
"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648",
"versionType": "git"
},
{
"lessThan": "5ac6019cb78e98c9608fda72726b36ddf8474dd7",
"status": "affected",
"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648",
"versionType": "git"
},
{
"lessThan": "3831568792af75b6523fa93bb91560e29189cf55",
"status": "affected",
"version": "981f95a571e3ca20a496c0b77dbf6b06039c6648",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/ublk_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nublk: check import_ubuf() return value\n\nimport_ubuf() can fail if the address range (provided by the userspace\nublk server) is outside the allowed user address space. Return that 0\nbytes were copied if import_ubuf() fails rather than passing an\nuninitialized struct iov_iter to ublk_copy_user_pages()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad pointer is io-\u003ebuf.addr from ublksrv_io_cmd.addr in ublk_ch_uring_cmd_local() on UBLK_IO_FETCH_REQ, UBLK_IO_COMMIT_AND_FETCH_REQ, or UBLK_IO_NEED_GET_DATA against /dev/ublkcN. import_ubuf() in ublk_map_io()/ublk_unmap_io() is handed that local userspace address; no network protocol carries it.\nAC:L - The ublk server chooses the FETCH/COMMIT buffer address. A non-zero kernel or wrap-around address fails access_ok() in import_ubuf() on every call (ublk_check_fetch_buf() only rejects addr==0). ublk_map_io()/ublk_unmap_io() then pass the uninitialized iov_iter to ublk_copy_user_pages() with no race or victim state.\nPR:L - ublk_ctrl_add_dev() lets a caller without CAP_SYS_ADMIN create a UBLK_F_UNPRIVILEGED_DEV device, and those devices cannot set UBLK_F_USER_COPY, UBLK_F_SUPPORT_ZERO_COPY, or UBLK_F_AUTO_BUF_REG, so ublk_need_map_io() is always true. ublk_ch_open() has no capability check; ublk_open() allows the owner to issue I/O to /dev/ublkbN.\nUI:N - The attacking process itself issues UBLK_CMD_ADD_DEV and UBLK_CMD_START_DEV on /dev/ublk-control, UBLK_IO_FETCH_REQ with the bad addr on /dev/ublkcN, then read/write on its own ublkb disk so ublk_queue_rq() \u2192 ublk_cmd_tw_cb() \u2192 ublk_dispatch_req() runs. No other user must mount or open anything.\nS:U - ublk_copy_user_pages() copies between the ublk request bio pages and the confused iov_iter entirely inside the host kernel via _copy_to_iter()/_copy_from_iter(). This is local kernel memory corruption, not a VM, IOMMU, or hypervisor escape.\nC:H - On a READ, ublk_unmap_io() calls _copy_from_iter() with the uninitialized iov_iter. iterate_and_advance() may treat leftover iter_type as ITER_KVEC or ITER_BVEC, so memcpy_from_iter() copies kernel memory into the request bio pages, which the attacker then reads from /dev/ublkbN.\nI:H - On a WRITE, ublk_map_io() calls _copy_to_iter() with that uninitialized iter, so iterate_kvec()/memcpy_to_iter() can write the attacker-controlled ublkb write payload to leftover kernel pointers. Garbage iter_type is iov_iter type confusion and an arbitrary kernel write.\nA:H - iterate_kvec() loads p-\u003eiov_len from leftover kvec pointers and iterate_bvec() calls kmap_local_page() on leftover bv_page, either of which oopses. ublk_unmap_io() also hits WARN_ON_ONCE(!data_source) in _copy_from_iter() when the iter was left with data_source==0."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:58.953Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7f97c762b5f6e0005c5c7d040ded73bf7fb3587e"
},
{
"url": "https://git.kernel.org/stable/c/27ff6e8703f7a7160c728501da2f8ef8e7bb6b2f"
},
{
"url": "https://git.kernel.org/stable/c/0121c84adb6a4cd6f7560b5895bd88f9899bbc1f"
},
{
"url": "https://git.kernel.org/stable/c/5ac6019cb78e98c9608fda72726b36ddf8474dd7"
},
{
"url": "https://git.kernel.org/stable/c/3831568792af75b6523fa93bb91560e29189cf55"
}
],
"title": "ublk: check import_ubuf() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90324",
"datePublished": "2026-09-17T16:08:40.077Z",
"dateReserved": "2026-09-11T19:38:34.802Z",
"dateUpdated": "2026-10-21T12:50:58.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99206 (GCVE-0-2026-99206)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix race in discovery auth updates
Separate configfs opens can concurrently update the discovery AuthMethod
parameter. Both callers may free the same value in
iscsi_update_param_value(), causing a double-free.
Protect the lookup and replacement with the discovery TPG access lock,
as used by the other TPG configfs parameter updates.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "128dfa7a9b4b3c956e8ac04a169a7ba04960cd75",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "35f3eb8ba914cbe079faf8712101b94ce6b2d821",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "3b206898acaf40f87cf59e97e511a6b60aad9d5e",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "57b6ebcc83afb5338c561ff97ca85dc954a89136",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "083eea404d162c324456cf4ff9912fe8701d936b",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "9b07828b133b326cb4fb59f144ca37f8db535999",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "6caa2b3edb7da4f50a38e16561b75fcae21d4099",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "e15b81f602edbdee39c335546f25486a1747f3f0",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:55.447Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/128dfa7a9b4b3c956e8ac04a169a7ba04960cd75"
},
{
"url": "https://git.kernel.org/stable/c/35f3eb8ba914cbe079faf8712101b94ce6b2d821"
},
{
"url": "https://git.kernel.org/stable/c/3b206898acaf40f87cf59e97e511a6b60aad9d5e"
},
{
"url": "https://git.kernel.org/stable/c/57b6ebcc83afb5338c561ff97ca85dc954a89136"
},
{
"url": "https://git.kernel.org/stable/c/083eea404d162c324456cf4ff9912fe8701d936b"
},
{
"url": "https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999"
},
{
"url": "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099"
},
{
"url": "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"
}
],
"title": "scsi: target: iscsi: Fix race in discovery auth updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99206",
"datePublished": "2026-10-28T10:35:59.851Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-30T12:42:55.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98134 (GCVE-0-2026-98134)
Vulnerability from cvelistv5
Published
2026-09-25 10:36
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: check_cond_jmp_op(): properly infer if register is null
Nicholas Carlini reported a bug when verifier can incorrectly infer
that a pointer is non-null. The bug occurs when two pointers are
compared and one of them has a type w/o PTR_MAYBE_NULL flag,
but which allows a value to be NULL at runtime.
Here is an example:
// `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED
// `a` is 0 at runtime.
// `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL
void *a = bpf_rdonly_cast(0, 0);
int *b = bpf_map_lookup_elem(...);
if (a == b)
*b = 42; // verifier does not catch null pointer dereference
This happens because of a special case in check_cond_jmp_op(),
which attempts to strip PTR_MAYBE_NULL flags from pointer types,
when processing comparisons like `rA == rB`, if either rA or rB can't
be null.
The non-null property is derived based on the absence of
PTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient
for types like PTR_TO_MEM, as in the example.
This patch replaces type_may_be_null() call with reg_not_null(),
which contains an allowlist of types for which absence of
PTR_MAYBE_NULL actually means that the value can't be NULL at runtime.
At the moment, the list in the reg_not_null() omits two types for
which PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF.
In order to remain backward compatible, and assuming that only
comparison between pointers of the same type makes sense,
this commit extends reg_not_null(). W/o such an extension e.g.
verifier_jeq_infer_not_null/null_ptr_to_map_value fails.
reg_not_null() can be extended further, but I deem that out of scope
for the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID
checks in the check_cond_jmp_op() can be removed with migration to
reg_not_null(), but that is a behavioural change, as the special case
would start matching for PTR_TO_BTF_ID that is also is_trusted_reg().
I omit the behavioural change from this commit.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d51cd486930f5bcfd4b55d55ab8e47b03f93d2ed",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
},
{
"lessThan": "dfd8f8adda565e08c370c45cf9d6b2511ba9b5c6",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
},
{
"lessThan": "9bf96b4347f541604b3caadeabda0773d9ceaf2a",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
},
{
"lessThan": "b55c9f019e169ed0d01394f96e172286a8b21b99",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
},
{
"lessThan": "d3ef6c097ba078e1f8c7239d76a0ce8b61e75095",
"status": "affected",
"version": "befae75856ab406a3f3fab2aa2118cf3b2dfe3e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: check_cond_jmp_op(): properly infer if register is null\n\nNicholas Carlini reported a bug when verifier can incorrectly infer\nthat a pointer is non-null. The bug occurs when two pointers are\ncompared and one of them has a type w/o PTR_MAYBE_NULL flag,\nbut which allows a value to be NULL at runtime.\nHere is an example:\n\n // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED\n // `a` is 0 at runtime.\n // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL\n void *a = bpf_rdonly_cast(0, 0);\n int *b = bpf_map_lookup_elem(...);\n\n if (a == b)\n *b = 42; // verifier does not catch null pointer dereference\n\nThis happens because of a special case in check_cond_jmp_op(),\nwhich attempts to strip PTR_MAYBE_NULL flags from pointer types,\nwhen processing comparisons like `rA == rB`, if either rA or rB can\u0027t\nbe null.\n\nThe non-null property is derived based on the absence of\nPTR_MAYBE_NULL flag on rA\u0027s or rB\u0027s type. But that is not sufficient\nfor types like PTR_TO_MEM, as in the example.\n\nThis patch replaces type_may_be_null() call with reg_not_null(),\nwhich contains an allowlist of types for which absence of\nPTR_MAYBE_NULL actually means that the value can\u0027t be NULL at runtime.\n\nAt the moment, the list in the reg_not_null() omits two types for\nwhich PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF.\nIn order to remain backward compatible, and assuming that only\ncomparison between pointers of the same type makes sense,\nthis commit extends reg_not_null(). W/o such an extension e.g.\nverifier_jeq_infer_not_null/null_ptr_to_map_value fails.\n\nreg_not_null() can be extended further, but I deem that out of scope\nfor the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID\nchecks in the check_cond_jmp_op() can be removed with migration to\nreg_not_null(), but that is a behavioural change, as the special case\nwould start matching for PTR_TO_BTF_ID that is also is_trusted_reg().\nI omit the behavioural change from this commit."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:40.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d51cd486930f5bcfd4b55d55ab8e47b03f93d2ed"
},
{
"url": "https://git.kernel.org/stable/c/dfd8f8adda565e08c370c45cf9d6b2511ba9b5c6"
},
{
"url": "https://git.kernel.org/stable/c/9bf96b4347f541604b3caadeabda0773d9ceaf2a"
},
{
"url": "https://git.kernel.org/stable/c/b55c9f019e169ed0d01394f96e172286a8b21b99"
},
{
"url": "https://git.kernel.org/stable/c/d3ef6c097ba078e1f8c7239d76a0ce8b61e75095"
}
],
"title": "bpf: check_cond_jmp_op(): properly infer if register is null",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98134",
"datePublished": "2026-09-25T10:36:12.919Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-10-21T12:54:40.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99142 (GCVE-0-2026-99142)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Check operator stack capacity before pushing
predicate_parse() uses the first operator stack entry before processing
any opening parentheses. A push then increments top before writing.
The existing check still permits that write when top already points to
the last allocated entry, which can access beyond the operator stack.
Reject the push when top reaches the last allocated entry.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c43c41ec62ca54ae145aa4912c6692a26d625734",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "d6f0006f194db49c54117ae22146421da5a2ca59",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "a866a8a753922cdf7710b8eb3f686dc0efc06505",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "75e894f92417390f0ef44fd350f2d3634c784876",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "c47a7b11bcb3d45e29723afcf6336866476b1d08",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check operator stack capacity before pushing\n\npredicate_parse() uses the first operator stack entry before processing\nany opening parentheses. A push then increments top before writing.\nThe existing check still permits that write when top already points to\nthe last allocated entry, which can access beyond the operator stack.\n\nReject the push when top reaches the last allocated entry."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker supplies the malformed filter through PERF_EVENT_IOC_SET_FILTER; perf_event_set_filter() calls ftrace_profile_set_filter(), create_filter(), process_preds(), and the patched predicate_parse(), with no network input.\nAC:L - In an ipi_send_cpumask filter, an embedded newline makes parse_pred()-\u003ecpulist_parse() accept a CPUS{} prefix while calc_stack() counts later fake parentheses, deterministically making nr_parens too small without a race or external state.\nPR:L - An unprivileged process can open a self-targeted PERF_TYPE_TRACEPOINT counting event with exclude_kernel=1 and no PERF_SAMPLE_RAW: sys_perf_event_open() skips perf_allow_kernel(), and perf_trace_event_perm() returns before perf_allow_tracepoint().\nUI:N - The attacking process performs both perf_event_open() and PERF_EVENT_IOC_SET_FILTER itself; no victim must mount, open, or process anything.\nS:U - predicate_parse() corrupts the host kernel heap within the same kernel security authority; it does not cross a guest-host, IOMMU, or other security boundary.\nC:N - The faulty operation is write-only: *(++top) = invert can overwrite at most two adjacent 32-bit words, and this parsing path neither returns adjacent kernel memory nor supplies a demonstrated read primitive.\nI:H - Because op_stack has nr_parens integer slots, the pre-increment push can write one or two attacker-controlled 32-bit entries beyond the allocation, modifying an adjacent slab object.\nA:H - The out-of-bounds writes can corrupt a neighboring slab object or freelist state, causing a kernel oops or panic when the damaged object or cache entry is subsequently used."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:44.895Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c43c41ec62ca54ae145aa4912c6692a26d625734"
},
{
"url": "https://git.kernel.org/stable/c/d6f0006f194db49c54117ae22146421da5a2ca59"
},
{
"url": "https://git.kernel.org/stable/c/a866a8a753922cdf7710b8eb3f686dc0efc06505"
},
{
"url": "https://git.kernel.org/stable/c/75e894f92417390f0ef44fd350f2d3634c784876"
},
{
"url": "https://git.kernel.org/stable/c/c47a7b11bcb3d45e29723afcf6336866476b1d08"
}
],
"title": "tracing: Check operator stack capacity before pushing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99142",
"datePublished": "2026-10-28T10:34:53.839Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-31T12:43:44.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68241 (GCVE-0-2026-68241)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/mst: limit DP MST ESI service loop
The loop in intel_dp_check_mst_status() keeps servicing interrupts
originating from the sink without bound. Add an upper bound to the new
interrupts occurring during interrupt processing to not get stuck on
potentially stuck sink devices. Use arbitrary 32 tries to clear incoming
interrupts in one go.
Discovered using AI-assisted static analysis confirmed by Intel Product
Security.
Note: The condition likely pre-dates the commit in the Fixes: tag, but
this is about as far back as a backport has any chance of
succeeding. Before that, the retry had a goto.
(cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3c0ec2c2d5948356a22c8f1c08a8087b12a303e7 Version: 3c0ec2c2d5948356a22c8f1c08a8087b12a303e7 Version: 3c0ec2c2d5948356a22c8f1c08a8087b12a303e7 Version: 3c0ec2c2d5948356a22c8f1c08a8087b12a303e7 Version: 3c0ec2c2d5948356a22c8f1c08a8087b12a303e7 Version: 3c0ec2c2d5948356a22c8f1c08a8087b12a303e7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_dp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76a1817d31f1a01fc5d9de63cb219e2c10d40400",
"status": "affected",
"version": "3c0ec2c2d5948356a22c8f1c08a8087b12a303e7",
"versionType": "git"
},
{
"lessThan": "fae63319ad397666a9c56a17ea1047d2bf9a1e25",
"status": "affected",
"version": "3c0ec2c2d5948356a22c8f1c08a8087b12a303e7",
"versionType": "git"
},
{
"lessThan": "02ceba559412751106c0cfa5cbdb80db50303083",
"status": "affected",
"version": "3c0ec2c2d5948356a22c8f1c08a8087b12a303e7",
"versionType": "git"
},
{
"lessThan": "e3bcd3bf7eeca9570b9fa0b2f8a602c7bcc6b0d0",
"status": "affected",
"version": "3c0ec2c2d5948356a22c8f1c08a8087b12a303e7",
"versionType": "git"
},
{
"lessThan": "9061fbf2230b6fcef042a6f637beae57c2fc93a5",
"status": "affected",
"version": "3c0ec2c2d5948356a22c8f1c08a8087b12a303e7",
"versionType": "git"
},
{
"lessThan": "005771c18c5b2c98cb4e7517661aea460990fd3f",
"status": "affected",
"version": "3c0ec2c2d5948356a22c8f1c08a8087b12a303e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_dp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/mst: limit DP MST ESI service loop\n\nThe loop in intel_dp_check_mst_status() keeps servicing interrupts\noriginating from the sink without bound. Add an upper bound to the new\ninterrupts occurring during interrupt processing to not get stuck on\npotentially stuck sink devices. Use arbitrary 32 tries to clear incoming\ninterrupts in one go.\n\nDiscovered using AI-assisted static analysis confirmed by Intel Product\nSecurity.\n\nNote: The condition likely pre-dates the commit in the Fixes: tag, but\nthis is about as far back as a backport has any chance of\nsucceeding. Before that, the retry had a goto.\n\n(cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:12.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76a1817d31f1a01fc5d9de63cb219e2c10d40400"
},
{
"url": "https://git.kernel.org/stable/c/fae63319ad397666a9c56a17ea1047d2bf9a1e25"
},
{
"url": "https://git.kernel.org/stable/c/02ceba559412751106c0cfa5cbdb80db50303083"
},
{
"url": "https://git.kernel.org/stable/c/e3bcd3bf7eeca9570b9fa0b2f8a602c7bcc6b0d0"
},
{
"url": "https://git.kernel.org/stable/c/9061fbf2230b6fcef042a6f637beae57c2fc93a5"
},
{
"url": "https://git.kernel.org/stable/c/005771c18c5b2c98cb4e7517661aea460990fd3f"
}
],
"title": "drm/i915/mst: limit DP MST ESI service loop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68241",
"datePublished": "2026-08-10T12:01:07.103Z",
"dateReserved": "2026-07-30T09:28:09.377Z",
"dateUpdated": "2026-10-30T12:28:12.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97478 (GCVE-0-2026-97478)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virt: acrn: Fix irqfd use-after-free during eventfd shutdown
acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free
the same struct hsm_irqfd:
CPU0 CPU1
---- ----
eventfd_release()
wake_up_poll(EPOLLHUP)
hsm_irqfd_wakeup()
queue_work(&irqfd->shutdown)
acrn_irqfd_deassign()
hsm_irqfd_shutdown()
list_del_init()
eventfd_ctx_remove_wait_queue()
eventfd_ctx_put()
kfree(irqfd)
hsm_irqfd_shutdown_work()
container_of(work, ..., shutdown)
irqfd->vm <-- use-after-free
The deassign path freed the irqfd while a shutdown work item was
already queued by EPOLLHUP (or vice versa), so the work item could
resurrect a dangling pointer through container_of().
Switch to the lifetime model used by KVM irqfds:
- Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds
under irqfds_lock and queue the cleanup work.
- hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the
eventfd waitqueue entry, drops the eventfd reference and frees the
irqfd.
- A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()
ensures the cleanup work is queued at most once, no matter how many
of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to
call from the waitqueue callback, which runs with wqh->lock held and
IRQs disabled and therefore cannot take irqfds_lock.
- acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the
eventfd is fully detached on return. acrn_irqfd_deinit() deactivates
every irqfd, flushes the workqueue and only then destroys it, so no
path can queue_work() onto a torn-down workqueue.
- acrn_irqfd_assign() now installs the eventfd waitqueue entry and
publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is
never visible to deassign/deinit before its waitqueue entry is in
place, and any EPOLLHUP that fires in the assign window queues
cleanup work that blocks on irqfds_lock until publication is done.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/virt/acrn/irqfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dccf23a72a6c5ec8d9eab2a7f98e186af6eaff48",
"status": "affected",
"version": "aa3b483ff1d71c50b33db154048dff9a8f08ac71",
"versionType": "git"
},
{
"lessThan": "6e9e007ee1dfb54bc2d070550308077ec28dbaec",
"status": "affected",
"version": "aa3b483ff1d71c50b33db154048dff9a8f08ac71",
"versionType": "git"
},
{
"lessThan": "0e1152f689847b9db2f05454775d34610c1424c2",
"status": "affected",
"version": "aa3b483ff1d71c50b33db154048dff9a8f08ac71",
"versionType": "git"
},
{
"lessThan": "d8156aacfcabb81f52c20ef89094945434d08079",
"status": "affected",
"version": "aa3b483ff1d71c50b33db154048dff9a8f08ac71",
"versionType": "git"
},
{
"lessThan": "666c7f9e07925aa0863348f960e09bb89f8f05a3",
"status": "affected",
"version": "aa3b483ff1d71c50b33db154048dff9a8f08ac71",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/virt/acrn/irqfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: acrn: Fix irqfd use-after-free during eventfd shutdown\n\nacrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free\nthe same struct hsm_irqfd:\n\n CPU0 CPU1\n ---- ----\n eventfd_release()\n wake_up_poll(EPOLLHUP)\n hsm_irqfd_wakeup()\n queue_work(\u0026irqfd-\u003eshutdown)\n acrn_irqfd_deassign()\n hsm_irqfd_shutdown()\n list_del_init()\n eventfd_ctx_remove_wait_queue()\n eventfd_ctx_put()\n kfree(irqfd)\n hsm_irqfd_shutdown_work()\n container_of(work, ..., shutdown)\n irqfd-\u003evm \u003c-- use-after-free\n\nThe deassign path freed the irqfd while a shutdown work item was\nalready queued by EPOLLHUP (or vice versa), so the work item could\nresurrect a dangling pointer through container_of().\n\nSwitch to the lifetime model used by KVM irqfds:\n\n - Deassign/deinit only deactivate the irqfd: remove it from vm-\u003eirqfds\n under irqfds_lock and queue the cleanup work.\n - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the\n eventfd waitqueue entry, drops the eventfd reference and frees the\n irqfd.\n - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()\n ensures the cleanup work is queued at most once, no matter how many\n of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to\n call from the waitqueue callback, which runs with wqh-\u003elock held and\n IRQs disabled and therefore cannot take irqfds_lock.\n - acrn_irqfd_deassign() flushes vm-\u003eirqfd_wq before returning so the\n eventfd is fully detached on return. acrn_irqfd_deinit() deactivates\n every irqfd, flushes the workqueue and only then destroys it, so no\n path can queue_work() onto a torn-down workqueue.\n - acrn_irqfd_assign() now installs the eventfd waitqueue entry and\n publishes the irqfd to vm-\u003eirqfds under irqfds_lock, so the irqfd is\n never visible to deassign/deinit before its waitqueue entry is in\n place, and any EPOLLHUP that fires in the assign window queues\n cleanup work that blocks on irqfds_lock until publication is done."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached from ioctl(ACRN_IOCTL_IRQFD) on /dev/acrn_hsm: acrn_dev_ioctl() copy_from_user()s struct acrn_irqfd and calls acrn_irqfd_config() \u2192 acrn_irqfd_assign()/acrn_irqfd_deassign(), while close() of that eventfd hits eventfd_release() \u2192 hsm_irqfd_wakeup(). No remote protocol carries the fd, flags, or EPOLLHUP.\nAC:L - The attacker owns both sides: one thread ioctl(ACRN_IOCTL_IRQFD) with ACRN_IRQFD_FLAG_DEASSIGN so acrn_irqfd_deassign() \u2192 hsm_irqfd_shutdown() kfree()s the hsm_irqfd, while another close()s a dup of the same eventfd so eventfd_release() \u2192 wake_up_poll(EPOLLHUP) \u2192 hsm_irqfd_wakeup() queues hsm_irqfd_shutdown_work(); the window is retryable.\nPR:L - acrn_dev_open(), acrn_dev_ioctl() and acrn_irqfd_config() have no capable()/CAP_* gate; only /dev/acrn_hsm DAC applies. ACRN Service VM deployments grant that node to the deprivileged acrn-dm device-model account (as with /dev/kvm), so a local user with that fd can CREATE_VM and IRQFD without init-namespace root.\nUI:N - The attacker opens /dev/acrn_hsm, ioctl(ACRN_IOCTL_CREATE_VM) then ACRN_IOCTL_IRQFD assign, and races close() of its own eventfd against deassign (or acrn_dev_release() \u2192 acrn_irqfd_deinit()); no other user must mount, open, or click.\nS:U - hsm_irqfd_shutdown_work() uses the freed struct hsm_irqfd in the Service VM kernel that runs acrn_dev_ioctl(). The attacker is already a Service VM process issuing HSM ioctls, not a User VM guest crossing into the ACRN hypervisor, so impact stays in one kernel authority.\nC:H - After acrn_irqfd_deassign() kfree()s the hsm_irqfd, hsm_irqfd_shutdown_work() container_of()s the queued work_struct and reads irqfd-\u003evm (and later irqfd-\u003eeventfd) from the freed kmalloc object. Reclaiming that slot lets the attacker disclose reallocated kernel heap through those dangling loads.\nI:H - The same UAF lets hsm_irqfd_shutdown_work() mutex_lock(\u0026irqfd-\u003evm-\u003eirqfds_lock), list_del_init(\u0026irqfd-\u003elist) and eventfd_ctx_put(irqfd-\u003eeventfd) on attacker-reclaimed hsm_irqfd fields, which is an arbitrary write / wait-queue function-pointer hijack, plus a second kfree of the sprayed object.\nA:H - hsm_irqfd_shutdown_work() loading irqfd-\u003evm after hsm_irqfd_shutdown() kfree()s it oopses on a dangling pointer or corrupts the irqfds mutex/list; the EPOLLHUP work versus deassign kfree race in the commit is a Service VM kernel panic even without a successful spray."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:59.771Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dccf23a72a6c5ec8d9eab2a7f98e186af6eaff48"
},
{
"url": "https://git.kernel.org/stable/c/6e9e007ee1dfb54bc2d070550308077ec28dbaec"
},
{
"url": "https://git.kernel.org/stable/c/0e1152f689847b9db2f05454775d34610c1424c2"
},
{
"url": "https://git.kernel.org/stable/c/d8156aacfcabb81f52c20ef89094945434d08079"
},
{
"url": "https://git.kernel.org/stable/c/666c7f9e07925aa0863348f960e09bb89f8f05a3"
}
],
"title": "virt: acrn: Fix irqfd use-after-free during eventfd shutdown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97478",
"datePublished": "2026-09-24T16:04:20.263Z",
"dateReserved": "2026-09-24T16:01:01.149Z",
"dateUpdated": "2026-10-30T12:36:59.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90083 (GCVE-0-2026-90083)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ife: Only operate on Ethernet frames
act_ife encapsulates/decapsulates the original Ethernet header and uses
skb->dev->hard_header_len as the length of that header. That is only
correct for Ethernet devices: on a device where hard_header_len does not
match the L2 header that was actually pulled (PPP reports PPP_HDRLEN
while nothing is stripped on ingress), the ingress skb_push()/skb_pull()
use the wrong length and can hit skb_under_panic when headroom is tight.
IFE is Ethernet-only by design - it builds an outer ethhdr, rewrites
h_source/h_dest/h_proto, and calls eth_type_trans() on decode - so
instead of trying to make the offsets work for arbitrary link types,
simply drop packets that do not carry an Ethernet header.
Checking skb->dev->type alone is not enough. We have to cater for a
corner case where mirred can redirect an skb from a non-Ethernet device
to an Ethernet one, and skb->dev then says nothing about the framing the
skb actually has: an skb redirected from ppp0 reaches the target's ingress
hook with mac_len 0 and no Ethernet header at all. So at ingress also
require mac_len to be ETH_HLEN. On egress mac_len is not maintained, so
the device type is all we have; a bogus redirect there yields a malformed
frame rather than an out-of-bounds push, and it would be malformed with or
without IFE.
That corner case is not theoretical - redirecting from ppp0 into a veth
that has an ife encode action on its ingress hook panics without this
patch:
skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000
data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3
kernel BUG at net/core/skbuff.c:214!
Call Trace:
skb_push (net/core/skbuff.c:224 net/core/skbuff.c:2657)
tcf_ife_act (net/sched/act_ife.c:829 net/sched/act_ife.c:874)
tc_run (net/core/dev.c:4463)
netif_receive_skb (net/core/dev.c:6463 net/core/dev.c:6522)
tcf_mirred_to_dev (net/sched/act_mirred.c:248 net/sched/act_mirred.c:328)
tcf_mirred_act (net/sched/act_mirred.c:489)
tc_run (net/core/dev.c:4463)
process_backlog (net/core/dev.c:6728)
With Ethernet framing guaranteed, use ETH_HLEN instead of
hard_header_len.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 295a6e06d21e1f469c9f38b00125a13b60ad4e7c Version: 295a6e06d21e1f469c9f38b00125a13b60ad4e7c Version: 295a6e06d21e1f469c9f38b00125a13b60ad4e7c Version: 295a6e06d21e1f469c9f38b00125a13b60ad4e7c Version: 295a6e06d21e1f469c9f38b00125a13b60ad4e7c Version: 295a6e06d21e1f469c9f38b00125a13b60ad4e7c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ife/ife.c",
"net/sched/act_ife.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c07621770b04f19b67e3af4a24b4d447826fbdd",
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"versionType": "git"
},
{
"lessThan": "b951dd2fd5ede007474fc134ecb5639e1f86f5de",
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"versionType": "git"
},
{
"lessThan": "13dddf87a1f89557920f9b437a21ea0b7225f828",
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"versionType": "git"
},
{
"lessThan": "d218ea7df6eba076171f2d4897a429a31f2139f0",
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"versionType": "git"
},
{
"lessThan": "138b0054021fd7d57bc3eb68b3f4e2bcec037849",
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"versionType": "git"
},
{
"lessThan": "5b483f7791b079bb97d411f1066652ff659207ff",
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ife/ife.c",
"net/sched/act_ife.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Only operate on Ethernet frames\n\nact_ife encapsulates/decapsulates the original Ethernet header and uses\nskb-\u003edev-\u003ehard_header_len as the length of that header. That is only\ncorrect for Ethernet devices: on a device where hard_header_len does not\nmatch the L2 header that was actually pulled (PPP reports PPP_HDRLEN\nwhile nothing is stripped on ingress), the ingress skb_push()/skb_pull()\nuse the wrong length and can hit skb_under_panic when headroom is tight.\n\nIFE is Ethernet-only by design - it builds an outer ethhdr, rewrites\nh_source/h_dest/h_proto, and calls eth_type_trans() on decode - so\ninstead of trying to make the offsets work for arbitrary link types,\nsimply drop packets that do not carry an Ethernet header.\n\nChecking skb-\u003edev-\u003etype alone is not enough. We have to cater for a\ncorner case where mirred can redirect an skb from a non-Ethernet device\nto an Ethernet one, and skb-\u003edev then says nothing about the framing the\nskb actually has: an skb redirected from ppp0 reaches the target\u0027s ingress\nhook with mac_len 0 and no Ethernet header at all. So at ingress also\nrequire mac_len to be ETH_HLEN. On egress mac_len is not maintained, so\nthe device type is all we have; a bogus redirect there yields a malformed\nframe rather than an out-of-bounds push, and it would be malformed with or\nwithout IFE.\n\nThat corner case is not theoretical - redirecting from ppp0 into a veth\nthat has an ife encode action on its ingress hook panics without this\npatch:\n\n skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000\n data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3\n kernel BUG at net/core/skbuff.c:214!\n Call Trace:\n skb_push (net/core/skbuff.c:224 net/core/skbuff.c:2657)\n tcf_ife_act (net/sched/act_ife.c:829 net/sched/act_ife.c:874)\n tc_run (net/core/dev.c:4463)\n netif_receive_skb (net/core/dev.c:6463 net/core/dev.c:6522)\n tcf_mirred_to_dev (net/sched/act_mirred.c:248 net/sched/act_mirred.c:328)\n tcf_mirred_act (net/sched/act_mirred.c:489)\n tc_run (net/core/dev.c:4463)\n process_backlog (net/core/dev.c:6728)\n\nWith Ethernet framing guaranteed, use ETH_HLEN instead of\nhard_header_len."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:02.434Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c07621770b04f19b67e3af4a24b4d447826fbdd"
},
{
"url": "https://git.kernel.org/stable/c/b951dd2fd5ede007474fc134ecb5639e1f86f5de"
},
{
"url": "https://git.kernel.org/stable/c/13dddf87a1f89557920f9b437a21ea0b7225f828"
},
{
"url": "https://git.kernel.org/stable/c/d218ea7df6eba076171f2d4897a429a31f2139f0"
},
{
"url": "https://git.kernel.org/stable/c/138b0054021fd7d57bc3eb68b3f4e2bcec037849"
},
{
"url": "https://git.kernel.org/stable/c/5b483f7791b079bb97d411f1066652ff659207ff"
}
],
"title": "net/sched: act_ife: Only operate on Ethernet frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90083",
"datePublished": "2026-09-17T16:06:00.185Z",
"dateReserved": "2026-09-11T19:38:34.785Z",
"dateUpdated": "2026-10-30T12:34:02.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99175 (GCVE-0-2026-99175)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fsnotify: prevent mark additions during connector teardown
fsnotify_destroy_marks() keeps a reference to its current mark while it
drops conn->lock to destroy the mark. This stabilizes the forward-walk
cursor, but does not prevent a new mark from being inserted before it.
For example, an inotify watch re-added after IN_IGNORED sorts before the
old, detached mark for the same group. The walk can miss the replacement
and then detach the entire connector from the object.
The replacement is still on its group's marks_list and, for inotify, in
the watch IDR. The group mutex no longer protects the connector's object
from disappearing. An unprivileged fdinfo read racing the final detach
can consequently call igrab(NULL):
BUG: KASAN: null-ptr-deref in igrab+0x24/0x100
Write of size 4 at addr 0000000000000148
Call Trace:
igrab+0x24/0x100
inotify_show_fdinfo+0x1dc/0x5e0
seq_show+0x397/0x690
Set a DESTROYING flag under conn->lock before starting the walk, and
reject new marks on that connector with -ENOENT. The existing add-mark
error paths undo the temporary group-list entry and the backend's watch
allocation. Do not wait for teardown while holding the group mutex,
which the destroyer needs. Once the old connector is detached, an add
can install a fresh connector as before.
This closes the insertion race for all object types using the common
connector teardown, without changing the mark reference or SRCU lifetime
rules.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 Version: 6b3f05d24d355f50f3d9814304650fcab0efb482 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/notify/mark.c",
"include/linux/fsnotify_backend.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7def717c06aea7004905e4d1568c3691ef9825d",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "da2f9aa89ef1b1fe7a7c6e1a8ddacd9c975e86aa",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "587d80966dcce2824f13fd32dab83bf882acf66f",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "d28a460a2237220d9ccbdd3baac6eaead44e96cb",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "61133f15773b907bada651a02d9c6d38eae37c48",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "952501bfc6e5e654ac4a17ec9d90c1ec614bd9f1",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "472589eacdf10b5f9bd10b333957ed5291b2544b",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
},
{
"lessThan": "36ebddca56b9d8993d6dc984fdecc748ee1f5e06",
"status": "affected",
"version": "6b3f05d24d355f50f3d9814304650fcab0efb482",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/notify/mark.c",
"include/linux/fsnotify_backend.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: prevent mark additions during connector teardown\n\nfsnotify_destroy_marks() keeps a reference to its current mark while it\ndrops conn-\u003elock to destroy the mark. This stabilizes the forward-walk\ncursor, but does not prevent a new mark from being inserted before it.\nFor example, an inotify watch re-added after IN_IGNORED sorts before the\nold, detached mark for the same group. The walk can miss the replacement\nand then detach the entire connector from the object.\n\nThe replacement is still on its group\u0027s marks_list and, for inotify, in\nthe watch IDR. The group mutex no longer protects the connector\u0027s object\nfrom disappearing. An unprivileged fdinfo read racing the final detach\ncan consequently call igrab(NULL):\n\n BUG: KASAN: null-ptr-deref in igrab+0x24/0x100\n Write of size 4 at addr 0000000000000148\n Call Trace:\n igrab+0x24/0x100\n inotify_show_fdinfo+0x1dc/0x5e0\n seq_show+0x397/0x690\n\nSet a DESTROYING flag under conn-\u003elock before starting the walk, and\nreject new marks on that connector with -ENOENT. The existing add-mark\nerror paths undo the temporary group-list entry and the backend\u0027s watch\nallocation. Do not wait for teardown while holding the group mutex,\nwhich the destroyer needs. Once the old connector is detached, an add\ncan install a fresh connector as before.\n\nThis closes the insertion race for all object types using the common\nconnector teardown, without changing the mark reference or SRCU lifetime\nrules."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:39.046Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7def717c06aea7004905e4d1568c3691ef9825d"
},
{
"url": "https://git.kernel.org/stable/c/da2f9aa89ef1b1fe7a7c6e1a8ddacd9c975e86aa"
},
{
"url": "https://git.kernel.org/stable/c/587d80966dcce2824f13fd32dab83bf882acf66f"
},
{
"url": "https://git.kernel.org/stable/c/d28a460a2237220d9ccbdd3baac6eaead44e96cb"
},
{
"url": "https://git.kernel.org/stable/c/61133f15773b907bada651a02d9c6d38eae37c48"
},
{
"url": "https://git.kernel.org/stable/c/952501bfc6e5e654ac4a17ec9d90c1ec614bd9f1"
},
{
"url": "https://git.kernel.org/stable/c/472589eacdf10b5f9bd10b333957ed5291b2544b"
},
{
"url": "https://git.kernel.org/stable/c/36ebddca56b9d8993d6dc984fdecc748ee1f5e06"
}
],
"title": "fsnotify: prevent mark additions during connector teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99175",
"datePublished": "2026-10-28T10:35:29.760Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:39.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89788 (GCVE-0-2026-89788)
Vulnerability from cvelistv5
Published
2026-09-16 08:48
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
ksmbd_tree_conn_connect() publishes a new tree connection in
sess->tree_conns with a single reference and returns its pointer to
smb2_tree_connect(). The handler continues to initialize the object and
build the response after publication. A concurrent session logoff can
erase the connection and drop that reference, freeing the object while
the handler still uses it.
BUG: KASAN: slab-use-after-free in smb2_tree_connect+0xe3d/0xf90
smb2_tree_connect (fs/smb/server/smb2pdu.c:2872)
handle_ksmbd_work
process_one_work
worker_thread
kthread
After xa_store() succeeds, take a second reference before releasing
tree_conns_lock. The original reference belongs to the xarray entry and
the second belongs to the creating smb2_tree_connect() handler.
Keep the references balanced in every path:
- On normal exit or an error after publication, smb2_tree_connect()
drops its creator reference. Error cleanup also calls
ksmbd_tree_conn_disconnect(), which drops the xarray reference only if
it removes the exact entry.
- SMB2 TREE_DISCONNECT uses the same helper to remove the entry and drop
its xarray reference. The request's existing lookup reference remains
owned by the request and is released by the existing cleanup.
- Session LOGOFF removes each entry and drops its xarray reference. If
it wins the race, later cleanup sees that the entry is gone and does
not drop that reference again.
To enforce this ownership, claim the disconnected state and erase the
exact entry atomically under tree_conns_lock. This guarantees one drop
for the xarray reference and one drop by each in-flight user, regardless
of which teardown path wins. If logoff removes the entry before
initialization completes, fail the connect instead of marking the
detached object TREE_CONNECTED.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7b58ee8d0b91359554cf219cd4f33872ea2afd66 Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e Version: 33b235a6e6ebe0f05f3586a71e8d281d00f71e2e Version: dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c Version: 6.1.71 ≤ Version: 5.15.145 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/tree_connect.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "63f5939b50470ef4d245c16d2098376b952beb51",
"status": "affected",
"version": "7b58ee8d0b91359554cf219cd4f33872ea2afd66",
"versionType": "git"
},
{
"lessThan": "ca3a3984bf445aaec69f6937f11e560d4b849365",
"status": "affected",
"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
"versionType": "git"
},
{
"lessThan": "bd58a52738f7576ee5f5eb74243df13f902c8051",
"status": "affected",
"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
"versionType": "git"
},
{
"lessThan": "4e30fbd26e84efa2e5cbec4eb11e126ac0c79313",
"status": "affected",
"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
"versionType": "git"
},
{
"lessThan": "b5ec6c462aab1062cf5d1e667ba7c6442f737055",
"status": "affected",
"version": "33b235a6e6ebe0f05f3586a71e8d281d00f71e2e",
"versionType": "git"
},
{
"status": "affected",
"version": "dd45db4d9bbc8f122a9b4db5ce94ae29fcf03d3c",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/mgmt/tree_connect.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix tree connection use-after-free in smb2_tree_connect()\n\nksmbd_tree_conn_connect() publishes a new tree connection in\nsess-\u003etree_conns with a single reference and returns its pointer to\nsmb2_tree_connect(). The handler continues to initialize the object and\nbuild the response after publication. A concurrent session logoff can\nerase the connection and drop that reference, freeing the object while\nthe handler still uses it.\n\nBUG: KASAN: slab-use-after-free in smb2_tree_connect+0xe3d/0xf90\n smb2_tree_connect (fs/smb/server/smb2pdu.c:2872)\n handle_ksmbd_work\n process_one_work\n worker_thread\n kthread\n\nAfter xa_store() succeeds, take a second reference before releasing\ntree_conns_lock. The original reference belongs to the xarray entry and\nthe second belongs to the creating smb2_tree_connect() handler.\n\nKeep the references balanced in every path:\n\n- On normal exit or an error after publication, smb2_tree_connect()\n drops its creator reference. Error cleanup also calls\n ksmbd_tree_conn_disconnect(), which drops the xarray reference only if\n it removes the exact entry.\n- SMB2 TREE_DISCONNECT uses the same helper to remove the entry and drop\n its xarray reference. The request\u0027s existing lookup reference remains\n owned by the request and is released by the existing cleanup.\n- Session LOGOFF removes each entry and drops its xarray reference. If\n it wins the race, later cleanup sees that the entry is gone and does\n not drop that reference again.\n\nTo enforce this ownership, claim the disconnected state and erase the\nexact entry atomically under tree_conns_lock. This guarantees one drop\nfor the xarray reference and one drop by each in-flight user, regardless\nof which teardown path wins. If logoff removes the entry before\ninitialization completes, fail the connect instead of marking the\ndetached object TREE_CONNECTED."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the UAF is reached from remote SMB2 TREE_CONNECT racing SESSION_LOGOFF via ksmbd_conn_handler_loop() through handle_ksmbd_work(), smb2_tree_connect(), ksmbd_tree_conn_connect(), and ksmbd_tree_conn_session_logoff().\nAC:L - The attacker drives both sides by issuing concurrent SMB2 TREE_CONNECT and SESSION_LOGOFF on their own connections (SMB3 multi-channel or parallel ksmbd-io work items). After xa_store() the object has one xarray ref, so logoff can free it while the handler still uses it; no victim timing or rare kernel config is required.\nPR:N - TREE_CONNECT and LOGOFF need a valid SMB2 session, but ksmbd supports guest/anonymous users and guest-ok shares (including IPC$); guest session setup skips NTLMSSP password verification, so a reasonable NAS/IoT deployment lets an unauthenticated client reach this path.\nUI:N - No victim action is required; the attacker programmatically issues SESSION_SETUP, TREE_CONNECT, and LOGOFF on their own SMB connections to trigger the race.\nS:U - The UAF corrupts ksmbd/kernel heap on the SMB server host and can escalate privileges within that kernel; it does not cross a VM, guest-to-host, container, or IOMMU/DMA security boundary.\nC:H - Use-after-free of struct ksmbd_tree_connect and its share_conf pointer: after logoff kfree\u0027s the published object, smb2_tree_connect still reads share flags and fields, enabling arbitrary kernel disclosure via heap reuse.\nI:H - The handler writes t_state, maximal_access, and posix_extensions into the freed object after xa_store(); with heap spray this yields arbitrary kernel writes and control-flow hijacking, matching High integrity for tree_conn UAF.\nA:H - KASAN reports slab-use-after-free in smb2_tree_connect on the ksmbd-io worker; the dangling tree_conn pointer causes a kernel oops or panic and is repeatable by resending TREE_CONNECT concurrently with LOGOFF."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:01.334Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/63f5939b50470ef4d245c16d2098376b952beb51"
},
{
"url": "https://git.kernel.org/stable/c/ca3a3984bf445aaec69f6937f11e560d4b849365"
},
{
"url": "https://git.kernel.org/stable/c/bd58a52738f7576ee5f5eb74243df13f902c8051"
},
{
"url": "https://git.kernel.org/stable/c/4e30fbd26e84efa2e5cbec4eb11e126ac0c79313"
},
{
"url": "https://git.kernel.org/stable/c/b5ec6c462aab1062cf5d1e667ba7c6442f737055"
}
],
"title": "ksmbd: fix tree connection use-after-free in smb2_tree_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89788",
"datePublished": "2026-09-16T08:48:25.049Z",
"dateReserved": "2026-09-11T19:38:34.766Z",
"dateUpdated": "2026-10-30T12:33:01.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90263 (GCVE-0-2026-90263)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: check if root is readonly when setting posix acl
For a filesystem which has btrfs read-only property set to true, all
write operations including acl and xattr should be denied. However, acl
can still be set even if btrfs ro property is true.
This happens because no function on the set_acl code path checks the root
is readonly or not. It was checked in btrfs_setxattr_trans() but got
removed in commit 353c2ea735e4 ("btrfs: remove redundant readonly root
check in btrfs_setxattr_trans")
That commit didn't check if all the callers properly check the root's
read-only flag. A previous fix is commit b51111271b03 ("btrfs: check if
root is readonly while setting security xattr").
Always check if the root is read-only before performing the set acl
operation.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 353c2ea735e4b54fb6250861e67b51b1bcb47198 Version: 353c2ea735e4b54fb6250861e67b51b1bcb47198 Version: 353c2ea735e4b54fb6250861e67b51b1bcb47198 Version: 353c2ea735e4b54fb6250861e67b51b1bcb47198 Version: 353c2ea735e4b54fb6250861e67b51b1bcb47198 Version: 353c2ea735e4b54fb6250861e67b51b1bcb47198 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3e6b504a79d8e90bb7aa8a03a42dc2b51dcc4c4",
"status": "affected",
"version": "353c2ea735e4b54fb6250861e67b51b1bcb47198",
"versionType": "git"
},
{
"lessThan": "20b2c2f3316e82a76ae3358c0bd45824f50f3fd5",
"status": "affected",
"version": "353c2ea735e4b54fb6250861e67b51b1bcb47198",
"versionType": "git"
},
{
"lessThan": "dc3a6e90a0a6350a6d43fed9f005f54171809580",
"status": "affected",
"version": "353c2ea735e4b54fb6250861e67b51b1bcb47198",
"versionType": "git"
},
{
"lessThan": "ce8103676f4d4b13e1f087fcfb34f80774d30be2",
"status": "affected",
"version": "353c2ea735e4b54fb6250861e67b51b1bcb47198",
"versionType": "git"
},
{
"lessThan": "d5602f96ff1e266f069b4d0d94f441050e057e06",
"status": "affected",
"version": "353c2ea735e4b54fb6250861e67b51b1bcb47198",
"versionType": "git"
},
{
"lessThan": "01c2f41fc441f75b3f9326443372faceb1cb6638",
"status": "affected",
"version": "353c2ea735e4b54fb6250861e67b51b1bcb47198",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: check if root is readonly when setting posix acl\n\nFor a filesystem which has btrfs read-only property set to true, all\nwrite operations including acl and xattr should be denied. However, acl\ncan still be set even if btrfs ro property is true.\n\nThis happens because no function on the set_acl code path checks the root\nis readonly or not. It was checked in btrfs_setxattr_trans() but got\nremoved in commit 353c2ea735e4 (\"btrfs: remove redundant readonly root\ncheck in btrfs_setxattr_trans\")\n\nThat commit didn\u0027t check if all the callers properly check the root\u0027s\nread-only flag. A previous fix is commit b51111271b03 (\"btrfs: check if\nroot is readonly while setting security xattr\").\n\nAlways check if the root is read-only before performing the set acl\noperation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:58.242Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3e6b504a79d8e90bb7aa8a03a42dc2b51dcc4c4"
},
{
"url": "https://git.kernel.org/stable/c/20b2c2f3316e82a76ae3358c0bd45824f50f3fd5"
},
{
"url": "https://git.kernel.org/stable/c/dc3a6e90a0a6350a6d43fed9f005f54171809580"
},
{
"url": "https://git.kernel.org/stable/c/ce8103676f4d4b13e1f087fcfb34f80774d30be2"
},
{
"url": "https://git.kernel.org/stable/c/d5602f96ff1e266f069b4d0d94f441050e057e06"
},
{
"url": "https://git.kernel.org/stable/c/01c2f41fc441f75b3f9326443372faceb1cb6638"
}
],
"title": "btrfs: check if root is readonly when setting posix acl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90263",
"datePublished": "2026-09-17T16:08:00.085Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-30T12:34:58.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97962 (GCVE-0-2026-97962)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Move representor vnic reporter to eswitch devlink port
The representor vnic devlink health reporter is created and destroyed
along the representor netdev (un)load path, which is not serialized by
the devlink instance lock. Destroying the reporter from there triggers
a devl_assert_locked() splat on driver unbind:
WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758
Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ...
CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ...
RIP: 0010:devl_assert_locked+0x54/0x70
Call Trace:
<TASK>
devl_health_reporter_destroy+0x3a/0x1b0
mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core]
mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core]
? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core]
? kernfs_remove_by_name_ns+0xc3/0xf0
device_release_driver_internal+0x3b2/0x560
unbind_store+0xce/0xf0
Move the reporter's lifecycle to the eswitch devlink port (un)register
paths, which are already serialized by the devlink instance lock, and
store the handle on mlx5_devlink_port. Use the port's mlx5_vport as the
reporter priv since the diagnose callback only needs a device handle and
a vport number, and mlx5_vport carries both and is initialized before
any representor driver probes.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rep.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_rep.h",
"drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c",
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d552beb9d278aeb180d26c3889b6bd21444ad11e",
"status": "affected",
"version": "cf14af140a5ad0937d385ce693100f33f02e9c54",
"versionType": "git"
},
{
"lessThan": "fb52d58f7d6abc2f956d9c1ac472c709f7bb33c2",
"status": "affected",
"version": "cf14af140a5ad0937d385ce693100f33f02e9c54",
"versionType": "git"
},
{
"lessThan": "dcaba72c85c14fe7393a59d61695941e6ccbd7d7",
"status": "affected",
"version": "cf14af140a5ad0937d385ce693100f33f02e9c54",
"versionType": "git"
},
{
"lessThan": "d1fcff9b39bac188ef62a77ebd176484be928ec2",
"status": "affected",
"version": "cf14af140a5ad0937d385ce693100f33f02e9c54",
"versionType": "git"
},
{
"lessThan": "7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937",
"status": "affected",
"version": "cf14af140a5ad0937d385ce693100f33f02e9c54",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rep.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_rep.h",
"drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c",
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Move representor vnic reporter to eswitch devlink port\n\nThe representor vnic devlink health reporter is created and destroyed\nalong the representor netdev (un)load path, which is not serialized by\nthe devlink instance lock. Destroying the reporter from there triggers\na devl_assert_locked() splat on driver unbind:\n WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758\n Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ...\n CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT\n Tainted: [W]=WARN\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ...\n RIP: 0010:devl_assert_locked+0x54/0x70\n Call Trace:\n \u003cTASK\u003e\n devl_health_reporter_destroy+0x3a/0x1b0\n mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core]\n ? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core]\n ? kernfs_remove_by_name_ns+0xc3/0xf0\n device_release_driver_internal+0x3b2/0x560\n unbind_store+0xce/0xf0\n\nMove the reporter\u0027s lifecycle to the eswitch devlink port (un)register\npaths, which are already serialized by the devlink instance lock, and\nstore the handle on mlx5_devlink_port. Use the port\u0027s mlx5_vport as the\nreporter priv since the diagnose callback only needs a device handle and\na vport number, and mlx5_vport carries both and is initialized before\nany representor driver probes."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:53.121Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d552beb9d278aeb180d26c3889b6bd21444ad11e"
},
{
"url": "https://git.kernel.org/stable/c/fb52d58f7d6abc2f956d9c1ac472c709f7bb33c2"
},
{
"url": "https://git.kernel.org/stable/c/dcaba72c85c14fe7393a59d61695941e6ccbd7d7"
},
{
"url": "https://git.kernel.org/stable/c/d1fcff9b39bac188ef62a77ebd176484be928ec2"
},
{
"url": "https://git.kernel.org/stable/c/7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937"
}
],
"title": "net/mlx5e: Move representor vnic reporter to eswitch devlink port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97962",
"datePublished": "2026-09-25T10:23:06.150Z",
"dateReserved": "2026-09-25T10:18:58.206Z",
"dateUpdated": "2026-10-21T12:53:53.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99132 (GCVE-0-2026-99132)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous
xfs_trans_commit(), which flushes the CIL push workqueue internally.
If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to
lock these buffers to fail them, causing a deadlock:
setlabel: holds buf lock -> flush_workqueue(xfs-cil)
CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf)
Remove the xfs_trans_bhold() calls so that commit releases the buffer
locks normally. After the sync commit, re-acquire the buffers via
mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b Version: f7664b31975bd893190708e76b2c424328f0c49b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_rtgroup.h",
"fs/xfs/libxfs/xfs_sb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16468281da17263095bd1906cf2d16a972f10791",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "45f124f3902bfae6a366d124db04f707264176fb",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "d900946853c2d183fa0e199bae9ddbcd21795a18",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "83b2e511cf9ba22904b167e00fcbd85169b50b2c",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "acd7f2f9b822b6e126f3e3c99c173e62aa315b6f",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "e5456dec79c71c8ef8f9f9adb77d320f113b34db",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "6353e5cd8c43d6e805cacbfbfecf4103571a7ff8",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
},
{
"lessThan": "41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff",
"status": "affected",
"version": "f7664b31975bd893190708e76b2c424328f0c49b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_rtgroup.h",
"fs/xfs/libxfs/xfs_sb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don\u0027t hold buffer locks across sync transaction commit in xfs_sync_sb_buf\n\nxfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous\nxfs_trans_commit(), which flushes the CIL push workqueue internally.\nIf shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to\nlock these buffers to fail them, causing a deadlock:\n\n setlabel: holds buf lock -\u003e flush_workqueue(xfs-cil)\n CIL push worker: xfs_buf_item_unpin -\u003e xfs_buf_lock(same buf)\n\nRemove the xfs_trans_bhold() calls so that commit releases the buffer\nlocks normally. After the sync commit, re-acquire the buffers via\nmp-\u003em_sb_bp / mp-\u003em_rtsb_bp for the on-disk writeback."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:05.352Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16468281da17263095bd1906cf2d16a972f10791"
},
{
"url": "https://git.kernel.org/stable/c/45f124f3902bfae6a366d124db04f707264176fb"
},
{
"url": "https://git.kernel.org/stable/c/d900946853c2d183fa0e199bae9ddbcd21795a18"
},
{
"url": "https://git.kernel.org/stable/c/83b2e511cf9ba22904b167e00fcbd85169b50b2c"
},
{
"url": "https://git.kernel.org/stable/c/acd7f2f9b822b6e126f3e3c99c173e62aa315b6f"
},
{
"url": "https://git.kernel.org/stable/c/e5456dec79c71c8ef8f9f9adb77d320f113b34db"
},
{
"url": "https://git.kernel.org/stable/c/6353e5cd8c43d6e805cacbfbfecf4103571a7ff8"
},
{
"url": "https://git.kernel.org/stable/c/41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff"
}
],
"title": "xfs: don\u0027t hold buffer locks across sync transaction commit in xfs_sync_sb_buf",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99132",
"datePublished": "2026-10-28T10:34:45.756Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:05.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90105 (GCVE-0-2026-90105)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: fix reading neigh ha
Currently arp/neigh_reduce read neigh ha directly which can lead to
partial reads while the neigh is being updated. Use neigh_ha_snapshot to
take a stable snapshot of the address similar to route_shortcircuit which
already does the right thing.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e4f67addf158f98f8197e08974966b18480dc751 Version: e4f67addf158f98f8197e08974966b18480dc751 Version: e4f67addf158f98f8197e08974966b18480dc751 Version: e4f67addf158f98f8197e08974966b18480dc751 Version: e4f67addf158f98f8197e08974966b18480dc751 Version: e4f67addf158f98f8197e08974966b18480dc751 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1e86c5b4463178751a9fd3f0a3876a602dc360c",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "6093baf2b2c57e7da33bacd2223570a78b416d89",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "751cb520f9e47538b7223df133806a29fc41f54f",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "f43ef9a3f9c121472a0754c9e9bff13317ace0f7",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "ecc8bac11a101e5f6989a14b92e17b51f9761630",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "b824059a673b2283e78c7aae2c7d257aad7f0e1d",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: fix reading neigh ha\n\nCurrently arp/neigh_reduce read neigh ha directly which can lead to\npartial reads while the neigh is being updated. Use neigh_ha_snapshot to\ntake a stable snapshot of the address similar to route_shortcircuit which\nalready does the right thing."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:09.898Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1e86c5b4463178751a9fd3f0a3876a602dc360c"
},
{
"url": "https://git.kernel.org/stable/c/6093baf2b2c57e7da33bacd2223570a78b416d89"
},
{
"url": "https://git.kernel.org/stable/c/751cb520f9e47538b7223df133806a29fc41f54f"
},
{
"url": "https://git.kernel.org/stable/c/f43ef9a3f9c121472a0754c9e9bff13317ace0f7"
},
{
"url": "https://git.kernel.org/stable/c/ecc8bac11a101e5f6989a14b92e17b51f9761630"
},
{
"url": "https://git.kernel.org/stable/c/b824059a673b2283e78c7aae2c7d257aad7f0e1d"
}
],
"title": "vxlan: fix reading neigh ha",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90105",
"datePublished": "2026-09-17T16:06:14.829Z",
"dateReserved": "2026-09-11T19:38:34.786Z",
"dateUpdated": "2026-10-30T12:34:09.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68755 (GCVE-0-2025-68755)
Vulnerability from cvelistv5
Published
2026-01-05 09:32
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: most: remove broken i2c driver
The MOST I2C driver has been completely broken for five years without
anyone noticing so remove the driver from staging.
Specifically, commit 723de0f9171e ("staging: most: remove device from
interface structure") started requiring drivers to set the interface
device pointer before registration, but the I2C driver was never updated
which results in a NULL pointer dereference if anyone ever tries to
probe it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c Version: 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c Version: 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c Version: 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c Version: 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c Version: 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/most/Kconfig",
"drivers/staging/most/Makefile",
"drivers/staging/most/i2c/Kconfig",
"drivers/staging/most/i2c/Makefile",
"drivers/staging/most/i2c/i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4cb61138482dd0b7ba551037b61f5e50a889604",
"status": "affected",
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"versionType": "git"
},
{
"lessThan": "6cbba922934805f86eece6ba7010b7201962695d",
"status": "affected",
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"versionType": "git"
},
{
"lessThan": "10d50bc913b69fa18a5c6fbf293c7a87962e22ef",
"status": "affected",
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"versionType": "git"
},
{
"lessThan": "6059a66dba7f26b21852831432e17075f1a1c783",
"status": "affected",
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"versionType": "git"
},
{
"lessThan": "e463548fd80e779efea1cb2d3049b8a7231e6925",
"status": "affected",
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"versionType": "git"
},
{
"lessThan": "495df2da6944477d282d5cc0c13174d06e25b310",
"status": "affected",
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/most/Kconfig",
"drivers/staging/most/Makefile",
"drivers/staging/most/i2c/Kconfig",
"drivers/staging/most/i2c/Makefile",
"drivers/staging/most/i2c/i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: most: remove broken i2c driver\n\nThe MOST I2C driver has been completely broken for five years without\nanyone noticing so remove the driver from staging.\n\nSpecifically, commit 723de0f9171e (\"staging: most: remove device from\ninterface structure\") started requiring drivers to set the interface\ndevice pointer before registration, but the I2C driver was never updated\nwhich results in a NULL pointer dereference if anyone ever tries to\nprobe it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:19.033Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4cb61138482dd0b7ba551037b61f5e50a889604"
},
{
"url": "https://git.kernel.org/stable/c/6cbba922934805f86eece6ba7010b7201962695d"
},
{
"url": "https://git.kernel.org/stable/c/10d50bc913b69fa18a5c6fbf293c7a87962e22ef"
},
{
"url": "https://git.kernel.org/stable/c/6059a66dba7f26b21852831432e17075f1a1c783"
},
{
"url": "https://git.kernel.org/stable/c/e463548fd80e779efea1cb2d3049b8a7231e6925"
},
{
"url": "https://git.kernel.org/stable/c/495df2da6944477d282d5cc0c13174d06e25b310"
}
],
"title": "staging: most: remove broken i2c driver",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68755",
"datePublished": "2026-01-05T09:32:29.149Z",
"dateReserved": "2025-12-24T10:30:51.033Z",
"dateUpdated": "2026-10-30T12:23:19.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93181 (GCVE-0-2026-93181)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
In uncore_event_cpu_online(), uncore_box_ref() was called before
uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0,
but box->cpu is still -1 at that point because uncore_change_context()
has not run yet. As a result, the box is never initialized on the
first CPU to come online in a die, leaving it permanently
uninitialized in the single-CPU-per-die case.
Thus, box->refcnt is one count below the true value, and in the CPU
offline path, the box will be torn down on the second-to-last CPU.
In uncore_event_cpu_offline(), uncore_box_unref() was called after
uncore_change_context(), so box->cpu is already -1 when the collector
CPU goes offline, which prevents it from tearing down the box.
Fix by swapping the call order in both paths so that
uncore_box_{ref,unref}() runs at the point where box->cpu reflects
the correct context.
Move allocate_boxes() out of uncore_box_ref() to enable this
reordering.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/events/intel/uncore.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cfd351602e6704cce9bc766a974afb9f745d44b",
"status": "affected",
"version": "c74443d92f68f07c03ae242ced554b749e6c6736",
"versionType": "git"
},
{
"lessThan": "64aa1bb4017d598828c6d8cd718f43daf2a83375",
"status": "affected",
"version": "c74443d92f68f07c03ae242ced554b749e6c6736",
"versionType": "git"
},
{
"lessThan": "174f0582e38abe03b88e15f04bfe58490f88cb19",
"status": "affected",
"version": "c74443d92f68f07c03ae242ced554b749e6c6736",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/events/intel/uncore.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Fix uncore_box ref/unref ordering\n\nIn uncore_event_cpu_online(), uncore_box_ref() was called before\nuncore_change_context(). uncore_box_ref() gates on box-\u003ecpu \u003e= 0,\nbut box-\u003ecpu is still -1 at that point because uncore_change_context()\nhas not run yet. As a result, the box is never initialized on the\nfirst CPU to come online in a die, leaving it permanently\nuninitialized in the single-CPU-per-die case.\n\nThus, box-\u003erefcnt is one count below the true value, and in the CPU\noffline path, the box will be torn down on the second-to-last CPU.\n\nIn uncore_event_cpu_offline(), uncore_box_unref() was called after\nuncore_change_context(), so box-\u003ecpu is already -1 when the collector\nCPU goes offline, which prevents it from tearing down the box.\n\nFix by swapping the call order in both paths so that\nuncore_box_{ref,unref}() runs at the point where box-\u003ecpu reflects\nthe correct context.\n\nMove allocate_boxes() out of uncore_box_ref() to enable this\nreordering."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:12.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cfd351602e6704cce9bc766a974afb9f745d44b"
},
{
"url": "https://git.kernel.org/stable/c/64aa1bb4017d598828c6d8cd718f43daf2a83375"
},
{
"url": "https://git.kernel.org/stable/c/174f0582e38abe03b88e15f04bfe58490f88cb19"
}
],
"title": "perf/x86/intel/uncore: Fix uncore_box ref/unref ordering",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93181",
"datePublished": "2026-09-17T16:12:08.716Z",
"dateReserved": "2026-09-17T16:02:15.091Z",
"dateUpdated": "2026-10-21T12:52:12.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72098 (GCVE-0-2026-72098)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: fix buffer overflow in FEC calculation
There's a buffer overflow in dm-verity-fec:
if (neras && *neras <= v->fec->roots)
fio->erasures[(*neras)++] = i;
This allows *neras to reach roots + 1 (the post-increment pushes it past
roots). This value is then passed as no_eras to decode_rs8(). Inside the
RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator
polynomial loop writes lambda[j] where j can reach nroots + 1 — one
element past the end of lambda[] (which is sized nroots + 1, valid
indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting
the syndrome buffer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:49.534768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:27.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c",
"drivers/md/dm-verity-fec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "84d4d2a6988c9a733f7821452cefb5b0d93de2d1",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "374775626c327aec2425c16b4d36706e5f8718b8",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "5488d3a69d205e28f74f18857b853aa12e778e66",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "f7990c2b0f08b8841fcd2652d1d7002f5994a7a7",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "31d6e6c0ba8d5a7bd59660035a089307100c5e8e",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c",
"drivers/md/dm-verity-fec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere\u0027s a buffer overflow in dm-verity-fec:\n\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\n\tfio-\u003eerasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 \u2014 one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In cloud/network-boot deployments where dm-verity data, hash, or FEC backing devices are served over NBD/iSCSI/TCP, a remote block provider can supply crafted blocks that drive the FEC erasure-correction path during ordinary read I/O through verity_map without local code execution.\nAC:L - A crafted backing image or malicious network-block responses can deterministically produce at least fec_roots+1 hash-mismatched or failed message blocks in one RS group, reliably reaching the off-by-one no_eras path on the second FEC decode attempt after verification failure.\nPR:N - Triggering requires only read I/O against an active dm-verity+FEC mapping; a remote NBD/iSCSI peer needs no account or privileges on the victim host, and unprivileged local processes with read access to the mapped device or filesystem can also reach the vulnerable FEC path.\nUI:N - Exploitation is driven by automatic boot-time reads, udev probing, or ordinary filesystem I/O on the dm-verity device; no specific victim action beyond normal system operation is required once corruption is present.\nS:U - The overflow corrupts kernel heap Reed-Solomon scratch buffers during dm-verity verification within the same kernel security authority; it does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - The inflated no_eras value causes decode_rs8 to XOR-write one uint16 past lambda[] into syn[0], corrupting adjacent kernel decoder state; such heap out-of-bounds writes can be leveraged for arbitrary memory disclosure.\nI:H - The same out-of-bounds write in the erasure-locator loop corrupts syndrome buffers later used to modify decoded message bytes, providing a heap memory-corruption primitive that can enable arbitrary kernel writes or control-flow hijacking.\nA:H - Corrupting Reed-Solomon decoder state during dm-verity verification can cause kernel oops, panics, or hung I/O on critical read-only partitions (notably Android/embedded systems with FEC enabled), denying availability of the device or entire system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:46.939Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/84d4d2a6988c9a733f7821452cefb5b0d93de2d1"
},
{
"url": "https://git.kernel.org/stable/c/374775626c327aec2425c16b4d36706e5f8718b8"
},
{
"url": "https://git.kernel.org/stable/c/dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc"
},
{
"url": "https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66"
},
{
"url": "https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7"
},
{
"url": "https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e"
}
],
"title": "dm-verity: fix buffer overflow in FEC calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72098",
"datePublished": "2026-08-15T05:52:43.666Z",
"dateReserved": "2026-08-09T03:40:39.905Z",
"dateUpdated": "2026-10-30T12:28:46.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64024 (GCVE-0-2026-64024)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
Blamed commit moved the TIME_WAIT-derived ISN from the skb control
block to a per-CPU variable, assuming the value would always be consumed
by tcp_conn_request() for the same packet that wrote it. That assumption
is violated by multiple drop paths between the producer
(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer
(tcp_conn_request()):
- min_ttl / min_hopcount check
- xfrm policy check
- tcp_inbound_hash() MD5/AO mismatch
- tcp_filter() eBPF/SO_ATTACH_FILTER drop
- th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
- psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
- tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
- tcp_v{4,6}_cookie_check() returning NULL
When a packet is dropped on any of these paths, tcp_tw_isn is left set.
The next SYN processed on the same CPU then consumes the non zero value in
tcp_conn_request(), receiving a potentially predictable ISN.
This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu
variable.
Note that tcp_v{4,6}_fill_cb() do not set it.
Very litle impact on overall code size/complexity:
$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new
add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)
Function old new delta
tcp_v6_rcv 3038 3042 +4
tcp_v4_rcv 3035 3039 +4
tcp_conn_request 2938 2923 -15
Total: Before=24436060, After=24436053, chg -0.00%
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64024",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:24.819208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/tcp.h",
"net/ipv4/tcp.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8bb6aa419b142dcc2680177ecc39c4c38db7fc16",
"status": "affected",
"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
"versionType": "git"
},
{
"lessThan": "e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd",
"status": "affected",
"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
"versionType": "git"
},
{
"lessThan": "4affe063fa56c880cbea8d0bfded0bb80751579d",
"status": "affected",
"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
"versionType": "git"
},
{
"lessThan": "1bbf0ced1d9db73ac7893c2187f3459288603e0d",
"status": "affected",
"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/tcp.h",
"net/ipv4/tcp.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n\n - min_ttl / min_hopcount check\n - xfrm policy check\n - tcp_inbound_hash() MD5/AO mismatch\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\n - th-\u003esyn \u0026\u0026 th-\u003efin discard in tcp_rcv_state_process() TCP_LISTEN\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n - tcp_v{4,6}_cookie_check() returning NULL\n\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\n\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\n\nThis patch moves back tcp_tw_isn to skb-\u003ecb[], getting rid of the per-cpu\nvariable.\n\nNote that tcp_v{4,6}_fill_cb() do not set it.\n\nVery litle impact on overall code size/complexity:\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction old new delta\ntcp_v6_rcv 3038 3042 +4\ntcp_v4_rcv 3035 3039 +4\ntcp_conn_request 2938 2923 -15\nTotal: Before=24436060, After=24436053, chg -0.00%"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached from the standard IPv4/IPv6 TCP receive path (tcp_v4_rcv/tcp_v6_rcv) when remote attackers send crafted TCP packets to any listening service on the host.\nAC:L - An attacker fully controls the trigger sequence\u2014establishing TIME_WAIT state, deliberately causing drops on documented paths (e.g., SYN+FIN or checksum failure), and spraying SYNs to land on the same CPU via RPS flow hashing\u2014without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to send TCP packets to a reachable port; no local shell access, capabilities, or authentication is needed on the target system.\nUI:N - No victim user action is required; the attack is conducted entirely by sending network packets to an internet-facing or LAN-reachable server.\nS:U - Impact is confined to the kernel TCP stack on the target host (predictable ISNs, syncookie bypass, session manipulation) and does not cross a VM, container, or IOMMU security boundary.\nC:L - Stale TIME_WAIT ISNs leak predictable sequence-number information that an off-path attacker can use to infer or intercept data on affected TCP connections, bypassing the cryptographically generated ISNs from secure_tcp_seq_and_ts_off().\nI:H - Predictable server ISNs enable TCP session hijacking and injection of forged segments into established or newly accepted connections, plus syncookie bypass allows unauthorized connection state to be created under flood conditions.\nA:H - Skipping syncookie and SYN-backlog protections when a stale non-zero ISN is consumed allows unauthenticated resource exhaustion and connection-disruption attacks against listening services."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:55.876Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8bb6aa419b142dcc2680177ecc39c4c38db7fc16"
},
{
"url": "https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd"
},
{
"url": "https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d"
},
{
"url": "https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d"
}
],
"title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64024",
"datePublished": "2026-07-19T15:39:16.598Z",
"dateReserved": "2026-07-19T07:54:57.027Z",
"dateUpdated": "2026-10-21T12:42:55.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99150 (GCVE-0-2026-99150)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
amdgpu_debugfs_gpr_read() drops its runtime PM reference right after
reading the wave registers. When copying them to userspace fails, it
jumps to the err label, which drops the reference a second time. A read
into a bad buffer on Navi31 either steals a reference somebody else
holds (power/runtime_usage goes from 1 to 0) or underflows the count:
amdgpu 0000:03:00.0: Runtime PM usage count underflow!
The registers are already in the kernel buffer at that point, so finish
the hardware access first and copy the buffer with a single
copy_to_user() instead of the put_user() loop with its own error path.
(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 9eee152aab56d374edb9ad21b3db05f5cdda2fe6 Version: 865e2dbadf6856c9219626fbd6154cac44e5fbca Version: 5.8.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24c1f6e381d564e5f6893323cfe0264950358451",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "c333834b1b9cbb1021c954d29fa2373ac9e73499",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "eda6b57a83d942199a5947e73556fe918affad86",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "f9c0b333a5e44f734478ca8a7345f8b87d65ba7c",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "35aa048f242cade635f17924183c1df0ffe7a486",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "652b1f26125fe48aed5f4944698a85b457eef491",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "253555a9baccefffe1f6e5f2fe54363c7c01ebb9",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"lessThan": "de9f6bcdb44f0e410031002e2f103826ea6b6259",
"status": "affected",
"version": "9eee152aab56d374edb9ad21b3db05f5cdda2fe6",
"versionType": "git"
},
{
"status": "affected",
"version": "865e2dbadf6856c9219626fbd6154cac44e5fbca",
"versionType": "git"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: don\u0027t drop the runtime PM reference twice in amdgpu_gpr\n\namdgpu_debugfs_gpr_read() drops its runtime PM reference right after\nreading the wave registers. When copying them to userspace fails, it\njumps to the err label, which drops the reference a second time. A read\ninto a bad buffer on Navi31 either steals a reference somebody else\nholds (power/runtime_usage goes from 1 to 0) or underflows the count:\n\n amdgpu 0000:03:00.0: Runtime PM usage count underflow!\n\nThe registers are already in the kernel buffer at that point, so finish\nthe hardware access first and copy the buffer with a single\ncopy_to_user() instead of the put_user() loop with its own error path.\n\n(cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:17.152Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24c1f6e381d564e5f6893323cfe0264950358451"
},
{
"url": "https://git.kernel.org/stable/c/c333834b1b9cbb1021c954d29fa2373ac9e73499"
},
{
"url": "https://git.kernel.org/stable/c/eda6b57a83d942199a5947e73556fe918affad86"
},
{
"url": "https://git.kernel.org/stable/c/f9c0b333a5e44f734478ca8a7345f8b87d65ba7c"
},
{
"url": "https://git.kernel.org/stable/c/35aa048f242cade635f17924183c1df0ffe7a486"
},
{
"url": "https://git.kernel.org/stable/c/652b1f26125fe48aed5f4944698a85b457eef491"
},
{
"url": "https://git.kernel.org/stable/c/253555a9baccefffe1f6e5f2fe54363c7c01ebb9"
},
{
"url": "https://git.kernel.org/stable/c/de9f6bcdb44f0e410031002e2f103826ea6b6259"
}
],
"title": "drm/amdgpu: don\u0027t drop the runtime PM reference twice in amdgpu_gpr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99150",
"datePublished": "2026-10-28T10:35:05.753Z",
"dateReserved": "2026-09-25T10:25:14.396Z",
"dateUpdated": "2026-10-30T12:42:17.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63859 (GCVE-0-2026-63859)
Vulnerability from cvelistv5
Published
2026-07-19 14:04
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in
airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to
TX_CPU_IDX to notify the NIC the QDMA TX ring is empty.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/airoha/airoha_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b86b4c7767e932f59cd23b31587b73a03cb1dfc",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
},
{
"lessThan": "c0cfce4d76702dba9601a4020df1a0bc35806efc",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
},
{
"lessThan": "9b5d56fe389d68ede080c716e6f10895facaf7db",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
},
{
"lessThan": "3309965fe44c00fd65af7cef5016e9e782c021a7",
"status": "affected",
"version": "23020f04932701d5c8363e60756f12b43b8ed752",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/airoha/airoha_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()\n\nSimilar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in\nairoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to\nTX_CPU_IDX to notify the NIC the QDMA TX ring is empty."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:42.608Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b86b4c7767e932f59cd23b31587b73a03cb1dfc"
},
{
"url": "https://git.kernel.org/stable/c/c0cfce4d76702dba9601a4020df1a0bc35806efc"
},
{
"url": "https://git.kernel.org/stable/c/9b5d56fe389d68ede080c716e6f10895facaf7db"
},
{
"url": "https://git.kernel.org/stable/c/3309965fe44c00fd65af7cef5016e9e782c021a7"
}
],
"title": "net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63859",
"datePublished": "2026-07-19T14:04:47.572Z",
"dateReserved": "2026-07-19T07:54:57.016Z",
"dateUpdated": "2026-10-21T12:42:42.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99180 (GCVE-0-2026-99180)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
unicode: free the map after a grace period
generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and
dereference the unicode map while a pathwalk in rcu mode holds nothing
but rcu_read_lock(). The filesystems that use them, ext4, f2fs and
tmpfs, drop the map with utf8_unload() from ->put_super(), which runs
when the last reference to the mount goes away. A lookup that is still
inside such a filesystem at that point reads a freed map.
With a pathwalk held up in utf8_casefold_hash() while the last reference
to a casefolded tmpfs goes away:
BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950
Read of size 8 at addr ff110001030fe658 by task walker/98
Call Trace:
<TASK>
utf8nlookup+0x74c/0x950
utf8byte+0x160/0x1560
utf8_casefold_hash+0x167/0x230
generic_ci_d_hash+0xdd/0x1c0
link_path_walk+0x11ad/0x1d30
path_lookupat+0x63/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
[...]
Allocated by task 94:
__kmalloc_cache_noprof+0x249/0x560
utf8_load+0x4e/0x570
shmem_parse_opt_casefold.isra.0+0x92/0x270
[...]
Freed by task 97:
kfree+0x1db/0x5b0
shmem_put_super+0x72/0x170
generic_shutdown_super+0x14c/0x530
kill_anon_super+0x3a/0x60
deactivate_locked_super+0x9c/0xf0
cleanup_mnt+0x9f/0x130
So far that has been hard to hit. umount(2) waits for a grace period
in namespace_unlock() before it drops the mount, so only a mount whose
last reference goes away elsewhere, like the close of a file or a chdir
out of a lazily unmounted directory, can race a walker. So it is
reachable.
Delay the free until a grace period has passed. The map and the data
table it holds a reference to then outlive any pathwalk that found the
superblock before the mount went away. The reference on the data table
module is dropped from the rcu callback as well. utf8-core is built in
whenever CONFIG_UNICODE is set, so there is no module exit that would
have to wait for the callbacks.
Overlayfs points the s_encoding of an overlay at the map of its first
layer without taking a reference of its own. That stays correct. The
layer is held by the overlay, so its map is dropped only after the
overlay is gone.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 Version: b886ee3e778ec2ad43e276fd378ab492cf6819b7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/unicode/utf8-core.c",
"include/linux/unicode.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "092e14e1479a39157ca01668d43e4649793f39ed",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "6472455f2b015cad43adb790cb63fe1d3cff2f57",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "f96c2731a105d6663c606388f5dc21781e00ade5",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "69a0d6b31d05e856c7335509222f25321e3c69ca",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "6560c3d9a6925e3747d9ad8463e16010c31ba715",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
},
{
"lessThan": "a96c5299bd7305eb984377681eb3222a57376405",
"status": "affected",
"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/unicode/utf8-core.c",
"include/linux/unicode.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunicode: free the map after a grace period\n\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb-\u003es_encoding and\ndereference the unicode map while a pathwalk in rcu mode holds nothing\nbut rcu_read_lock(). The filesystems that use them, ext4, f2fs and\ntmpfs, drop the map with utf8_unload() from -\u003eput_super(), which runs\nwhen the last reference to the mount goes away. A lookup that is still\ninside such a filesystem at that point reads a freed map.\n\nWith a pathwalk held up in utf8_casefold_hash() while the last reference\nto a casefolded tmpfs goes away:\n\n BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950\n Read of size 8 at addr ff110001030fe658 by task walker/98\n Call Trace:\n \u003cTASK\u003e\n utf8nlookup+0x74c/0x950\n utf8byte+0x160/0x1560\n utf8_casefold_hash+0x167/0x230\n generic_ci_d_hash+0xdd/0x1c0\n link_path_walk+0x11ad/0x1d30\n path_lookupat+0x63/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n [...]\n Allocated by task 94:\n __kmalloc_cache_noprof+0x249/0x560\n utf8_load+0x4e/0x570\n shmem_parse_opt_casefold.isra.0+0x92/0x270\n [...]\n Freed by task 97:\n kfree+0x1db/0x5b0\n shmem_put_super+0x72/0x170\n generic_shutdown_super+0x14c/0x530\n kill_anon_super+0x3a/0x60\n deactivate_locked_super+0x9c/0xf0\n cleanup_mnt+0x9f/0x130\n\nSo far that has been hard to hit. umount(2) waits for a grace period\nin namespace_unlock() before it drops the mount, so only a mount whose\nlast reference goes away elsewhere, like the close of a file or a chdir\nout of a lazily unmounted directory, can race a walker. So it is\nreachable.\n\nDelay the free until a grace period has passed. The map and the data\ntable it holds a reference to then outlive any pathwalk that found the\nsuperblock before the mount went away. The reference on the data table\nmodule is dropped from the rcu callback as well. utf8-core is built in\nwhenever CONFIG_UNICODE is set, so there is no module exit that would\nhave to wait for the callbacks.\n\nOverlayfs points the s_encoding of an overlay at the map of its first\nlayer without taking a reference of its own. That stays correct. The\nlayer is held by the overlay, so its map is dropped only after the\noverlay is gone."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Local statx() pathwalks reach generic_ci_d_hash() and utf8_casefold_hash(), while chdir() and final mount teardown reach shmem_put_super() and the patched utf8_unload(); no network protocol carries the trigger.\nAC:L - After umount2(MNT_DETACH), one attacker can loop Unicode statx() lookups from a retained cwd while a sibling chdir() drops the final mount reference; the attacker controls both sides and can repeatedly retry the race.\nPR:L - shmem_fs_type includes FS_USERNS_MOUNT, so an unprivileged user can mount casefolded tmpfs in their own user/mount namespace and, as inode owner, pass vfs_fileattr_set() to set FS_CASEFOLD_FL.\nUI:N - The same attacker performs the casefolded tmpfs mount, FS_IOC_SETFLAGS, lazy unmount, statx(), and chdir() operations; no victim action is required.\nS:U - The utf8nlookup() use-after-free occurs within the host kernel reached by the local process, and any resulting kernel compromise remains under that same security authority.\nC:H - utf8nlookup() dereferences reclaimed unicode_map tables and ntab[] pointers, including tables-\u003eutf8data and utf8agetab; reclaiming the generic-kmalloc object can turn these stale pointer dereferences into attacker-directed kernel reads.\nI:H - utf8_unload() frees a still-referenced generic-kmalloc unicode_map; attacker-controlled heap reclamation can replace its tables and ntab[] pointers used by utf8nlookup(), making this heap use-after-free exploitable for memory corruption and control-flow hijacking.\nA:H - The demonstrated stale unicode_map dereference in utf8nlookup() produces a KASAN slab-use-after-free, and corrupted tables or ntab[] pointers can cause a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:50.381Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/092e14e1479a39157ca01668d43e4649793f39ed"
},
{
"url": "https://git.kernel.org/stable/c/6472455f2b015cad43adb790cb63fe1d3cff2f57"
},
{
"url": "https://git.kernel.org/stable/c/f96c2731a105d6663c606388f5dc21781e00ade5"
},
{
"url": "https://git.kernel.org/stable/c/5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07"
},
{
"url": "https://git.kernel.org/stable/c/69a0d6b31d05e856c7335509222f25321e3c69ca"
},
{
"url": "https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8"
},
{
"url": "https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715"
},
{
"url": "https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405"
}
],
"title": "unicode: free the map after a grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99180",
"datePublished": "2026-10-28T10:35:33.578Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-31T12:44:50.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40065 (GCVE-0-2025-40065)
Vulnerability from cvelistv5
Published
2025-10-28 11:48
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Write hgatp register with valid mode bits
According to the RISC-V Privileged Architecture Spec, when MODE=Bare
is selected,software must write zero to the remaining fields of hgatp.
We have detected the valid mode supported by the HW before, So using a
valid mode to detect how many vmid bits are supported.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/vmid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "feb64ca53d97b3ac8ba9ecbeae5f9426f1513650",
"status": "affected",
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"versionType": "git"
},
{
"lessThan": "8b6e327736db013b9e385c3f6f9f0b04ddf26e43",
"status": "affected",
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"versionType": "git"
},
{
"lessThan": "5cba8ae00279296a586d0596443109d601b1d116",
"status": "affected",
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"versionType": "git"
},
{
"lessThan": "d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357",
"status": "affected",
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"versionType": "git"
},
{
"lessThan": "2b351e3d04be9e1533f26c3464f1e44a5beace30",
"status": "affected",
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/vmid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Write hgatp register with valid mode bits\n\nAccording to the RISC-V Privileged Architecture Spec, when MODE=Bare\nis selected,software must write zero to the remaining fields of hgatp.\n\nWe have detected the valid mode supported by the HW before, So using a\nvalid mode to detect how many vmid bits are supported."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:44.991Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/feb64ca53d97b3ac8ba9ecbeae5f9426f1513650"
},
{
"url": "https://git.kernel.org/stable/c/8b6e327736db013b9e385c3f6f9f0b04ddf26e43"
},
{
"url": "https://git.kernel.org/stable/c/5cba8ae00279296a586d0596443109d601b1d116"
},
{
"url": "https://git.kernel.org/stable/c/d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357"
},
{
"url": "https://git.kernel.org/stable/c/2b351e3d04be9e1533f26c3464f1e44a5beace30"
}
],
"title": "RISC-V: KVM: Write hgatp register with valid mode bits",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40065",
"datePublished": "2025-10-28T11:48:35.785Z",
"dateReserved": "2025-04-16T07:20:57.159Z",
"dateUpdated": "2026-10-30T12:22:44.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43294 (GCVE-0-2026-43294)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
we may get the following kernel panic, for some panels, when rebooting:
systemd-shutdown[1]: Rebooting.
Call trace:
...
do_serror+0x28/0x68
el1h_64_error_handler+0x34/0x50
el1h_64_error+0x6c/0x70
rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
mipi_dsi_device_transfer+0x44/0x58
mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
ili9881c_unprepare+0x38/0x88
drm_panel_unprepare+0xbc/0x108
This happens for panels that need to send MIPI-DSI commands in their
unprepare() callback. Since the MIPI-DSI interface is stopped at that
point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
Fix by moving rzg2l_mipi_dsi_stop() to new callback function
rzg2l_mipi_dsi_atomic_post_disable().
With this change we now have the correct power-down/stop sequence:
systemd-shutdown[1]: Rebooting.
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
reboot: Restarting system
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cd7a71958c9f7f1def1a110e1ac98c022a554cd",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
},
{
"lessThan": "ad9a3246e76b83cd19eb07088111a743a9558bcd",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
},
{
"lessThan": "79f42487ed60d0d5ffce97c3bb98f80c3d17735a",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
},
{
"lessThan": "41cda667ffc5074c56279c632b0c20024da6ecdd",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
},
{
"lessThan": "64aa8b3a60a825134f7d866adf05c024bbe0c24c",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels\n\nSince commit 56de5e305d4b (\"clk: renesas: r9a07g044: Add MSTOP for RZ/G2L\")\nwe may get the following kernel panic, for some panels, when rebooting:\n\n systemd-shutdown[1]: Rebooting.\n Call trace:\n ...\n do_serror+0x28/0x68\n el1h_64_error_handler+0x34/0x50\n el1h_64_error+0x6c/0x70\n rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)\n mipi_dsi_device_transfer+0x44/0x58\n mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4\n ili9881c_unprepare+0x38/0x88\n drm_panel_unprepare+0xbc/0x108\n\nThis happens for panels that need to send MIPI-DSI commands in their\nunprepare() callback. Since the MIPI-DSI interface is stopped at that\npoint, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.\n\nFix by moving rzg2l_mipi_dsi_stop() to new callback function\nrzg2l_mipi_dsi_atomic_post_disable().\n\nWith this change we now have the correct power-down/stop sequence:\n\n systemd-shutdown[1]: Rebooting.\n rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry\n ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry\n rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry\n reboot: Restarting system"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:29.748Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cd7a71958c9f7f1def1a110e1ac98c022a554cd"
},
{
"url": "https://git.kernel.org/stable/c/ad9a3246e76b83cd19eb07088111a743a9558bcd"
},
{
"url": "https://git.kernel.org/stable/c/79f42487ed60d0d5ffce97c3bb98f80c3d17735a"
},
{
"url": "https://git.kernel.org/stable/c/41cda667ffc5074c56279c632b0c20024da6ecdd"
},
{
"url": "https://git.kernel.org/stable/c/64aa8b3a60a825134f7d866adf05c024bbe0c24c"
}
],
"title": "drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43294",
"datePublished": "2026-05-08T13:11:17.483Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-10-21T12:40:29.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40086 (GCVE-0-2025-40086)
Vulnerability from cvelistv5
Published
2025-10-30 09:47
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
An array of VM binds can potentially evict other buffer objects (BOs)
within the same VM under certain conditions, which may lead to NULL
pointer dereferences later in the bind pipeline. To prevent this, clear
the allow_res_evict flag in the xe_bo_validate call.
v2:
- Invert polarity of no_res_evict (Thomas)
- Add comment in code explaining issue (Thomas)
(cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_vm.c",
"drivers/gpu/drm/xe/xe_vm_types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d21087d083e6f324d69ee87c872a4cbb5bc4a48c",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "7ac74613e5f2ef3450f44fd2127198662c2563a9",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_vm.c",
"drivers/gpu/drm/xe/xe_vm_types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.5",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Don\u0027t allow evicting of BOs in same VM in array of VM binds\n\nAn array of VM binds can potentially evict other buffer objects (BOs)\nwithin the same VM under certain conditions, which may lead to NULL\npointer dereferences later in the bind pipeline. To prevent this, clear\nthe allow_res_evict flag in the xe_bo_validate call.\n\nv2:\n - Invert polarity of no_res_evict (Thomas)\n - Add comment in code explaining issue (Thomas)\n\n(cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:46.403Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d21087d083e6f324d69ee87c872a4cbb5bc4a48c"
},
{
"url": "https://git.kernel.org/stable/c/5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384"
},
{
"url": "https://git.kernel.org/stable/c/7ac74613e5f2ef3450f44fd2127198662c2563a9"
}
],
"title": "drm/xe: Don\u0027t allow evicting of BOs in same VM in array of VM binds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40086",
"datePublished": "2025-10-30T09:47:56.005Z",
"dateReserved": "2025-04-16T07:20:57.161Z",
"dateUpdated": "2026-10-21T12:37:46.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74405 (GCVE-0-2026-74405)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
OPP: Fix race between OPP addition and lookup
A race exists between dev_pm_opp_add_dynamic() and
dev_pm_opp_find_freq_exact():
CPU0 (add) CPU1 (lookup)
------------------------------- ------------------------------
_opp_add()
mutex_lock()
list_add(&new_opp->node, head)
mutex_unlock() _opp_table_find_key()
mutex_lock()
dev_pm_opp_get(opp)
kref_get()
mutex_unlock()
kref_init(&new_opp->kref)
dev_pm_opp_put()
kref_put_mutex()
The newly added OPP is inserted into the list before its kref is
initialized. A concurrent lookup can find this OPP and increment its
reference count while it is still uninitialized, leading to refcount
corruption and a potential premature free.
Fix this by initializing ->kref and ->opp_table before making the OPP
visible via list_add(). This ensures any concurrent lookup observes a
fully initialized object.
[ Viresh: Updated commit log ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 Version: 7034764a1e4a6edbb60914e89aad8384e3fe5d17 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:48.602720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:43.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/opp/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "835b9b5b4d287a03c713680b0231d36ff599201b",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "2fb061a90898420d8ca1a0b9959ca977d90fa841",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "e25be5d812ec8ca2615d23726b3861b04e2fff35",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "932ebfad767be1395946cbc1727a7c38eeee3d24",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "1946ea2f6b3ec00e313c78e83fc196f1f6aba2a9",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "46696b0b2123475d7f95909435c09808fc5ffd23",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
},
{
"lessThan": "f5e1cc9a284bff2510981643a5bca4bc4c21b81a",
"status": "affected",
"version": "7034764a1e4a6edbb60914e89aad8384e3fe5d17",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/opp/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nOPP: Fix race between OPP addition and lookup\n\nA race exists between dev_pm_opp_add_dynamic() and\ndev_pm_opp_find_freq_exact():\n\n CPU0 (add) CPU1 (lookup)\n ------------------------------- ------------------------------\n _opp_add()\n mutex_lock()\n list_add(\u0026new_opp-\u003enode, head)\n mutex_unlock() _opp_table_find_key()\n mutex_lock()\n dev_pm_opp_get(opp)\n kref_get()\n mutex_unlock()\n kref_init(\u0026new_opp-\u003ekref)\n dev_pm_opp_put()\n kref_put_mutex()\n\nThe newly added OPP is inserted into the list before its kref is\ninitialized. A concurrent lookup can find this OPP and increment its\nreference count while it is still uninitialized, leading to refcount\ncorruption and a potential premature free.\n\nFix this by initializing -\u003ekref and -\u003eopp_table before making the OPP\nvisible via list_add(). This ensures any concurrent lookup observes a\nfully initialized object.\n\n[ Viresh: Updated commit log ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the kernel OPP DVFS core reached only from local cpufreq, devfreq, thermal, and GPU power-management paths (e.g. scmi-cpufreq, mtk-mfg, MSM Adreno) that call dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact(); there is no network, adjacent-radio, or physical-device input into _opp_add().\nAC:L - The attacker can drive the lookup side with parallel CPU/GPU load or cpufreq scaling while the kernel concurrently inserts OPPs via _opp_add() during multi-CPU SCMI/GPU power-domain attach and boot cpufreq init; both race participants are attacker-influenceable timing on multi-core ARM/Android/embedded systems.\nPR:L - No init-namespace root is required to hammer dev_pm_opp_find_freq_exact() through normal cpufreq, thermal, or GPU DVFS activity from an unprivileged local process; OPP registration runs automatically in kernel driver attach/probe paths without attacker credentials.\nUI:N - Exploitation does not require any victim action beyond the attacker (or kernel) driving DVFS activity; no mount, file open, or other interactive step is needed once the attacker runs concurrent workload or scaling pressure on the target system.\nS:U - Refcount corruption causes premature kfree() of a dev_pm_opp slab object still linked in the OPP table, enabling standard kernel memory corruption and privilege escalation within the same OS boundary rather than a VM, IOMMU, or sandbox escape.\nC:H - Uninitialized kref_get()/kref_init() races corrupt the OPP refcount and can free the structure while still listed; this use-after-free of kmalloc\u0027d dev_pm_opp memory can expose adjacent heap contents and support arbitrary kernel read primitives.\nI:H - Premature free of dev_pm_opp while its list node remains reachable allows heap reuse and controlled writes through subsequent allocations, providing a standard path to corrupt kernel objects and achieve arbitrary code execution.\nA:H - Refcount corruption can trigger _opp_kref_release() to kfree() an OPP still referenced by concurrent lookups, causing kernel oops/panic from use-after-free or list corruption during ongoing DVFS operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:58.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/835b9b5b4d287a03c713680b0231d36ff599201b"
},
{
"url": "https://git.kernel.org/stable/c/2fb061a90898420d8ca1a0b9959ca977d90fa841"
},
{
"url": "https://git.kernel.org/stable/c/e25be5d812ec8ca2615d23726b3861b04e2fff35"
},
{
"url": "https://git.kernel.org/stable/c/932ebfad767be1395946cbc1727a7c38eeee3d24"
},
{
"url": "https://git.kernel.org/stable/c/1946ea2f6b3ec00e313c78e83fc196f1f6aba2a9"
},
{
"url": "https://git.kernel.org/stable/c/46696b0b2123475d7f95909435c09808fc5ffd23"
},
{
"url": "https://git.kernel.org/stable/c/bb75bd7d9ae7672034f73ce67a57e6ac89bb39e5"
},
{
"url": "https://git.kernel.org/stable/c/f5e1cc9a284bff2510981643a5bca4bc4c21b81a"
}
],
"title": "OPP: Fix race between OPP addition and lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74405",
"datePublished": "2026-08-15T05:59:14.719Z",
"dateReserved": "2026-08-15T05:44:03.892Z",
"dateUpdated": "2026-10-30T12:29:58.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97479 (GCVE-0-2026-97479)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-30 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
driver core: Avoid warning when removing a device while its supplier is unbinding
During driver removal, the following warning can appear:
WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc
...
Call trace:
__device_links_no_driver+0xcc/0xfc (P)
device_links_driver_cleanup+0xa8/0xf0
device_release_driver_internal+0x208/0x23c
device_links_unbind_consumers+0xe0/0x108
device_release_driver_internal+0xec/0x23c
device_links_unbind_consumers+0xe0/0x108
device_release_driver_internal+0xec/0x23c
device_links_unbind_consumers+0xe0/0x108
device_release_driver_internal+0xec/0x23c
driver_detach+0xa0/0x12c
bus_remove_driver+0x6c/0xbc
driver_unregister+0x30/0x60
pci_unregister_driver+0x20/0x9c
lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci]
This warning is triggered when a consumer is removed because the links
status of its supplier is not DL_DEV_DRIVER_BOUND and the link flag
DL_FLAG_SYNC_STATE_ONLY is not set.
The topology in terms of consumers/suppliers used was the following
(consumer ---> supplier):
i2c -----------> OIC ----> PCI device
| ^
| |
+---> pinctrl ---+
When the PCI device is removed, the OIC (interrupt controller) has to be
removed. In order to remove the OIC, pinctrl and i2c need to be removed
and to remove pinctrl, i2c need to be removed. The removal order is:
1) i2c
2) pinctrl
3) OIC
4) PCI device
In details, the removal sequence is the following (with 0000:01:00.0 the
PCI device):
driver_detach: call device_release_driver_internal(0000:01:00.0)...
device_links_busy(0000:01:00.0):
links->status = DL_DEV_UNBINDING
device_links_unbind_consumers(0000:01:00.0):
0000:01:00.0--oic link->status = DL_STATE_SUPPLIER_UNBIND
call device_release_driver_internal(oic)...
device_links_busy(oic):
links->status = DL_DEV_UNBINDING
device_links_unbind_consumers(oic):
oic--pinctrl link->status = DL_STATE_SUPPLIER_UNBIND
call device_release_driver_internal(pinctrl)...
device_links_busy(pinctrl):
links->status = DL_DEV_UNBINDING
device_links_unbind_consumers(pinctrl):
pinctrl--i2c link->status = DL_STATE_SUPPLIER_UNBIND
call device_release_driver_internal(i2c)...
device_links_busy(i2c): links->status = DL_DEV_UNBINDING
__device_links_no_driver(i2c)...
pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND
oic--i2c link->status is DL_STATE_ACTIVE
oic--i2c link->supplier->links.status is DL_DEV_UNBINDING
The warning is triggered by the i2c removal because the OIC (supplier)
links status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set
to DL_DEV_UNBINDING.
It is perfectly legit to have the links status set to DL_DEV_UNBINDING
in that case. Indeed we had started to unbind the OIC which triggered
the consumer unbinding and didn't finish yet when the i2c is unbound.
Avoid the warning when the supplier links status is set to
DL_DEV_UNBINDING and thus support this removal sequence without any
warnings.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8c3e315d4296421cd26b3300ee0ac117f0877f20 Version: 8c3e315d4296421cd26b3300ee0ac117f0877f20 Version: 8c3e315d4296421cd26b3300ee0ac117f0877f20 Version: 8c3e315d4296421cd26b3300ee0ac117f0877f20 Version: 8c3e315d4296421cd26b3300ee0ac117f0877f20 Version: 2e5c082d3727522a3f30a50582784d24754d14a8 Version: 70154bb515a325c007bcf64971099e1e17f16f28 Version: 5.6.19 ≤ Version: 5.7.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d13785eabc3871bde179f3f17a2b2bef064864a",
"status": "affected",
"version": "8c3e315d4296421cd26b3300ee0ac117f0877f20",
"versionType": "git"
},
{
"lessThan": "d5eb39d6178ca88db706c7b82dcd19a77f30aa9e",
"status": "affected",
"version": "8c3e315d4296421cd26b3300ee0ac117f0877f20",
"versionType": "git"
},
{
"lessThan": "da22e4bce2a8cbed32dcda407b7d06cb5feec8e3",
"status": "affected",
"version": "8c3e315d4296421cd26b3300ee0ac117f0877f20",
"versionType": "git"
},
{
"lessThan": "73ea4ec0ec46d12558a61842b474e7dd63538edc",
"status": "affected",
"version": "8c3e315d4296421cd26b3300ee0ac117f0877f20",
"versionType": "git"
},
{
"lessThan": "36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9",
"status": "affected",
"version": "8c3e315d4296421cd26b3300ee0ac117f0877f20",
"versionType": "git"
},
{
"status": "affected",
"version": "2e5c082d3727522a3f30a50582784d24754d14a8",
"versionType": "git"
},
{
"status": "affected",
"version": "70154bb515a325c007bcf64971099e1e17f16f28",
"versionType": "git"
},
{
"lessThan": "5.7",
"status": "affected",
"version": "5.6.19",
"versionType": "semver"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: Avoid warning when removing a device while its supplier is unbinding\n\nDuring driver removal, the following warning can appear:\n WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc\n ...\n Call trace:\n __device_links_no_driver+0xcc/0xfc (P)\n device_links_driver_cleanup+0xa8/0xf0\n device_release_driver_internal+0x208/0x23c\n device_links_unbind_consumers+0xe0/0x108\n device_release_driver_internal+0xec/0x23c\n device_links_unbind_consumers+0xe0/0x108\n device_release_driver_internal+0xec/0x23c\n device_links_unbind_consumers+0xe0/0x108\n device_release_driver_internal+0xec/0x23c\n driver_detach+0xa0/0x12c\n bus_remove_driver+0x6c/0xbc\n driver_unregister+0x30/0x60\n pci_unregister_driver+0x20/0x9c\n lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci]\n\nThis warning is triggered when a consumer is removed because the links\nstatus of its supplier is not DL_DEV_DRIVER_BOUND and the link flag\nDL_FLAG_SYNC_STATE_ONLY is not set.\n\nThe topology in terms of consumers/suppliers used was the following\n(consumer ---\u003e supplier):\n\n i2c -----------\u003e OIC ----\u003e PCI device\n | ^\n | |\n +---\u003e pinctrl ---+\n\nWhen the PCI device is removed, the OIC (interrupt controller) has to be\nremoved. In order to remove the OIC, pinctrl and i2c need to be removed\nand to remove pinctrl, i2c need to be removed. The removal order is:\n 1) i2c\n 2) pinctrl\n 3) OIC\n 4) PCI device\n\nIn details, the removal sequence is the following (with 0000:01:00.0 the\nPCI device):\n driver_detach: call device_release_driver_internal(0000:01:00.0)...\n device_links_busy(0000:01:00.0):\n links-\u003estatus = DL_DEV_UNBINDING\n device_links_unbind_consumers(0000:01:00.0):\n 0000:01:00.0--oic link-\u003estatus = DL_STATE_SUPPLIER_UNBIND\n call device_release_driver_internal(oic)...\n device_links_busy(oic):\n links-\u003estatus = DL_DEV_UNBINDING\n device_links_unbind_consumers(oic):\n oic--pinctrl link-\u003estatus = DL_STATE_SUPPLIER_UNBIND\n call device_release_driver_internal(pinctrl)...\n device_links_busy(pinctrl):\n links-\u003estatus = DL_DEV_UNBINDING\n device_links_unbind_consumers(pinctrl):\n pinctrl--i2c link-\u003estatus = DL_STATE_SUPPLIER_UNBIND\n call device_release_driver_internal(i2c)...\n device_links_busy(i2c): links-\u003estatus = DL_DEV_UNBINDING\n __device_links_no_driver(i2c)...\n pinctrl--i2c link-\u003estatus is DL_STATE_SUPPLIER_UNBIND\n oic--i2c link-\u003estatus is DL_STATE_ACTIVE\n oic--i2c link-\u003esupplier-\u003elinks.status is DL_DEV_UNBINDING\n\nThe warning is triggered by the i2c removal because the OIC (supplier)\nlinks status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set\nto DL_DEV_UNBINDING.\n\nIt is perfectly legit to have the links status set to DL_DEV_UNBINDING\nin that case. Indeed we had started to unbind the OIC which triggered\nthe consumer unbinding and didn\u0027t finish yet when the i2c is unbound.\n\nAvoid the warning when the supplier links status is set to\nDL_DEV_UNBINDING and thus support this removal sequence without any\nwarnings."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:37:00.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d13785eabc3871bde179f3f17a2b2bef064864a"
},
{
"url": "https://git.kernel.org/stable/c/d5eb39d6178ca88db706c7b82dcd19a77f30aa9e"
},
{
"url": "https://git.kernel.org/stable/c/da22e4bce2a8cbed32dcda407b7d06cb5feec8e3"
},
{
"url": "https://git.kernel.org/stable/c/73ea4ec0ec46d12558a61842b474e7dd63538edc"
},
{
"url": "https://git.kernel.org/stable/c/36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9"
}
],
"title": "driver core: Avoid warning when removing a device while its supplier is unbinding",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97479",
"datePublished": "2026-09-24T16:04:21.956Z",
"dateReserved": "2026-09-24T16:01:01.149Z",
"dateUpdated": "2026-10-30T12:37:00.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99159 (GCVE-0-2026-99159)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one
sub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[]
shifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()
dereferences when userspace maps trace_pipe_raw. rb_update_meta_reader()
writes two such indices into meta->buffers[], which rb_cpu_meta_valid()
would reject on the next boot, discarding the previous boot's trace.
A CPU's sub-buffer array starts after its meta header and the nr_subbufs
integers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx()
inverts that calculation but skips only the integers, not the header, so
its base is one sub-buffer low whenever the omitted header size crosses
the alignment boundary.
Invert the calculation with rb_subbufs_from_meta() rather than repeating
it. rb_range_buffer() maps an index back to an address through the same
helper, so the two directions can no longer disagree.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c0cf2240bb5ca5704ea932ba66ee54f43173915",
"status": "affected",
"version": "b14d032973d4e6c36e025e96ea3437de53d072d9",
"versionType": "git"
},
{
"lessThan": "2f1248b728b56d583ea454fedf239550c49f7b18",
"status": "affected",
"version": "b14d032973d4e6c36e025e96ea3437de53d072d9",
"versionType": "git"
},
{
"lessThan": "7469b3585ef5f65840d467d2caa811a9098c84b9",
"status": "affected",
"version": "b14d032973d4e6c36e025e96ea3437de53d072d9",
"versionType": "git"
},
{
"lessThan": "25132363c723afc39aace8b098f547ab4a0ea759",
"status": "affected",
"version": "b14d032973d4e6c36e025e96ea3437de53d072d9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()\n\nOn a persistent ring buffer, rb_meta_subbuf_idx() can return an index one\nsub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[]\nshifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()\ndereferences when userspace maps trace_pipe_raw. rb_update_meta_reader()\nwrites two such indices into meta-\u003ebuffers[], which rb_cpu_meta_valid()\nwould reject on the next boot, discarding the previous boot\u0027s trace.\n\nA CPU\u0027s sub-buffer array starts after its meta header and the nr_subbufs\nintegers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx()\ninverts that calculation but skips only the integers, not the header, so\nits base is one sub-buffer low whenever the omitted header size crosses\nthe alignment boundary.\n\nInvert the calculation with rb_subbufs_from_meta() rather than repeating\nit. rb_range_buffer() maps an index back to an address through the same\nhelper, so the two directions can no longer disagree."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:25.874Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c0cf2240bb5ca5704ea932ba66ee54f43173915"
},
{
"url": "https://git.kernel.org/stable/c/2f1248b728b56d583ea454fedf239550c49f7b18"
},
{
"url": "https://git.kernel.org/stable/c/7469b3585ef5f65840d467d2caa811a9098c84b9"
},
{
"url": "https://git.kernel.org/stable/c/25132363c723afc39aace8b098f547ab4a0ea759"
}
],
"title": "ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99159",
"datePublished": "2026-10-28T10:35:12.520Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-30T12:42:25.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89601 (GCVE-0-2026-89601)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext2: Fix lost inode updates for IS_SYNC inodes
ext2_setsize() and ext2_xattr_set2() had a construct like:
if (IS_SYNC(inode)) {
sync_inode_metadata(inode, 1);
} else {
mark_inode_dirty(inode);
}
which leads to lost inode updates for IS_SYNC inodes because
sync_inode_metadata() does anything only if the inode is already dirty
and hence inode updates may be simply lost. Fix the problem by
unconditionally marking the inode dirty and *then* call
sync_inode_metadata().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext2/inode.c",
"fs/ext2/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "55e66d84b5272c425b324a2b247cdacacf1e10b9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b879565effd88fc119c2efea3f3868a9997ed9ba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e54de654423bee98d1ba50379b09daf97c7854a6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5481766125041e71662f2e32ee0e91ad5f4d07f4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5efb3350230fef831167740e69e6db2861101186",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext2/inode.c",
"fs/ext2/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: Fix lost inode updates for IS_SYNC inodes\n\next2_setsize() and ext2_xattr_set2() had a construct like:\n\n\tif (IS_SYNC(inode)) {\n\t\tsync_inode_metadata(inode, 1);\n\t} else {\n\t\tmark_inode_dirty(inode);\n\t}\n\nwhich leads to lost inode updates for IS_SYNC inodes because\nsync_inode_metadata() does anything only if the inode is already dirty\nand hence inode updates may be simply lost. Fix the problem by\nunconditionally marking the inode dirty and *then* call\nsync_inode_metadata()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd SETATTR/SETXATTR and ksmbd truncate/EA handling call notify_change()/vfs_setxattr() into ext2_setattr()/ext2_xattr_set2() when an ext2 volume is NFS/SMB-exported (NAS and embedded USB-storage appliances, including sync-mounted disks); a remote client with write access therefore reaches the lost IS_SYNC inode update without a local shell.\nAC:L - The attacker can put the target in the IS_SYNC state at will (owner-writable FS_IOC_SETFLAGS/chattr +S, or a sync-mounted export) and then deterministically truncate or set/remove xattrs; sync_inode_metadata() skips a clean inode every time, with no race or memory layout outside attacker control.\nPR:L - The path is gated only by ordinary VFS write checks (inode_permission MAY_WRITE, xattr_permission for user.* xattrs, or inode_owner_or_capable() for FS_IOC_SETFLAGS); an unprivileged local user or a low-privilege NFS/SMB client with write access to a file suffices, and no init-namespace capability is required.\nUI:N - The attacker performs every step themselves (setting the SYNC flag, truncating or changing xattrs/ACLs, and driving inode reclaim); no separate victim action such as mounting a crafted image is required.\nS:U - Impact is confined to filesystem metadata and file data on the host that mounted the ext2 volume; this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:H - Removing the last xattr on an IS_SYNC inode frees the EA block without persisting i_file_acl=0, leaving a dangling on-disk pointer; after that block is reused, ext2_xattr_get() memcpy()s its contents to userspace when the header looks valid, so the filesystem-level UAF discloses other files\u0027 data.\nI:H - The lost i_file_acl update leaves the on-disk inode pointing at a freed EA block, so a later in-place xattr write can corrupt whatever reused that block, including other users\u0027 files and metadata; intended-durable IS_SYNC size/ctime/ACL updates can also fail to land, corrupting filesystem state.\nA:H - Reloading the stale i_file_acl and reading an invalid reused EA block calls ext2_error(), which panics on errors=panic and remounts the volume read-only on errors=remount-ro; the resulting filesystem inconsistency can also render files and the volume unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:18.488Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/55e66d84b5272c425b324a2b247cdacacf1e10b9"
},
{
"url": "https://git.kernel.org/stable/c/b879565effd88fc119c2efea3f3868a9997ed9ba"
},
{
"url": "https://git.kernel.org/stable/c/e54de654423bee98d1ba50379b09daf97c7854a6"
},
{
"url": "https://git.kernel.org/stable/c/5481766125041e71662f2e32ee0e91ad5f4d07f4"
},
{
"url": "https://git.kernel.org/stable/c/5efb3350230fef831167740e69e6db2861101186"
},
{
"url": "https://git.kernel.org/stable/c/356984d1a5c32e94810cbb6c8dc7d8ff2d4d919a"
}
],
"title": "ext2: Fix lost inode updates for IS_SYNC inodes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89601",
"datePublished": "2026-09-11T19:45:04.667Z",
"dateReserved": "2026-09-11T19:38:34.732Z",
"dateUpdated": "2026-10-30T12:32:18.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99174 (GCVE-0-2026-99174)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: free the sbi after a grace period
ext4_get_link() follows a symlink that keeps its target in a data block
in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT).
That reads s_mount_state in the ASSERT() of ext4_getblk() and again in
ext4_es_lookup_extent(), and the lookup bumps the extent status hit or
miss counter, all through sb->s_fs_info.
ext4_put_super() destroys those counters, clears sb->s_fs_info and frees
the sbi without waiting for a grace period. A pathwalk that is still in
ext4_get_link() when the last reference to the mount goes away then
dereferences a NULL s_fs_info, the freed sbi or the destroyed percpu
counters.
With a pathwalk held up in ext4_get_link() while the last reference
goes away:
KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
RIP: 0010:ext4_getblk+0xf0/0x640
Call Trace:
<TASK>
ext4_get_link+0x26c/0x410
pick_link+0xf96/0x1780
step_into_slowpath+0x9b8/0x1250
path_lookupat+0x484/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
vfs_fstatat+0x4d/0x90
__do_sys_newfstatat+0xa0/0x100
do_syscall_64+0x10e/0x5e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
So far that has been hard to hit. umount(2) waits for a grace period in
namespace_unlock() before it drops the mount, so only a mount whose last
reference goes away elsewhere, like the close of a file or a chdir out of
a lazily unmounted directory, can race a walker.
Keep sb->s_fs_info and free the sbi together with the extent status
counters after a grace period. Split the counters out of
ext4_es_unregister_shrinker() for that. The shrinker still gets wasted
in ext4_put_super(), the counters go with the sbi.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6493792d3299b3e33f887ef8a150099d271faf9c Version: 6493792d3299b3e33f887ef8a150099d271faf9c Version: 6493792d3299b3e33f887ef8a150099d271faf9c Version: 6493792d3299b3e33f887ef8a150099d271faf9c Version: 6493792d3299b3e33f887ef8a150099d271faf9c Version: 6493792d3299b3e33f887ef8a150099d271faf9c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/extents-test.c",
"fs/ext4/extents.c",
"fs/ext4/extents_status.c",
"fs/ext4/extents_status.h",
"fs/ext4/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf3bd5824c985b350d150bcd76698ee5e993fcba",
"status": "affected",
"version": "6493792d3299b3e33f887ef8a150099d271faf9c",
"versionType": "git"
},
{
"lessThan": "b4b0598fad51a978fcbda9d55eef6b5bd3cbe7d8",
"status": "affected",
"version": "6493792d3299b3e33f887ef8a150099d271faf9c",
"versionType": "git"
},
{
"lessThan": "4ce0e27ea610663a9cdc04e3bca38559147428d4",
"status": "affected",
"version": "6493792d3299b3e33f887ef8a150099d271faf9c",
"versionType": "git"
},
{
"lessThan": "80d5db1686b05fad6f384be017714297d828a714",
"status": "affected",
"version": "6493792d3299b3e33f887ef8a150099d271faf9c",
"versionType": "git"
},
{
"lessThan": "87d29b8b849738d52fe820d495fa0aa2d5a1ec82",
"status": "affected",
"version": "6493792d3299b3e33f887ef8a150099d271faf9c",
"versionType": "git"
},
{
"lessThan": "c17b44266a1f9fcb49b894d4611d1254bf1aa313",
"status": "affected",
"version": "6493792d3299b3e33f887ef8a150099d271faf9c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/extents-test.c",
"fs/ext4/extents.c",
"fs/ext4/extents_status.c",
"fs/ext4/extents_status.h",
"fs/ext4/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: free the sbi after a grace period\n\next4_get_link() follows a symlink that keeps its target in a data block\nin rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT).\nThat reads s_mount_state in the ASSERT() of ext4_getblk() and again in\next4_es_lookup_extent(), and the lookup bumps the extent status hit or\nmiss counter, all through sb-\u003es_fs_info.\n\next4_put_super() destroys those counters, clears sb-\u003es_fs_info and frees\nthe sbi without waiting for a grace period. A pathwalk that is still in\next4_get_link() when the last reference to the mount goes away then\ndereferences a NULL s_fs_info, the freed sbi or the destroyed percpu\ncounters.\n\nWith a pathwalk held up in ext4_get_link() while the last reference\ngoes away:\n\n KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]\n RIP: 0010:ext4_getblk+0xf0/0x640\n Call Trace:\n \u003cTASK\u003e\n ext4_get_link+0x26c/0x410\n pick_link+0xf96/0x1780\n step_into_slowpath+0x9b8/0x1250\n path_lookupat+0x484/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n vfs_fstatat+0x4d/0x90\n __do_sys_newfstatat+0xa0/0x100\n do_syscall_64+0x10e/0x5e0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSo far that has been hard to hit. umount(2) waits for a grace period in\nnamespace_unlock() before it drops the mount, so only a mount whose last\nreference goes away elsewhere, like the close of a file or a chdir out of\na lazily unmounted directory, can race a walker.\n\nKeep sb-\u003es_fs_info and free the sbi together with the extent status\ncounters after a grace period. Split the counters out of\next4_es_unregister_shrinker() for that. The shrinker still gets wasted\nin ext4_put_super(), the counters go with the sbi."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:37.969Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf3bd5824c985b350d150bcd76698ee5e993fcba"
},
{
"url": "https://git.kernel.org/stable/c/b4b0598fad51a978fcbda9d55eef6b5bd3cbe7d8"
},
{
"url": "https://git.kernel.org/stable/c/4ce0e27ea610663a9cdc04e3bca38559147428d4"
},
{
"url": "https://git.kernel.org/stable/c/80d5db1686b05fad6f384be017714297d828a714"
},
{
"url": "https://git.kernel.org/stable/c/87d29b8b849738d52fe820d495fa0aa2d5a1ec82"
},
{
"url": "https://git.kernel.org/stable/c/c17b44266a1f9fcb49b894d4611d1254bf1aa313"
}
],
"title": "ext4: free the sbi after a grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99174",
"datePublished": "2026-10-28T10:35:28.758Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:37.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98131 (GCVE-0-2026-98131)
Vulnerability from cvelistv5
Published
2026-09-25 10:36
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
In stmmac_tso_xmit(), if the DMA mapping of an skb fragment fails, the
frame is dropped but the DMA mappings already created for the linear
part and for the fragments mapped before the failure are never
unmapped, leaking DMA mappings.
Fix the leak by walking back over the descriptors used by the frame and
releasing each of them with stmmac_free_tx_buffer(). Moreover, release
the descriptors with stmmac_release_tx_desc() unmapping the DMA buffers.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5449b635362cb678d29d8f6ab54e65734d891ce",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "8a3257f142ae513d0c96d42f97386d4941bcec29",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "e85adaac3dc6317cae902372c6849189ec62cf7d",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
},
{
"lessThan": "a5d946466a95621fa2769720d59ea336003aa1a5",
"status": "affected",
"version": "f748be531d7012c456b97f66091d86b3675c5fef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix dma mapping leak in stmmac_tso_xmit()\n\nIn stmmac_tso_xmit(), if the DMA mapping of an skb fragment fails, the\nframe is dropped but the DMA mappings already created for the linear\npart and for the fragments mapped before the failure are never\nunmapped, leaking DMA mappings.\n\nFix the leak by walking back over the descriptors used by the frame and\nreleasing each of them with stmmac_free_tx_buffer(). Moreover, release\nthe descriptors with stmmac_release_tx_desc() unmapping the DMA buffers."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:39.509Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5449b635362cb678d29d8f6ab54e65734d891ce"
},
{
"url": "https://git.kernel.org/stable/c/8a3257f142ae513d0c96d42f97386d4941bcec29"
},
{
"url": "https://git.kernel.org/stable/c/e85adaac3dc6317cae902372c6849189ec62cf7d"
},
{
"url": "https://git.kernel.org/stable/c/a5d946466a95621fa2769720d59ea336003aa1a5"
}
],
"title": "net: stmmac: fix dma mapping leak in stmmac_tso_xmit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98131",
"datePublished": "2026-09-25T10:36:11.043Z",
"dateReserved": "2026-09-25T10:25:14.318Z",
"dateUpdated": "2026-10-21T12:54:39.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90343 (GCVE-0-2026-90343)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: stop PMSR before P2P and NAN teardown
PMSR request teardown must abort active measurements while the
wireless_dev is still present in the driver. cfg80211_leave_locked() and
cfg80211_stop_pd() already do this before invoking the driver's stop
callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not.
Those helpers are also called directly by nl80211, rfkill shutdown, and
wireless_dev unregister paths. If one of these paths stops a P2P device
or NAN interface with a pending request, it removes the mac80211
subinterface from the driver first. Subsequent request cleanup cannot
reach the lower driver's abort callback, but cfg80211 frees the request
regardless. Driver state can then retain a stale request and use it when
it later reports a result.
Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN
interface. This keeps lower-driver request state and cfg80211 request
ownership in sync for all of the helpers' callers.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af158188ef7b4e89d0a3c04680a98d90b3822ec5",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "9374943fc5a45915e4ea8b597b6a17d3b571bcbf",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "dc1e41df6e683ff9522bf40dd3125ed7ccd8a4e4",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "7a22cbc6c6bdd3c3811b4ce13875685c520f94de",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "db3439ad11ac5e52decdefe784c98b21c3757848",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "6c5fc504d0d6934132637aa3db4b9b58148eaa78",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: stop PMSR before P2P and NAN teardown\n\nPMSR request teardown must abort active measurements while the\nwireless_dev is still present in the driver. cfg80211_leave_locked() and\ncfg80211_stop_pd() already do this before invoking the driver\u0027s stop\ncallback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not.\n\nThose helpers are also called directly by nl80211, rfkill shutdown, and\nwireless_dev unregister paths. If one of these paths stops a P2P device\nor NAN interface with a pending request, it removes the mac80211\nsubinterface from the driver first. Subsequent request cleanup cannot\nreach the lower driver\u0027s abort callback, but cfg80211 frees the request\nregardless. Driver state can then retain a stale request and use it when\nit later reports a result.\n\nCall cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN\ninterface. This keeps lower-driver request state and cfg80211 request\nownership in sync for all of the helpers\u0027 callers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is created when nl80211_stop_p2p_device() or nl80211_stop_nan() (also cfg80211_shutdown_all_interfaces() and _cfg80211_unregister_wdev()) call cfg80211_stop_p2p_device()/cfg80211_stop_nan() with a pending cfg80211_pmsr_request still on wdev-\u003epmsr_list; those paths are local generic-netlink/rfkill/unregister, not parsing of a received 802.11/FTM frame.\nAC:L - The attacker issues NL80211_CMD_PEER_MEASUREMENT_START (iwlwifi stores mvm-\u003eftm_initiator.req; hwsim stores data-\u003epmsr_request), then NL80211_CMD_STOP_P2P_DEVICE so drv_remove_interface() clears IEEE80211_SDATA_IN_DRIVER, then closes the socket so nl80211_netlink_notify()-\u003ecfg80211_release_pmsr() kfree()s the request while drv_abort_pmsr() returns without calling the driver.\nPR:L - NL80211_CMD_NEW_INTERFACE, NL80211_CMD_START_P2P_DEVICE, NL80211_CMD_PEER_MEASUREMENT_START and NL80211_CMD_STOP_P2P_DEVICE are GENL_UNS_ADMIN_PERM, checked as netlink_ns_capable(skb, net-\u003euser_ns, CAP_NET_ADMIN); an unprivileged user obtains that via unshare -Urn. (STOP_NAN is GENL_ADMIN_PERM, but the P2P path is sufficient.)\nUI:N - The attacker creates/starts the P2P_DEVICE wdev, starts the PMSR request, stops it via NL80211_CMD_STOP_P2P_DEVICE, and closes their own nl80211 socket; no other user must associate, mount, or confirm anything.\nS:U - The dangling cfg80211_pmsr_request is used in-process by iwl_mvm_ftm_range_resp()/iwl_mvm_ftm_restart() and cfg80211_pmsr_report() in the same kernel; this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After kfree(req) in cfg80211_pmsr_process_abort(), iwl_mvm_ftm_range_resp() and iwl_mvm_ftm_restart() still load mvm-\u003eftm_initiator.req-\u003ecookie, n_peers and peers[].addr and pass the object to cfg80211_pmsr_report(); that heap UAF is an arbitrary read primitive.\nI:H - The same stale ftm_initiator.req / hwsim pmsr_request is later passed to cfg80211_pmsr_complete() (list_del on the freed object) and used as live driver state, giving a heap write/control-flow hijack primitive from the UAF.\nA:H - iwl_mvm_ftm_range_resp() dereferences the freed cfg80211_pmsr_request when firmware later delivers a TOF range response (or iwl_mvm_ftm_restart() on FW restart), which oopses the kernel even without a full exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:16.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af158188ef7b4e89d0a3c04680a98d90b3822ec5"
},
{
"url": "https://git.kernel.org/stable/c/9374943fc5a45915e4ea8b597b6a17d3b571bcbf"
},
{
"url": "https://git.kernel.org/stable/c/dc1e41df6e683ff9522bf40dd3125ed7ccd8a4e4"
},
{
"url": "https://git.kernel.org/stable/c/7a22cbc6c6bdd3c3811b4ce13875685c520f94de"
},
{
"url": "https://git.kernel.org/stable/c/db3439ad11ac5e52decdefe784c98b21c3757848"
},
{
"url": "https://git.kernel.org/stable/c/6c5fc504d0d6934132637aa3db4b9b58148eaa78"
}
],
"title": "wifi: cfg80211: stop PMSR before P2P and NAN teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90343",
"datePublished": "2026-09-17T16:08:53.670Z",
"dateReserved": "2026-09-11T19:38:34.804Z",
"dateUpdated": "2026-10-30T12:35:16.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90167 (GCVE-0-2026-90167)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: serialize oplock close with pending break ownership
close may abort an in-flight oplock break while another breaker already
holds an opinfo reference. Releasing pending_break wakes that waiter, but
without serializing the close transition with bit acquisition it can become
a new break owner through the test_and_set_bit() fast path. It can then
overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for
a dying opinfo.
Make OPLOCK_CLOSING terminal once the opinfo is removed from the inode
list. Serialize that transition, pending_break acquisition, and
OPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses
the race releases its ownership and returns -ENOENT. Explicitly wake
pending_break waiters during close so they can observe the terminal state.
Also prevent ACK and timeout paths from replacing OPLOCK_CLOSING with
OPLOCK_STATE_NONE.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/oplock.c",
"fs/smb/server/oplock.h",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02a31a30ccd09f3ff35ab5861c04209c381aa5dd",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "7148a6c06ddf1c263a1cf422bee541f24d3d3926",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "7d6e682b7633120c2f93400b8c6f335d9d8e5318",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "dc1e34f78dfab755fab9ad820ac5f82348fe1792",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "5f97bac88bfb333f426f01c118b8235e75af8d96",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "b0148dc5625dbfd50596ac63c7487c12e8a8ab03",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/oplock.c",
"fs/smb/server/oplock.h",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: serialize oplock close with pending break ownership\n\nclose may abort an in-flight oplock break while another breaker already\nholds an opinfo reference. Releasing pending_break wakes that waiter, but\nwithout serializing the close transition with bit acquisition it can become\na new break owner through the test_and_set_bit() fast path. It can then\noverwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for\na dying opinfo.\n\nMake OPLOCK_CLOSING terminal once the opinfo is removed from the inode\nlist. Serialize that transition, pending_break acquisition, and\nOPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses\nthe race releases its ownership and returns -ENOENT. Explicitly wake\npending_break waiters during close so they can observe the terminal state.\n\nAlso prevent ACK and timeout paths from replacing OPLOCK_CLOSING with\nOPLOCK_STATE_NONE."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:33.398Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02a31a30ccd09f3ff35ab5861c04209c381aa5dd"
},
{
"url": "https://git.kernel.org/stable/c/7148a6c06ddf1c263a1cf422bee541f24d3d3926"
},
{
"url": "https://git.kernel.org/stable/c/7d6e682b7633120c2f93400b8c6f335d9d8e5318"
},
{
"url": "https://git.kernel.org/stable/c/dc1e34f78dfab755fab9ad820ac5f82348fe1792"
},
{
"url": "https://git.kernel.org/stable/c/5f97bac88bfb333f426f01c118b8235e75af8d96"
},
{
"url": "https://git.kernel.org/stable/c/b0148dc5625dbfd50596ac63c7487c12e8a8ab03"
}
],
"title": "ksmbd: serialize oplock close with pending break ownership",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90167",
"datePublished": "2026-09-17T16:06:56.507Z",
"dateReserved": "2026-09-11T19:38:34.790Z",
"dateUpdated": "2026-10-30T12:34:33.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43299 (GCVE-0-2026-43299)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
[BUG]
There is a bug report that when btrfs hits ENOSPC error in a critical
path, btrfs flips RO (this part is expected, although the ENOSPC bug
still needs to be addressed).
The problem is after the RO flip, if there is a read repair pending, we
can hit the ASSERT() inside btrfs_repair_io_failure() like the following:
BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1
------------[ cut here ]------------
BTRFS: Transaction aborted (error -28)
WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844
Modules linked in: kvm_intel kvm irqbypass
[...]
---[ end trace 0000000000000000 ]---
BTRFS info (device vdc state EA): 2 enospc errors during balance
BTRFS info (device vdc state EA): balance: ended with status: -30
BTRFS error (device vdc state EA): parent transid verify failed on logical 30556160 mirror 2 wanted 8 found 6
BTRFS error (device vdc state EA): bdev /dev/nvme0n1 errs: wr 0, rd 0, flush 0, corrupt 10, gen 0
[...]
assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938
------------[ cut here ]------------
assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938
kernel BUG at fs/btrfs/bio.c:938!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 868 Comm: kworker/u8:13 Tainted: G W N 6.19.0-rc6+ #4788 PREEMPT(full)
Tainted: [W]=WARN, [N]=TEST
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Workqueue: btrfs-endio simple_end_io_work
RIP: 0010:btrfs_repair_io_failure.cold+0xb2/0x120
RSP: 0000:ffffc90001d2bcf0 EFLAGS: 00010246
RAX: 0000000000000051 RBX: 0000000000001000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8305cf42 RDI: 00000000ffffffff
RBP: 0000000000000002 R08: 00000000fffeffff R09: ffffffff837fa988
R10: ffffffff8327a9e0 R11: 6f69747265737361 R12: ffff88813018d310
R13: ffff888168b8a000 R14: ffffc90001d2bd90 R15: ffff88810a169000
FS: 0000000000000000(0000) GS:ffff8885e752c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
------------[ cut here ]------------
[CAUSE]
The cause of -ENOSPC error during the test case btrfs/124 is still
unknown, although it's known that we still have cases where metadata can
be over-committed but can not be fulfilled correctly, thus if we hit
such ENOSPC error inside a critical path, we have no choice but abort
the current transaction.
This will mark the fs read-only.
The problem is inside the btrfs_repair_io_failure() path that we require
the fs not to be mount read-only. This is normally fine, but if we are
doing a read-repair meanwhile the fs flips RO due to a critical error,
we can enter btrfs_repair_io_failure() with super block set to
read-only, thus triggering the above crash.
[FIX]
Just replace the ASSERT() with a proper return if the fs is already
read-only.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 908960c6c0fb3b3ce3971dc0ca47b581d256b968 Version: 908960c6c0fb3b3ce3971dc0ca47b581d256b968 Version: 908960c6c0fb3b3ce3971dc0ca47b581d256b968 Version: 908960c6c0fb3b3ce3971dc0ca47b581d256b968 Version: 908960c6c0fb3b3ce3971dc0ca47b581d256b968 Version: 908960c6c0fb3b3ce3971dc0ca47b581d256b968 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "053dd7f3c9647d3a781919c1b14105f46786d677",
"status": "affected",
"version": "908960c6c0fb3b3ce3971dc0ca47b581d256b968",
"versionType": "git"
},
{
"lessThan": "a35b38cb4b0dd08d7cc0bd4e400208c7aeba8a72",
"status": "affected",
"version": "908960c6c0fb3b3ce3971dc0ca47b581d256b968",
"versionType": "git"
},
{
"lessThan": "da3f596073de1c3cbc99941f01296968a85c8c76",
"status": "affected",
"version": "908960c6c0fb3b3ce3971dc0ca47b581d256b968",
"versionType": "git"
},
{
"lessThan": "81e1ae665004b99a10686473d99f0a7cb6335f38",
"status": "affected",
"version": "908960c6c0fb3b3ce3971dc0ca47b581d256b968",
"versionType": "git"
},
{
"lessThan": "f6df18c001e3dcebc08482d0adeacd0cfea08593",
"status": "affected",
"version": "908960c6c0fb3b3ce3971dc0ca47b581d256b968",
"versionType": "git"
},
{
"lessThan": "8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3",
"status": "affected",
"version": "908960c6c0fb3b3ce3971dc0ca47b581d256b968",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/bio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()\n\n[BUG]\nThere is a bug report that when btrfs hits ENOSPC error in a critical\npath, btrfs flips RO (this part is expected, although the ENOSPC bug\nstill needs to be addressed).\n\nThe problem is after the RO flip, if there is a read repair pending, we\ncan hit the ASSERT() inside btrfs_repair_io_failure() like the following:\n\n BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1\n ------------[ cut here ]------------\n BTRFS: Transaction aborted (error -28)\n WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844\n Modules linked in: kvm_intel kvm irqbypass\n [...]\n ---[ end trace 0000000000000000 ]---\n BTRFS info (device vdc state EA): 2 enospc errors during balance\n BTRFS info (device vdc state EA): balance: ended with status: -30\n BTRFS error (device vdc state EA): parent transid verify failed on logical 30556160 mirror 2 wanted 8 found 6\n BTRFS error (device vdc state EA): bdev /dev/nvme0n1 errs: wr 0, rd 0, flush 0, corrupt 10, gen 0\n [...]\n assertion failed: !(fs_info-\u003esb-\u003es_flags \u0026 SB_RDONLY) :: 0, in fs/btrfs/bio.c:938\n ------------[ cut here ]------------\n assertion failed: !(fs_info-\u003esb-\u003es_flags \u0026 SB_RDONLY) :: 0, in fs/btrfs/bio.c:938\n kernel BUG at fs/btrfs/bio.c:938!\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n CPU: 0 UID: 0 PID: 868 Comm: kworker/u8:13 Tainted: G W N 6.19.0-rc6+ #4788 PREEMPT(full)\n Tainted: [W]=WARN, [N]=TEST\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n Workqueue: btrfs-endio simple_end_io_work\n RIP: 0010:btrfs_repair_io_failure.cold+0xb2/0x120\n RSP: 0000:ffffc90001d2bcf0 EFLAGS: 00010246\n RAX: 0000000000000051 RBX: 0000000000001000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffffffff8305cf42 RDI: 00000000ffffffff\n RBP: 0000000000000002 R08: 00000000fffeffff R09: ffffffff837fa988\n R10: ffffffff8327a9e0 R11: 6f69747265737361 R12: ffff88813018d310\n R13: ffff888168b8a000 R14: ffffc90001d2bd90 R15: ffff88810a169000\n FS: 0000000000000000(0000) GS:ffff8885e752c000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n ------------[ cut here ]------------\n\n[CAUSE]\nThe cause of -ENOSPC error during the test case btrfs/124 is still\nunknown, although it\u0027s known that we still have cases where metadata can\nbe over-committed but can not be fulfilled correctly, thus if we hit\nsuch ENOSPC error inside a critical path, we have no choice but abort\nthe current transaction.\n\nThis will mark the fs read-only.\n\nThe problem is inside the btrfs_repair_io_failure() path that we require\nthe fs not to be mount read-only. This is normally fine, but if we are\ndoing a read-repair meanwhile the fs flips RO due to a critical error,\nwe can enter btrfs_repair_io_failure() with super block set to\nread-only, thus triggering the above crash.\n\n[FIX]\nJust replace the ASSERT() with a proper return if the fs is already\nread-only."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:23.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/053dd7f3c9647d3a781919c1b14105f46786d677"
},
{
"url": "https://git.kernel.org/stable/c/a35b38cb4b0dd08d7cc0bd4e400208c7aeba8a72"
},
{
"url": "https://git.kernel.org/stable/c/da3f596073de1c3cbc99941f01296968a85c8c76"
},
{
"url": "https://git.kernel.org/stable/c/81e1ae665004b99a10686473d99f0a7cb6335f38"
},
{
"url": "https://git.kernel.org/stable/c/f6df18c001e3dcebc08482d0adeacd0cfea08593"
},
{
"url": "https://git.kernel.org/stable/c/8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3"
}
],
"title": "btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43299",
"datePublished": "2026-05-08T13:11:20.872Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-10-30T12:25:23.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99154 (GCVE-0-2026-99154)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
A transport that implements parse_pdu_itt hands libiscsi an index taken
from the PDU, and both lookups bound it from above only:
if (i >= session->cmds_max)
i and cmds_max are both int, so a negative index passes and
session->cmds[i] is read from before the array.
be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,
*index = (int)itt;
and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the
hardware async ring without replacing its ITT, so the value is the
target's. It also reports the session's own age rather than the one in
the tag, which leaves the age comparison in iscsi_verify_itt() with
nothing to reject.
Bound the index from below in both lookups.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb Version: bfead3b2cb4607c71831423c3ee97d22cd0c9dcb |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24bd9ba431b2daa263f3551bc2f09f6b4487f5ae",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "f8fabe1fe044f86abc42194b8f86dfd70212115f",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "e896a97f336c5edfc13066b57ed431cb3f64e68c",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "6200fb2de579f268742a77b0f3d823cb0a8b1947",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "0eb06ebbbecb122f0df9a1f7f623f5255be741ed",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "6cadfa6f1f5896632d4223d3b7addb2a29fea74e",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "35b60549a956237488c89a2d85352e026e7d55b7",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
},
{
"lessThan": "8ee2a09a1dbb257c9e828ad2497f8e4832dfb142",
"status": "affected",
"version": "bfead3b2cb4607c71831423c3ee97d22cd0c9dcb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Reject a negative task index from parse_pdu_itt\n\nA transport that implements parse_pdu_itt hands libiscsi an index taken\nfrom the PDU, and both lookups bound it from above only:\n\n if (i \u003e= session-\u003ecmds_max)\n\ni and cmds_max are both int, so a negative index passes and\nsession-\u003ecmds[i] is read from before the array.\n\nbe2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag,\n\n *index = (int)itt;\n\nand beiscsi_complete_pdu() forwards an unsolicited NOP-In from the\nhardware async ring without replacing its ITT, so the value is the\ntarget\u0027s. It also reports the session\u0027s own age rather than the one in\nthe tag, which leaves the age comparison in iscsi_verify_itt() with\nnothing to reject.\n\nBound the index from below in both lookups."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A target-supplied iSCSI NOP-In enters through be_isr_msix()/be_iopoll() and flows via beiscsi_process_cq() and beiscsi_complete_pdu() to patched iscsi_verify_itt()/iscsi_itt_to_task(); beiscsi_parse_pdu() derives the negative index directly from the wire ITT.\nAC:L - On an affected be2iscsi connection, one NOP-In whose raw ITT casts negative deterministically passes the old upper-only checks. The sender chooses the ITT, and no race, timing window, or uncontrollable state is required.\nPR:N - The remote iSCSI target needs no host privilege: beiscsi_complete_pdu() accepts the hardware-ring NOP-In and __iscsi_complete_pdu() calls iscsi_verify_itt() without a credential or session-state gate. CAP_SYS_ADMIN governs local netlink setup, not this receive path.\nUI:N - The IRQ-poll path automatically processes the target\u0027s NOP-In through beiscsi_hdq_process_compl() and beiscsi_hdl_fwd_pdu(); no user must open a file, issue I/O, or approve the malformed PDU.\nS:U - The invalid session-\u003ecmds lookup and subsequent iscsi_task and be2iscsi resource corruption occur within the initiator host kernel; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - beiscsi_parse_pdu() supplies attacker-controlled signed i to iscsi_itt_to_task(), permitting a pointer-sized read at an attacker-selected offset before session-\u003ecmds. The loaded pointer is then dereferenced as an iscsi_task, making this an unbounded kernel-memory read and type-confusion primitive.\nI:H - iscsi_pool_init() places its original task-pointer table immediately before session-\u003ecmds, so negative indices can select real unrelated tasks. iscsi_complete_task() then changes task state/refcounts and can invoke beiscsi_cleanup_task() to free live DMA, WRB, and SGL resources.\nA:H - A farther-negative index can fault while reading session-\u003ecmds[i], while an index resolving to a never-used task reaches iscsi_nop_out_rsp() with task-\u003econn NULL. A single target-supplied NOP-In can therefore oops or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:09.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24bd9ba431b2daa263f3551bc2f09f6b4487f5ae"
},
{
"url": "https://git.kernel.org/stable/c/f8fabe1fe044f86abc42194b8f86dfd70212115f"
},
{
"url": "https://git.kernel.org/stable/c/e896a97f336c5edfc13066b57ed431cb3f64e68c"
},
{
"url": "https://git.kernel.org/stable/c/6200fb2de579f268742a77b0f3d823cb0a8b1947"
},
{
"url": "https://git.kernel.org/stable/c/0eb06ebbbecb122f0df9a1f7f623f5255be741ed"
},
{
"url": "https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74e"
},
{
"url": "https://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7"
},
{
"url": "https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142"
}
],
"title": "scsi: libiscsi: Reject a negative task index from parse_pdu_itt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99154",
"datePublished": "2026-10-28T10:35:08.968Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-31T12:44:09.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99014 (GCVE-0-2026-99014)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-24 14:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
address used for the PA_LINK lookup from hci_sent_cmd_data(). The
returned pointer borrows storage from sent_cmd or req_skb, without
holding a reference to either skb.
The scan worker runs on req_workqueue while hci_cmd_work() runs on the
separate device workqueue. After the scan worker loads sent_cmd, the
command worker can free and replace it before hci_sent_cmd_data()
dereferences the skb. The command payload can also be freed between
returning from the helper and comparing the address. The connection
lookup's RCU critical section does not protect the command skb.
KASAN reported:
BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
hci_sent_cmd_data+0x27c/0x2f0
hci_le_set_scan_param_sync+0x43a/0x850
hci_passive_scan_sync+0xb09/0x1460
hci_update_passive_scan_sync+0x47c/0x6e0
hci_le_pa_create_sync+0x200/0xa70
hci_cmd_sync_work+0x13c/0x290
Allocated by task 95:
skb_clone+0x13f/0x340
hci_cmd_work+0x2a9/0x7e0
Freed by task 95:
kmem_cache_free+0xba/0x3a0
hci_cmd_work+0x29c/0x7e0
Use hdev->lock to serialize the address snapshot with sent_cmd
replacement. Protect req_skb replacement and completion cleanup with
the same lock because the helper falls back to that skb. Copy the
address before releasing the lock and use the copy for the existing
RCU-protected connection lookup. Release the mutex before sending or
waiting for commands, preserving the lookup and completion ordering.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: de3c85d321bfb85b7742a6cfab95d680da3e26b1 Version: 22cbf4f84c00da64196eb15034feee868e63eef0 Version: 22cbf4f84c00da64196eb15034feee868e63eef0 Version: 22cbf4f84c00da64196eb15034feee868e63eef0 Version: 22cbf4f84c00da64196eb15034feee868e63eef0 Version: 7a54f8314584f78fb0557153b1059924249ef628 Version: 6.6.28 ≤ Version: 6.8.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_core.c",
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f01cbddfb4273fcc9a786d13b0a2525029023605",
"status": "affected",
"version": "de3c85d321bfb85b7742a6cfab95d680da3e26b1",
"versionType": "git"
},
{
"lessThan": "119ba8070b3f112dd36c897f4f70ea5bb7d370b8",
"status": "affected",
"version": "22cbf4f84c00da64196eb15034feee868e63eef0",
"versionType": "git"
},
{
"lessThan": "7db33b36213a3a1a40940c009ddac30670b55922",
"status": "affected",
"version": "22cbf4f84c00da64196eb15034feee868e63eef0",
"versionType": "git"
},
{
"lessThan": "762850c203fab1190ad6a3de41cd51920b22236d",
"status": "affected",
"version": "22cbf4f84c00da64196eb15034feee868e63eef0",
"versionType": "git"
},
{
"lessThan": "9af12272061d206af8bc3e40215cb694421ab73a",
"status": "affected",
"version": "22cbf4f84c00da64196eb15034feee868e63eef0",
"versionType": "git"
},
{
"status": "affected",
"version": "7a54f8314584f78fb0557153b1059924249ef628",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.28",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_core.c",
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix command skb lifetime during scan setup\n\nDuring PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the\naddress used for the PA_LINK lookup from hci_sent_cmd_data(). The\nreturned pointer borrows storage from sent_cmd or req_skb, without\nholding a reference to either skb.\n\nThe scan worker runs on req_workqueue while hci_cmd_work() runs on the\nseparate device workqueue. After the scan worker loads sent_cmd, the\ncommand worker can free and replace it before hci_sent_cmd_data()\ndereferences the skb. The command payload can also be freed between\nreturning from the helper and comparing the address. The connection\nlookup\u0027s RCU critical section does not protect the command skb.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0\n Workqueue: hci0 hci_cmd_sync_work\n Call Trace:\n hci_sent_cmd_data+0x27c/0x2f0\n hci_le_set_scan_param_sync+0x43a/0x850\n hci_passive_scan_sync+0xb09/0x1460\n hci_update_passive_scan_sync+0x47c/0x6e0\n hci_le_pa_create_sync+0x200/0xa70\n hci_cmd_sync_work+0x13c/0x290\n\n Allocated by task 95:\n skb_clone+0x13f/0x340\n hci_cmd_work+0x2a9/0x7e0\n\n Freed by task 95:\n kmem_cache_free+0xba/0x3a0\n hci_cmd_work+0x29c/0x7e0\n\nUse hdev-\u003elock to serialize the address snapshot with sent_cmd\nreplacement. Protect req_skb replacement and completion cleanup with\nthe same lock because the helper falls back to that skb. Copy the\naddress before releasing the lock and use the copy for the existing\nRCU-protected connection lookup. Release the mutex before sending or\nwaiting for commands, preserving the lookup and completion ordering."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local listen(2) on a broadcast BTPROTO_ISO socket reaches iso_sock_listen() \u2192 iso_listen_bis() \u2192 hci_pa_create_sync() \u2192 hci_le_pa_create_sync() \u2192 hci_le_set_ext_scan_param_sync(). No received Bluetooth PDU initiates this PA-sync setup.\nAC:L - The attacker can run the ISO listen while flooding security-filter-permitted HCI_OP_READ_LOCAL_VERSION commands through a raw HCI socket; hci_sock_sendmsg() queues them on hdev-\u003ecmd_q, making hci_cmd_work() race hci_sent_cmd_data() on the separate req_workqueue.\nPR:L - iso_sock_create(), bind(), and listen() have no capability check, while an unprivileged raw HCI socket may submit HCI_OP_READ_LOCAL_VERSION because OGF_INFO_PARAM/OCF 1 is in hci_sec_filter. Bluetooth sockets require init_net, but an ordinary host user satisfies that condition.\nUI:N - The attacking process itself binds and listens on the broadcast ISO socket and submits the racing raw HCI commands; no separate victim action is needed once ISO sockets and the adapter are enabled.\nS:U - The stale sent_cmd or req_skb and resulting memory access remain within the host kernel\u0027s Bluetooth authority; hci_le_set_ext_scan_param_sync() crosses no VM, IOMMU, or other security boundary.\nC:H - hci_cmd_data() dereferences len and data from a freed sk_buff, and the returned command-payload pointer can itself be freed before the six-byte bdaddr read. Reclaiming the sprayable skbuff_head_cache object therefore supplies an attacker-directed stale-pointer read primitive.\nI:H - A reclaimed command sk_buff controls the stale len/data fields and the bdaddr used to select a PA_LINK, whose iso_qos then determines the HCI_OP_LE_SET_EXT_SCAN_PARAMS command. This sprayable kernel use-after-free is an integrity-high memory-corruption primitive.\nA:H - KASAN confirmed a slab-use-after-free in hci_sent_cmd_data(); dereferencing the freed sk_buff or its released payload can fault in hci_cmd_sync_work and cause a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:10:02.640Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f01cbddfb4273fcc9a786d13b0a2525029023605"
},
{
"url": "https://git.kernel.org/stable/c/119ba8070b3f112dd36c897f4f70ea5bb7d370b8"
},
{
"url": "https://git.kernel.org/stable/c/7db33b36213a3a1a40940c009ddac30670b55922"
},
{
"url": "https://git.kernel.org/stable/c/762850c203fab1190ad6a3de41cd51920b22236d"
},
{
"url": "https://git.kernel.org/stable/c/9af12272061d206af8bc3e40215cb694421ab73a"
}
],
"title": "Bluetooth: hci_sync: Fix command skb lifetime during scan setup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99014",
"datePublished": "2026-10-23T12:20:39.617Z",
"dateReserved": "2026-09-25T10:25:14.385Z",
"dateUpdated": "2026-10-24T14:10:02.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99118 (GCVE-0-2026-99118)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Harden DMC firmware payload parsing
Validate the conversion of the DMC firmware size from dwords to bytes
using check_mul_overflow() before calculating the firmware payload size.
Reject zero-length payloads and zero MMIO counts in the DMC firmware
header so malformed firmware is caught early. Also set dmc_fw_size only
after the payload allocation succeeds.
(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d Version: eb805623d8b161342ed9c9caf366f0a295041a6d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_dmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e396088fa5c1f96ff43de29c2a2f8807078723d",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "53068cf3851dd4e00e8e668563e0353d9d79a98b",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "e33921271d4438f4a24014f560e5ab297d7eda3f",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "4589ad76a6b1011538600ad398baf0b7d73a1252",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "eb7a0ba650d607976d1a0a5e7501d3f14b35d026",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
},
{
"lessThan": "8bb1858db453cd4250e3b633f5d2d09206024ca6",
"status": "affected",
"version": "eb805623d8b161342ed9c9caf366f0a295041a6d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_dmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Harden DMC firmware payload parsing\n\nValidate the conversion of the DMC firmware size from dwords to bytes\nusing check_mul_overflow() before calculating the firmware payload size.\n\nReject zero-length payloads and zero MMIO counts in the DMC firmware\nheader so malformed firmware is caught early. Also set dmc_fw_size only\nafter the payload allocation succeeds.\n\n(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:55.667Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e396088fa5c1f96ff43de29c2a2f8807078723d"
},
{
"url": "https://git.kernel.org/stable/c/53068cf3851dd4e00e8e668563e0353d9d79a98b"
},
{
"url": "https://git.kernel.org/stable/c/e33921271d4438f4a24014f560e5ab297d7eda3f"
},
{
"url": "https://git.kernel.org/stable/c/4589ad76a6b1011538600ad398baf0b7d73a1252"
},
{
"url": "https://git.kernel.org/stable/c/eb7a0ba650d607976d1a0a5e7501d3f14b35d026"
},
{
"url": "https://git.kernel.org/stable/c/dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa"
},
{
"url": "https://git.kernel.org/stable/c/05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d"
},
{
"url": "https://git.kernel.org/stable/c/8bb1858db453cd4250e3b633f5d2d09206024ca6"
}
],
"title": "drm/i915/dmc: Harden DMC firmware payload parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99118",
"datePublished": "2026-10-28T10:34:34.627Z",
"dateReserved": "2026-09-25T10:25:14.393Z",
"dateUpdated": "2026-10-30T12:41:55.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46071 (GCVE-0-2026-46071)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.
However, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and
clearing clean bits in vmcb12 is not architecturally defined.
Move vmcb_mark_dirty() to callers and drop it for vmcb12.
This also facilitates incoming refactoring that does not pass the entire
VMCB to svm_copy_lbrs().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d20c796ca3709801f8a7fa36e8770a3dd8ebd34e Version: d20c796ca3709801f8a7fa36e8770a3dd8ebd34e Version: d20c796ca3709801f8a7fa36e8770a3dd8ebd34e Version: d20c796ca3709801f8a7fa36e8770a3dd8ebd34e Version: d20c796ca3709801f8a7fa36e8770a3dd8ebd34e Version: d20c796ca3709801f8a7fa36e8770a3dd8ebd34e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46071",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:07:20.631190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:35.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7fefb393a926bdfe445c63b4091185ed7da2733",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "165b08d2d1346dce5ed43db65e10f3194b9ae2fe",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "11d347b7edf5093d69aca72317300798a32bfd6b",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "a3f0981a5a0e0bd51ad74cc7d9eed32294b24002",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "9efe23568806d1cd06f7d146f9b3037b8d585a9f",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "b53ab5167a81537777ac780bbd93d32613aa3bda",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Avoid clearing VMCB_LBR in vmcb12\n\nsvm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.\nHowever, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and\nclearing clean bits in vmcb12 is not architecturally defined.\n\nMove vmcb_mark_dirty() to callers and drop it for vmcb12.\n\nThis also facilitates incoming refactoring that does not pass the entire\nVMCB to svm_copy_lbrs()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:59.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7fefb393a926bdfe445c63b4091185ed7da2733"
},
{
"url": "https://git.kernel.org/stable/c/165b08d2d1346dce5ed43db65e10f3194b9ae2fe"
},
{
"url": "https://git.kernel.org/stable/c/11d347b7edf5093d69aca72317300798a32bfd6b"
},
{
"url": "https://git.kernel.org/stable/c/a3f0981a5a0e0bd51ad74cc7d9eed32294b24002"
},
{
"url": "https://git.kernel.org/stable/c/9efe23568806d1cd06f7d146f9b3037b8d585a9f"
},
{
"url": "https://git.kernel.org/stable/c/b53ab5167a81537777ac780bbd93d32613aa3bda"
}
],
"title": "KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46071",
"datePublished": "2026-05-27T12:57:57.316Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-11-06T16:13:35.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31562 (GCVE-0-2026-31562)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-10-21 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register
The call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind,
which uses dev_get_drvdata to retrieve the mtk_dsi struct, so this
structure needs to be stored inside the driver data before invoking it.
As drvdata is currently uninitialized it leads to a crash when
registering the DSI DRM encoder right after acquiring
the mode_config.idr_mutex, blocking all subsequent DRM operations.
Fixes the following crash during mediatek-drm probe (tested on Xiaomi
Smart Clock x04g):
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000040
[...]
Modules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib
drm_dma_helper drm_kms_helper panel_simple
[...]
Call trace:
drm_mode_object_add+0x58/0x98 (P)
__drm_encoder_init+0x48/0x140
drm_encoder_init+0x6c/0xa0
drm_simple_encoder_init+0x20/0x34 [drm_kms_helper]
mtk_dsi_bind+0x34/0x13c [mediatek_drm]
component_bind_all+0x120/0x280
mtk_drm_bind+0x284/0x67c [mediatek_drm]
try_to_bring_up_aggregate_device+0x23c/0x320
__component_add+0xa4/0x198
component_add+0x14/0x20
mtk_dsi_host_attach+0x78/0x100 [mediatek_drm]
mipi_dsi_attach+0x2c/0x50
panel_simple_dsi_probe+0x4c/0x9c [panel_simple]
mipi_dsi_drv_probe+0x1c/0x28
really_probe+0xc0/0x3dc
__driver_probe_device+0x80/0x160
driver_probe_device+0x40/0x120
__device_attach_driver+0xbc/0x17c
bus_for_each_drv+0x88/0xf0
__device_attach+0x9c/0x1cc
device_initial_probe+0x54/0x60
bus_probe_device+0x34/0xa0
device_add+0x5b0/0x800
mipi_dsi_device_register_full+0xdc/0x16c
mipi_dsi_host_register+0xc4/0x17c
mtk_dsi_probe+0x10c/0x260 [mediatek_drm]
platform_probe+0x5c/0xa4
really_probe+0xc0/0x3dc
__driver_probe_device+0x80/0x160
driver_probe_device+0x40/0x120
__driver_attach+0xc8/0x1f8
bus_for_each_dev+0x7c/0xe0
driver_attach+0x24/0x30
bus_add_driver+0x11c/0x240
driver_register+0x68/0x130
__platform_register_drivers+0x64/0x160
mtk_drm_init+0x24/0x1000 [mediatek_drm]
do_one_initcall+0x60/0x1d0
do_init_module+0x54/0x240
load_module+0x1838/0x1dc0
init_module_from_file+0xd8/0xf0
__arm64_sys_finit_module+0x1b4/0x428
invoke_syscall.constprop.0+0x48/0xc8
do_el0_svc+0x3c/0xb8
el0_svc+0x34/0xe8
el0t_64_sync_handler+0xa0/0xe4
el0t_64_sync+0x198/0x19c
Code: 52800022 941004ab 2a0003f3 37f80040 (29005a80)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57b4864ca02f76d7debe8ce14c912335aef16055",
"status": "affected",
"version": "e4732b590a77318dff134612b013d66d2448ab20",
"versionType": "git"
},
{
"lessThan": "9a709b7e36324dfc1e6728eb81405470b7ae84e5",
"status": "affected",
"version": "e4732b590a77318dff134612b013d66d2448ab20",
"versionType": "git"
},
{
"lessThan": "df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b",
"status": "affected",
"version": "e4732b590a77318dff134612b013d66d2448ab20",
"versionType": "git"
},
{
"lessThan": "4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a",
"status": "affected",
"version": "e4732b590a77318dff134612b013d66d2448ab20",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register\n\nThe call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind,\nwhich uses dev_get_drvdata to retrieve the mtk_dsi struct, so this\nstructure needs to be stored inside the driver data before invoking it.\n\nAs drvdata is currently uninitialized it leads to a crash when\nregistering the DSI DRM encoder right after acquiring\nthe mode_config.idr_mutex, blocking all subsequent DRM operations.\n\nFixes the following crash during mediatek-drm probe (tested on Xiaomi\nSmart Clock x04g):\n\nUnable to handle kernel NULL pointer dereference at virtual address\n 0000000000000040\n[...]\nModules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib\n drm_dma_helper drm_kms_helper panel_simple\n[...]\nCall trace:\n drm_mode_object_add+0x58/0x98 (P)\n __drm_encoder_init+0x48/0x140\n drm_encoder_init+0x6c/0xa0\n drm_simple_encoder_init+0x20/0x34 [drm_kms_helper]\n mtk_dsi_bind+0x34/0x13c [mediatek_drm]\n component_bind_all+0x120/0x280\n mtk_drm_bind+0x284/0x67c [mediatek_drm]\n try_to_bring_up_aggregate_device+0x23c/0x320\n __component_add+0xa4/0x198\n component_add+0x14/0x20\n mtk_dsi_host_attach+0x78/0x100 [mediatek_drm]\n mipi_dsi_attach+0x2c/0x50\n panel_simple_dsi_probe+0x4c/0x9c [panel_simple]\n mipi_dsi_drv_probe+0x1c/0x28\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __device_attach_driver+0xbc/0x17c\n bus_for_each_drv+0x88/0xf0\n __device_attach+0x9c/0x1cc\n device_initial_probe+0x54/0x60\n bus_probe_device+0x34/0xa0\n device_add+0x5b0/0x800\n mipi_dsi_device_register_full+0xdc/0x16c\n mipi_dsi_host_register+0xc4/0x17c\n mtk_dsi_probe+0x10c/0x260 [mediatek_drm]\n platform_probe+0x5c/0xa4\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __driver_attach+0xc8/0x1f8\n bus_for_each_dev+0x7c/0xe0\n driver_attach+0x24/0x30\n bus_add_driver+0x11c/0x240\n driver_register+0x68/0x130\n __platform_register_drivers+0x64/0x160\n mtk_drm_init+0x24/0x1000 [mediatek_drm]\n do_one_initcall+0x60/0x1d0\n do_init_module+0x54/0x240\n load_module+0x1838/0x1dc0\n init_module_from_file+0xd8/0xf0\n __arm64_sys_finit_module+0x1b4/0x428\n invoke_syscall.constprop.0+0x48/0xc8\n do_el0_svc+0x3c/0xb8\n el0_svc+0x34/0xe8\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800022 941004ab 2a0003f3 37f80040 (29005a80)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:29.897Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57b4864ca02f76d7debe8ce14c912335aef16055"
},
{
"url": "https://git.kernel.org/stable/c/9a709b7e36324dfc1e6728eb81405470b7ae84e5"
},
{
"url": "https://git.kernel.org/stable/c/df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b"
},
{
"url": "https://git.kernel.org/stable/c/4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a"
}
],
"title": "drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31562",
"datePublished": "2026-04-24T14:35:43.950Z",
"dateReserved": "2026-03-09T15:48:24.116Z",
"dateUpdated": "2026-10-21T12:39:29.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90231 (GCVE-0-2026-90231)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix unconfined user namespace restriction forced stack
If a task is already confined by a stack the unprivileged transition
restriction on unconfined is not correctly, applied. This results in
an escape if two transitions through an unconfined profile can be
executed.
Fix this by pushing the check into the per profile label build. The
check will always be done against unconfined and result in a stack of
just the unconfined component when necessary.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/domain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fdd341654471cae4fbd9635d32b848cd0c8bc437",
"status": "affected",
"version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
"versionType": "git"
},
{
"lessThan": "7d1099b86356df81c379159bfb8a598aaf83ce81",
"status": "affected",
"version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
"versionType": "git"
},
{
"lessThan": "7da0bdf0610f6d35bbb061536a47fc41646306f0",
"status": "affected",
"version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
"versionType": "git"
},
{
"lessThan": "08c2f7c8d4b1434cfae006f3daf4d1bce330b57b",
"status": "affected",
"version": "2d9da9b188b8cd3b579d7ef5ba5d334be9dd38fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/domain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unconfined user namespace restriction forced stack\n\nIf a task is already confined by a stack the unprivileged transition\nrestriction on unconfined is not correctly, applied. This results in\nan escape if two transitions through an unconfined profile can be\nexecuted.\n\nFix this by pushing the check into the per profile label build. The\ncheck will always be done against unconfined and result in a stack of\njust the unconfined component when necessary."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker reaches aa_change_profile() by writing a changeprofile or exec command to /proc/self/attr/current or /proc/self/attr/exec (proc_pid_attr_write \u2192 apparmor_setprocattr \u2192 do_setattr) or via lsm_set_self_attr(2); the profile name is local process input, not a remote protocol message.\nAC:L - Success is two attacker-driven writes plus execve. The vulnerable gate is the pointer test label == \u0026labels_ns(label)-\u003eunconfined-\u003elabel in aa_change_profile(), so the first transition off the ns unconfined sentinel makes the second skip forced stacking; change_profile_perms() allows any target from a profile_unconfined() component, with no race.\nPR:L - Writing /proc/self/attr/current or /proc/self/attr/exec requires only that the opener is current (proc_pid_attr_write); there is no capable() check. The intended victims are tasks that fail cap_capable(current_cred(), \u0026init_user_ns, CAP_MAC_OVERRIDE), so a plain unprivileged local user, including one with caps only in a user namespace, suffices.\nUI:N - The attacker opens and writes their own /proc/self/attr/current or /proc/self/attr/exec, then execve()s to apply AA_CHANGE_ONEXEC; no other user must mount media, open a file, or confirm the transition.\nS:C - fn_label_build_in_scope() then aa_replace_current_label() drop the stacked ns unconfined profile that AppArmor was using as the MAC authority on the task, so later hooks (apparmor_userns_create, file mediation) run outside the policy that stack was required to keep applied\u2014an AppArmor policy/sandbox escape.\nC:H - After the second aa_change_profile()/handle_onexec() build, the task\u2019s label no longer includes ns unconfined, so AppArmor no longer denies reads a stacked or confined profile would have blocked, and a remaining FLAG_UNCONFINED label skips apparmor_userns_create() mediation, exposing userns-gated kernel interfaces the restriction was meant to hide.\nI:H - The same aa_replace_current_label() replacement lets the task perform writes and capability-using operations AppArmor was mediating, including unshare(CLONE_NEWUSER) from a FLAG_UNCONFINED profile, yielding CAP_SYS_ADMIN/CAP_NET_ADMIN in that namespace\u2014the integrity of the MAC policy the forced stack was supposed to preserve.\nA:N - The flaw only skips the forced-stack conversion in aa_change_profile()/handle_onexec(); it does not dereference invalid pointers, corrupt memory, or trigger BUG_ON, oops, panic, or deadlock."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:32.348Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fdd341654471cae4fbd9635d32b848cd0c8bc437"
},
{
"url": "https://git.kernel.org/stable/c/7d1099b86356df81c379159bfb8a598aaf83ce81"
},
{
"url": "https://git.kernel.org/stable/c/7da0bdf0610f6d35bbb061536a47fc41646306f0"
},
{
"url": "https://git.kernel.org/stable/c/08c2f7c8d4b1434cfae006f3daf4d1bce330b57b"
}
],
"title": "apparmor: fix unconfined user namespace restriction forced stack",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90231",
"datePublished": "2026-09-17T16:07:38.613Z",
"dateReserved": "2026-09-11T19:38:34.794Z",
"dateUpdated": "2026-10-21T12:50:32.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64117 (GCVE-0-2026-64117)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
ieee80211_invoke_fast_rx() reads RX status through
IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage
that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the
unicast forward path, mesh_data does:
info = IEEE80211_SKB_CB(fwd_skb);
memset(info, 0, sizeof(*info));
on the same skb the caller still names via rx->skb, then either
queues the skb for TX (success) or kfree_skb()'s it (no-route)
before returning RX_QUEUED. The caller's RX_QUEUED arm then
calls sta_stats_encode_rate(status) on memory that is either
zeroed (success path) or freed (no-route path). The latter is
KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.
Fix by encoding the rate from status before invoking
ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value
captured while status was still backed by valid memory.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:37.743399Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:12.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5fe97797412aa8bc0184f78379fafb594bcb7f66",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "0cd37e746e98ab0baa6d8b812955220775b080d6",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "a2650f8461cd8ba287fee2992b36abe733c2bd5e",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "2fb64f94f9afb774f2fa0c7835727d7a67f89f07",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb\n\nieee80211_invoke_fast_rx() reads RX status through\nIEEE80211_SKB_RXCB(skb), which aliases the same skb-\u003ecb storage\nthat ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the\nunicast forward path, mesh_data does:\n\n\tinfo = IEEE80211_SKB_CB(fwd_skb);\n\tmemset(info, 0, sizeof(*info));\n\non the same skb the caller still names via rx-\u003eskb, then either\nqueues the skb for TX (success) or kfree_skb()\u0027s it (no-route)\nbefore returning RX_QUEUED. The caller\u0027s RX_QUEUED arm then\ncalls sta_stats_encode_rate(status) on memory that is either\nzeroed (success path) or freed (no-route path). The latter is\nKASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.\n\nFix by encoding the rate from status before invoking\nieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value\ncaptured while status was still backed by valid memory."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when mac80211 processes attacker-supplied 802.11 data frames received over WiFi in a mesh deployment; per kernel CNA guidance, WiFi frame delivery is Adjacent rather than fully remote Network.\nAC:L - Once on a mesh network as an authorized peer, an attacker can reliably trigger the no-route unicast forward path by sending frames to destinations without an active mesh path, causing deterministic skb free followed by the UAF read.\nPR:N - Exploitation requires no privileges on the victim host; the attacker only needs to transmit valid mesh data frames from an adjacent peer, not local root, capabilities, or namespace admin rights on the target system.\nUI:N - No victim user action is required beyond normal mesh operation; the bug fires automatically during RX processing of the attacker\u0027s frames.\nS:U - Impact is confined to kernel/mac80211 memory on the receiving system and does not cross a VM, container, or IOMMU security boundary.\nC:H - The flaw is a slab use-after-free read of skb-\u003ecb via sta_stats_encode_rate(), which can expose freed heap contents and is classified as high confidentiality impact for UAF bugs.\nI:H - Use-after-free of skb control-block memory provides a standard heap corruption primitive that can be developed into arbitrary kernel writes or code execution, not merely a benign stats miscalculation.\nA:H - The freed-skb path produces KASAN-reported slab use-after-free and can cause kernel oops or panic; the condition is repeatable by sending additional triggering frames for denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:04.607Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5fe97797412aa8bc0184f78379fafb594bcb7f66"
},
{
"url": "https://git.kernel.org/stable/c/0cd37e746e98ab0baa6d8b812955220775b080d6"
},
{
"url": "https://git.kernel.org/stable/c/a2650f8461cd8ba287fee2992b36abe733c2bd5e"
},
{
"url": "https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07"
},
{
"url": "https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349"
}
],
"title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64117",
"datePublished": "2026-07-19T15:40:16.941Z",
"dateReserved": "2026-07-19T07:54:57.035Z",
"dateUpdated": "2026-10-21T12:43:04.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68447 (GCVE-0-2026-68447)
Vulnerability from cvelistv5
Published
2026-08-12 00:51
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size
from hardware without bounding it to the allocated BO region. If the HW
field is larger than the queue's control stack allocation, memcpy reads
past the BO into adjacent GTT memory and can leak kernel data to userspace.
Store the page-aligned control stack BO size in mqd_manager and clamp
checkpoint copies and reported checkpoint sizes to
min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound
for multi-XCC v9.4.3 checkpoint layout.
(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:08.161278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:10.800Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1218c6dcec80f886372635e82f3229d5babc37d3",
"status": "affected",
"version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c",
"versionType": "git"
},
{
"lessThan": "a0d87beb2660a5098b2b0ecdc1e96810a9074ea9",
"status": "affected",
"version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c",
"versionType": "git"
},
{
"lessThan": "426ffae6ecc7ec77d32bf8be065c21a1b881b084",
"status": "affected",
"version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\n\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue\u0027s control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\n\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm-\u003ectl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through the AMDKFD_IOC_CRIU_OP ioctl on the local /dev/kfd character device; no network or remote path exists to amdkfd CRIU checkpoint handling.\nAC:L - kfd_criu_restore_queue() copies the entire user-supplied MQD blob verbatim into the kernel MQD, so the attacker directly chooses cp_hqd_cntl_stack_size and a subsequent checkpoint deterministically triggers the over-read; queues are evicted under p-\u003emutex, so no race must be won.\nPR:L - The attacker needs access to /dev/kfd (render group) plus CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN; CAP_CHECKPOINT_RESTORE is a delegated, non-root capability routinely granted to CRIU tooling and container checkpoint services, so this is a limited privilege rather than full administrative control.\nUI:N - The attacker performs the CRIU restore and checkpoint ioctls entirely on its own process; no action by any other user or victim is required.\nS:U - The out-of-bounds read and the resulting disclosure stay within the kernel\u0027s own security authority on the host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - memcpy reads up to an attacker-chosen 32-bit length past the small MQD/control-stack BO into adjacent kernel GTT (vmap\u0027d host memory) or VRAM, and criu_checkpoint_queues_device() copies the whole buffer to userspace, disclosing large amounts of unrelated kernel/GPU memory.\nI:N - The destination buffer is kzalloc\u0027d using the same inflated size, so nothing is written out of bounds; the defect is purely an over-read with no kernel memory modification.\nA:H - With a large attacker-supplied cp_hqd_cntl_stack_size the memcpy walks far past the end of the small kmap\u0027d BO (roughly 0x8000 bytes) into unmapped virtual addresses or beyond the VRAM BAR mapping, producing a kernel oops and killing the driver."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:11.622Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1218c6dcec80f886372635e82f3229d5babc37d3"
},
{
"url": "https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9"
},
{
"url": "https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"
}
],
"title": "drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68447",
"datePublished": "2026-08-12T00:51:42.433Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-10-21T12:44:11.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74269 (GCVE-0-2026-74269)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt: fix head underflow on XDP head-grow
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on
a bnxt machine (and also crashes in NIPA).
It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which
builds the skb head:
napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);
The problem with this expression is that in page mode, rx_offset is:
bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
Which evaluates (at least on x86_64) to 258.
The test test_xdp_native_adjst_head_grow_data tests a case where the
head is adjusted by -256.
When this test runs, data_ptr is shifted to frag_start + 2 (where
frag_start = page_address(page) + offset).
Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb
expression subtracts 258, landing at an address before frag_start. This
could be either the previous fragment or the previous physical page when
the offset is < 256 (e.g. if the fragment started at offset 0).
When the skb is freed, the page pool fragment reference is dropped on
either the wrong page or the wrong frag of the right page. In either
case, the corrupted reference count can lead to the page being
prematurely recycled while still in use. Once (incorrectly) recycled, it
can be handed out again and on driver teardown this would result in a
double free.
The commit under fixes updated this code to handle the case where the
native page size is >= 64k, but it unintentionally broke the head grow
case.
To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the
existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on
allocation and preserve it on reuse.
In bnxt_rx_multi_page_skb, use the newly added offset field to compute
the fragment start and pass that to napi_build_skb. Adjust the layout
with skb_reserve.
There are two cases, the non-adjustment case and the adjustment case.
In both cases, the skb is built at page_address(page) + offset to
account for the case where the native page size >= 64K and skb_reserve
is called with data_ptr - (page_address(page) + offset). That
difference equals bp->rx_offset when data_ptr was not moved, or
bp->rx_offset + xdp_adjust when XDP adjusted the head.
Re-running the failing test with this commit applied causes the test to
run successfully to completion.
The other rx_skb_func implementations don't have this issue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9f11bfc03fb0d3c86f91b8ae945bb10f7e19c16 Version: f6974b4c2d8e1062b5a52228ee47293c15b4ee1e Version: f6974b4c2d8e1062b5a52228ee47293c15b4ee1e Version: f6974b4c2d8e1062b5a52228ee47293c15b4ee1e Version: f6974b4c2d8e1062b5a52228ee47293c15b4ee1e Version: f6974b4c2d8e1062b5a52228ee47293c15b4ee1e Version: ae0e135dc900827687ecc684c2bbb57aae48d318 Version: 6.1.45 ≤ Version: 6.4.10 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:50.592583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:29.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c",
"drivers/net/ethernet/broadcom/bnxt/bnxt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59f6211c006cb5936b443fb396eb43864ca21ed5",
"status": "affected",
"version": "e9f11bfc03fb0d3c86f91b8ae945bb10f7e19c16",
"versionType": "git"
},
{
"lessThan": "3e8f3959a7fd28461b8cd9708c21286b4250b77a",
"status": "affected",
"version": "f6974b4c2d8e1062b5a52228ee47293c15b4ee1e",
"versionType": "git"
},
{
"lessThan": "ff34e5a26a26c92142afea11455e259c4c4c617b",
"status": "affected",
"version": "f6974b4c2d8e1062b5a52228ee47293c15b4ee1e",
"versionType": "git"
},
{
"lessThan": "4c03275bc4435cc8e25f7f3f08aff58c0e783d8d",
"status": "affected",
"version": "f6974b4c2d8e1062b5a52228ee47293c15b4ee1e",
"versionType": "git"
},
{
"lessThan": "bb72b1c6755631c74b7e0878ee55bb81c06776c0",
"status": "affected",
"version": "f6974b4c2d8e1062b5a52228ee47293c15b4ee1e",
"versionType": "git"
},
{
"lessThan": "e26657fe3b85c068b01f42bb0c602f242d643ba9",
"status": "affected",
"version": "f6974b4c2d8e1062b5a52228ee47293c15b4ee1e",
"versionType": "git"
},
{
"status": "affected",
"version": "ae0e135dc900827687ecc684c2bbb57aae48d318",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.45",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c",
"drivers/net/ethernet/broadcom/bnxt/bnxt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt: fix head underflow on XDP head-grow\n\nThe xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on\na bnxt machine (and also crashes in NIPA).\n\nIt seems that the bug is an underflow in bnxt_rx_multi_page_skb, which\nbuilds the skb head:\n\n napi_build_skb(data_ptr - bp-\u003erx_offset, rxr-\u003erx_page_size);\n\nThe problem with this expression is that in page mode, rx_offset is:\n\n bp-\u003erx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;\n\nWhich evaluates (at least on x86_64) to 258.\n\nThe test test_xdp_native_adjst_head_grow_data tests a case where the\nhead is adjusted by -256.\n\nWhen this test runs, data_ptr is shifted to frag_start + 2 (where\nfrag_start = page_address(page) + offset).\n\nThen, bnxt_rx_multi_page_skb is invoked and the napi_build_skb\nexpression subtracts 258, landing at an address before frag_start. This\ncould be either the previous fragment or the previous physical page when\nthe offset is \u003c 256 (e.g. if the fragment started at offset 0).\n\nWhen the skb is freed, the page pool fragment reference is dropped on\neither the wrong page or the wrong frag of the right page. In either\ncase, the corrupted reference count can lead to the page being\nprematurely recycled while still in use. Once (incorrectly) recycled, it\ncan be handed out again and on driver teardown this would result in a\ndouble free.\n\nThe commit under fixes updated this code to handle the case where the\nnative page size is \u003e= 64k, but it unintentionally broke the head grow\ncase.\n\nTo fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the\nexisting offset field in struct bnxt_sw_rx_agg_bd. Populate it on\nallocation and preserve it on reuse.\n\nIn bnxt_rx_multi_page_skb, use the newly added offset field to compute\nthe fragment start and pass that to napi_build_skb. Adjust the layout\nwith skb_reserve.\n\nThere are two cases, the non-adjustment case and the adjustment case.\n\nIn both cases, the skb is built at page_address(page) + offset to\naccount for the case where the native page size \u003e= 64K and skb_reserve\nis called with data_ptr - (page_address(page) + offset). That\ndifference equals bp-\u003erx_offset when data_ptr was not moved, or\nbp-\u003erx_offset + xdp_adjust when XDP adjusted the head.\n\nRe-running the failing test with this commit applied causes the test to\nrun successfully to completion.\n\nThe other rx_skb_func implementations don\u0027t have this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is reached in bnxt hardware RX/NAPI processing when network packets arrive; the reproducing selftest triggers it by exchanging UDP packets over the network after XDP head-grow on receive.\nAC:L - Once a bnxt interface runs XDP multi-buffer with jumbo MTU, an attacker can reliably trigger bpf_xdp_adjust_head(-256) with packets larger than rx_copybreak (256 bytes); no race or attacker-uncontrollable memory layout is required.\nPR:N - The vulnerable receive path performs no authentication on incoming packets. Attaching the XDP program and enabling jumbo MTU are deployment preconditions on affected bnxt servers, not privileges the remote attacker needs.\nUI:N - After the affected bnxt interface is configured with XDP and jumbo MTU, exploitation requires only sending crafted network traffic; no additional victim action such as opening files or mounting filesystems is needed.\nS:U - Impact is kernel memory corruption and denial of service within the host networking stack. This is standard in-kernel privilege/integrity impact, not a VM escape, IOMMU bypass, or other cross-security-boundary violation.\nC:H - Pointer underflow builds the skb on the wrong page-pool fragment or prior physical page, corrupting refcount accounting and allowing pages to be recycled while still referenced, yielding a use-after-free that can expose kernel memory.\nI:H - Corrupted page-pool reference counts can prematurely recycle receive buffers still in use and lead to double-free on teardown, providing exploitable kernel heap memory corruption beyond a simple crash.\nA:H - The bug crashes bnxt systems during XDP head-grow testing and can be triggered repeatedly via received traffic, causing kernel oops, resource exhaustion, or panic especially when panic_on_warn is enabled."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:35.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59f6211c006cb5936b443fb396eb43864ca21ed5"
},
{
"url": "https://git.kernel.org/stable/c/3e8f3959a7fd28461b8cd9708c21286b4250b77a"
},
{
"url": "https://git.kernel.org/stable/c/ff34e5a26a26c92142afea11455e259c4c4c617b"
},
{
"url": "https://git.kernel.org/stable/c/4c03275bc4435cc8e25f7f3f08aff58c0e783d8d"
},
{
"url": "https://git.kernel.org/stable/c/bb72b1c6755631c74b7e0878ee55bb81c06776c0"
},
{
"url": "https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9"
}
],
"title": "bnxt: fix head underflow on XDP head-grow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74269",
"datePublished": "2026-08-15T05:57:43.559Z",
"dateReserved": "2026-08-15T05:44:03.878Z",
"dateUpdated": "2026-10-30T12:29:35.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80628 (GCVE-0-2026-80628)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: oss: Serialize readq reset state with q->lock
snd_seq_oss_readq_clear() resets qlen, head, and tail without
q->lock even though the normal reader and producer paths serialize the
same ring state under that spinlock. A reset can therefore race
snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave
stale records in the queue, drop freshly queued ones, or report the
wrong readiness after wakeup. KCSAN reports a data race between
snd_seq_oss_readq_clear() and snd_seq_oss_readq_free().
Take q->lock while clearing the ring and resetting input_time. Factor
the enqueue logic into a caller-locked helper so
snd_seq_oss_readq_put_timestamp() updates its suppression state under
the same lock instead of racing the reset path.
The buggy scenario involves two paths, with each column showing the
order within that path:
reset path: locked readq updater:
1. snd_seq_oss_reset() or 1. A reader or callback producer
release reaches takes q->lock on the same queue.
snd_seq_oss_readq_clear().
2. snd_seq_oss_readq_clear() 2. The updater tests or modifies
resets qlen, head, tail, qlen, head, and tail.
and input_time.
3. snd_seq_oss_readq_clear() 3. The updater completes its
wakes sleepers on read-modify-write sequence.
q->midi_sleep.
4. Without q->lock, the reset 4. The resulting ring state drives
can overlap the locked later reads and readiness.
update.
KCSAN reports:
BUG: KCSAN: data-race in snd_seq_oss_readq_clear /
snd_seq_oss_readq_free
write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:
snd_seq_oss_readq_free+0x6c/0x80
snd_seq_oss_read+0xcb/0x250
odev_read+0x38/0x60
vfs_read+0xff/0x600
ksys_read+0xb4/0x140
__x64_sys_read+0x46/0x60
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:
snd_seq_oss_readq_clear+0x1f/0x90
snd_seq_oss_reset+0xa7/0xf0
snd_seq_oss_ioctl+0x6f6/0x7e0
odev_ioctl+0x56/0xc0
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00000001 -> 0x00000000
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80628",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:58.858599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:31.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/oss/seq_oss_readq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf58e4abf61d6643446f08ce69993688bb914420",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bf862fdee4831fe1dbde20891db4b29b8f9972f7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "af74390983cae3e5e551a533d6fcfc9b8c1a8b9e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "287d506d4e0865918cec82bb1361f283a08c979b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "43e10709b1ba288bcbabb9b9cb6e518b2a5d8506",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "49ce92d207820f588b0406add82f053decfbe5d9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/oss/seq_oss_readq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Serialize readq reset state with q-\u003elock\n\nsnd_seq_oss_readq_clear() resets qlen, head, and tail without\nq-\u003elock even though the normal reader and producer paths serialize the\nsame ring state under that spinlock. A reset can therefore race\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave\nstale records in the queue, drop freshly queued ones, or report the\nwrong readiness after wakeup. KCSAN reports a data race between\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().\n\nTake q-\u003elock while clearing the ring and resetting input_time. Factor\nthe enqueue logic into a caller-locked helper so\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under\nthe same lock instead of racing the reset path.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nreset path: locked readq updater:\n1. snd_seq_oss_reset() or 1. A reader or callback producer\n release reaches takes q-\u003elock on the same queue.\n snd_seq_oss_readq_clear().\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies\n resets qlen, head, tail, qlen, head, and tail.\n and input_time.\n3. snd_seq_oss_readq_clear() 3. The updater completes its\n wakes sleepers on read-modify-write sequence.\n q-\u003emidi_sleep.\n4. Without q-\u003elock, the reset 4. The resulting ring state drives\n can overlap the locked later reads and readiness.\n update.\n\nKCSAN reports:\n\nBUG: KCSAN: data-race in snd_seq_oss_readq_clear /\nsnd_seq_oss_readq_free\n\nwrite to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:\n snd_seq_oss_readq_free+0x6c/0x80\n snd_seq_oss_read+0xcb/0x250\n odev_read+0x38/0x60\n vfs_read+0xff/0x600\n ksys_read+0xb4/0x140\n __x64_sys_read+0x46/0x60\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:\n snd_seq_oss_readq_clear+0x1f/0x90\n snd_seq_oss_reset+0xa7/0xf0\n snd_seq_oss_ioctl+0x6f6/0x7e0\n odev_ioctl+0x56/0xc0\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000001 -\u003e 0x00000000"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscall access to OSS sequencer character devices (/dev/sequencer or /dev/music) via read(2), ioctl(SNDCTL_SEQ_RESET/SNDCTL_SEQ_PANIC), or release; there is no network, Bluetooth, or physical-bus path into snd_seq_oss_readq_clear().\nAC:L - The attacker controls both race participants on the same fd (one thread ioctl reset or close while another read(2)s, or concurrent MIDI enqueue via sequencer callbacks) and can hammer the timing window without conditions outside attacker control.\nPR:L - odev_open/read/ioctl perform no capability checks; desktop, studio, and kiosk systems routinely grant unprivileged users access to /dev/sequencer via audio group or logind ACLs, and attackers can create ALSA MIDI ports to satisfy open requirements.\nUI:N - Triggering the race requires only the attacker\u0027s own threads or processes opening the sequencer and issuing reset/read; no separate victim action such as plugging hardware, mounting filesystems, or opening files on behalf of another user.\nS:U - Corruption is confined to the kernel OSS sequencer read queue within the same security domain; this is a standard local kernel memory-safety issue with no VM, IOMMU, or container-escape boundary crossed.\nC:H - Unlocked snd_seq_oss_readq_clear() races locked dequeue/enqueue on qlen/head/tail, yielding inconsistent ring state that can drive snd_seq_oss_readq_pick() and copy_to_user() to return unintended queue slots and expose stale kernel heap contents.\nI:H - The same race corrupts ring indices and length while snd_seq_oss_readq_put_event_locked() memcpy-writes events, enabling out-of-sync overwrites within the kmalloc\u0027d queue object that can be groomed toward arbitrary kernel memory modification.\nA:H - Corrupted qlen/head/tail and wakeup state from the unlocked reset can strand readers in wait/poll loops and deny MIDI/audio input on kiosk, studio, and media systems; the KCSAN-proven race is attacker-repeatable via ioctl reset concurrent with read(2)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:45.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf58e4abf61d6643446f08ce69993688bb914420"
},
{
"url": "https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7"
},
{
"url": "https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e"
},
{
"url": "https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b"
},
{
"url": "https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506"
},
{
"url": "https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9"
}
],
"title": "ALSA: seq: oss: Serialize readq reset state with q-\u003elock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80628",
"datePublished": "2026-08-28T06:48:45.377Z",
"dateReserved": "2026-08-26T14:34:25.775Z",
"dateUpdated": "2026-10-30T12:30:45.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89705 (GCVE-0-2026-89705)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
nfsd_dispatch() sets rq_status_counter to an odd value once a request has
been decoded, and back to an even value once it has been fully processed,
forming a seq-lock like protocol with the lockless reader in
nfsd_nl_rpc_status_get_dumpit().
Only the fully successful path restored the counter to even. The cache-hit
(RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return
after the odd-valued store without ever bringing the counter back to even.
Once one of those paths is taken, rq_status_counter is left odd: the next
request's decode ORs in 1 (still odd) and only a subsequent successful
encode restores even. While stuck odd, the dumpit reader treats the rqstp
fields as stable and its retry check compares against the same unchanging
odd value, so it never detects concurrent mutation. This exposes actively
mutating fields (e.g. args->ops / args->opcnt during compound decode and
release) to the lockless reader, which can read past the end of the
8-element inline ops array.
Add a helper that advances the counter to the next even value and call it
on every return path that follows the odd-valued store. The decode-error
path is left untouched as it is reached before the counter is set odd.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfssvc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5773e00cc0f9e34983bd29ba2a607c6b14258e00",
"status": "affected",
"version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
"versionType": "git"
},
{
"lessThan": "df5500ab85df661d9e4439e4c456787181fbd5ff",
"status": "affected",
"version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
"versionType": "git"
},
{
"lessThan": "b08c30f08d57f30699d36809d92f0b683dca261f",
"status": "affected",
"version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
"versionType": "git"
},
{
"lessThan": "f6045886fe3f14f269f683d64021b004a50d0efa",
"status": "affected",
"version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfssvc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths\n\nnfsd_dispatch() sets rq_status_counter to an odd value once a request has\nbeen decoded, and back to an even value once it has been fully processed,\nforming a seq-lock like protocol with the lockless reader in\nnfsd_nl_rpc_status_get_dumpit().\n\nOnly the fully successful path restored the counter to even. The cache-hit\n(RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return\nafter the odd-valued store without ever bringing the counter back to even.\nOnce one of those paths is taken, rq_status_counter is left odd: the next\nrequest\u0027s decode ORs in 1 (still odd) and only a subsequent successful\nencode restores even. While stuck odd, the dumpit reader treats the rqstp\nfields as stable and its retry check compares against the same unchanging\nodd value, so it never detects concurrent mutation. This exposes actively\nmutating fields (e.g. args-\u003eops / args-\u003eopcnt during compound decode and\nrelease) to the lockless reader, which can read past the end of the\n8-element inline ops array.\n\nAdd a helper that advances the counter to the next even value and call it\non every return path that follows the odd-valued store. The decode-error\npath is left untouched as it is reached before the counter is set odd."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The confidentiality and availability impact is in nfsd_nl_rpc_status_get_dumpit(), reached only via NFSD_CMD_RPC_STATUS_GET over AF_NETLINK. Remote NFS RPCs can leave rq_status_counter odd in nfsd_dispatch() but never enter dumpit, so exploitation requires local netlink access.\nAC:L - An attacker can send an NFSv4.0 COMPOUND with OP_CACHEME (SETCLIENTID) and a duplicate in-flight RPC so nfsd_cache_lookup() returns RC_DROPIT, leaving rq_status_counter stuck odd. Later compounds with more than eight ops then let dumpit observe opcnt/ops mid-decode with no seqlock retry; both sides are attacker-controlled.\nPR:L - NFSD_CMD_RPC_STATUS_GET is registered with GENL_CMD_CAP_DUMP and no GENL_ADMIN_PERM, so any unprivileged process in the nfsd network namespace can invoke the dump. Exploitation does not require CAP_NET_ADMIN or init-namespace root.\nUI:N - The attacker issues the netlink dump and the NFSv4 compounds themselves. No separate victim action such as mounting a filesystem or opening a device is required.\nS:U - The slab over-read and netlink leak occur in host-kernel nfsd on the local machine. Impact stays inside one security authority and is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - With the counter stuck odd, dumpit treats mutating args-\u003eops/opcnt as stable and reads min(opcnt,16) slots. When opcnt is set above eight before ops is switched off iops[8], indices 8-15 load adjacent slab at nfsd4_op stride and return those u32s via NFSD_A_RPC_STATUS_COMPOUND_OPS.\nI:N - dumpit only loads opnum into a stack nfsd_genl_rqstp for netlink. This seqlock bug yields an out-of-bounds read, not an out-of-bounds write, use-after-free write primitive, or control-flow hijack.\nA:H - Slots 8-15 are sampled at sizeof(struct nfsd4_op) stride past the trailing iops[8] array in kmalloc\u0027d nfsd4_compoundargs into adjacent or unmapped slab pages, which can oops the dumpit path even if the leak is not turned into a stable read."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:24.485Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5773e00cc0f9e34983bd29ba2a607c6b14258e00"
},
{
"url": "https://git.kernel.org/stable/c/df5500ab85df661d9e4439e4c456787181fbd5ff"
},
{
"url": "https://git.kernel.org/stable/c/b08c30f08d57f30699d36809d92f0b683dca261f"
},
{
"url": "https://git.kernel.org/stable/c/f6045886fe3f14f269f683d64021b004a50d0efa"
}
],
"title": "nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89705",
"datePublished": "2026-09-11T19:46:21.832Z",
"dateReserved": "2026-09-11T19:38:34.750Z",
"dateUpdated": "2026-10-21T12:48:24.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93146 (GCVE-0-2026-93146)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
time/namespace: Validate nanosecond field in proc_timens_set_offset()
The function validates tv_sec to be within [-KTIME_SEC_MAX, KTIME_SEC_MAX]
but never validates that tv_nsec is within the valid range of
[0, NSEC_PER_SEC-1] before using it in timespec64_add().
timespec64_add() expects both timespec64 structures to have normalized
values with tv_nsec in the range [0, 999999999]. If off->val.tv_nsec
contains invalid values (negative or >= NSEC_PER_SEC), it could lead to
incorrect calculations or unexpected behavior.
Add validation to ensure tv_nsec is within the valid range before
performing the addition.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 04a8682a71becdb639ec9c0d82b315a2baef7a5d Version: 04a8682a71becdb639ec9c0d82b315a2baef7a5d Version: 04a8682a71becdb639ec9c0d82b315a2baef7a5d Version: 04a8682a71becdb639ec9c0d82b315a2baef7a5d Version: 04a8682a71becdb639ec9c0d82b315a2baef7a5d Version: 04a8682a71becdb639ec9c0d82b315a2baef7a5d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/time/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce0dd307dfa3193fbf06371b7c819a6bff7d3d68",
"status": "affected",
"version": "04a8682a71becdb639ec9c0d82b315a2baef7a5d",
"versionType": "git"
},
{
"lessThan": "5b8a40de738b7c4896c2edbc6262bd1b3462ded0",
"status": "affected",
"version": "04a8682a71becdb639ec9c0d82b315a2baef7a5d",
"versionType": "git"
},
{
"lessThan": "b20d7085ab314672447322c10cc5d1ba443e3b8e",
"status": "affected",
"version": "04a8682a71becdb639ec9c0d82b315a2baef7a5d",
"versionType": "git"
},
{
"lessThan": "db667d2970c756cc7b483f45f272440f845a665b",
"status": "affected",
"version": "04a8682a71becdb639ec9c0d82b315a2baef7a5d",
"versionType": "git"
},
{
"lessThan": "1f0c3c0c36c7aedf55a60d9c71c4bd258b8937ce",
"status": "affected",
"version": "04a8682a71becdb639ec9c0d82b315a2baef7a5d",
"versionType": "git"
},
{
"lessThan": "06aba58e58492d2b8eae059274caed29025ea96e",
"status": "affected",
"version": "04a8682a71becdb639ec9c0d82b315a2baef7a5d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/time/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntime/namespace: Validate nanosecond field in proc_timens_set_offset()\n\nThe function validates tv_sec to be within [-KTIME_SEC_MAX, KTIME_SEC_MAX]\nbut never validates that tv_nsec is within the valid range of\n[0, NSEC_PER_SEC-1] before using it in timespec64_add().\n\ntimespec64_add() expects both timespec64 structures to have normalized\nvalues with tv_nsec in the range [0, 999999999]. If off-\u003eval.tv_nsec\ncontains invalid values (negative or \u003e= NSEC_PER_SEC), it could lead to\nincorrect calculations or unexpected behavior.\n\nAdd validation to ensure tv_nsec is within the valid range before\nperforming the addition."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:07.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce0dd307dfa3193fbf06371b7c819a6bff7d3d68"
},
{
"url": "https://git.kernel.org/stable/c/5b8a40de738b7c4896c2edbc6262bd1b3462ded0"
},
{
"url": "https://git.kernel.org/stable/c/b20d7085ab314672447322c10cc5d1ba443e3b8e"
},
{
"url": "https://git.kernel.org/stable/c/db667d2970c756cc7b483f45f272440f845a665b"
},
{
"url": "https://git.kernel.org/stable/c/1f0c3c0c36c7aedf55a60d9c71c4bd258b8937ce"
},
{
"url": "https://git.kernel.org/stable/c/06aba58e58492d2b8eae059274caed29025ea96e"
}
],
"title": "time/namespace: Validate nanosecond field in proc_timens_set_offset()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93146",
"datePublished": "2026-09-17T16:11:44.117Z",
"dateReserved": "2026-09-17T16:02:15.088Z",
"dateUpdated": "2026-10-30T12:36:07.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43048 (GCVE-0-2026-43048)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Mitigate potential OOB by removing bogus memset()
The memset() in hid_report_raw_event() has the good intention of
clearing out bogus data by zeroing the area from the end of the incoming
data string to the assumed end of the buffer. However, as we have
previously seen, doing so can easily result in OOB reads and writes in
the subsequent thread of execution.
The current suggestion from one of the HID maintainers is to remove the
memset() and simply return if the incoming event buffer size is not
large enough to fill the associated report.
Suggested-by Benjamin Tissoires <bentiss@kernel.org>
[bentiss: changed the return value]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd6104572bca9e4afe0dcdb8ecd65ef90b01297b Version: cd6104572bca9e4afe0dcdb8ecd65ef90b01297b Version: cd6104572bca9e4afe0dcdb8ecd65ef90b01297b Version: cd6104572bca9e4afe0dcdb8ecd65ef90b01297b Version: cd6104572bca9e4afe0dcdb8ecd65ef90b01297b Version: cd6104572bca9e4afe0dcdb8ecd65ef90b01297b |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43048",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:13:57.851885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:11.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad4316edbc63949094edeee538517dd689df7b24",
"status": "affected",
"version": "cd6104572bca9e4afe0dcdb8ecd65ef90b01297b",
"versionType": "git"
},
{
"lessThan": "218b93b7e284de1aa40a53f8f130f84f7da38858",
"status": "affected",
"version": "cd6104572bca9e4afe0dcdb8ecd65ef90b01297b",
"versionType": "git"
},
{
"lessThan": "b37e6019fe420335d884e30535549a25f084e00d",
"status": "affected",
"version": "cd6104572bca9e4afe0dcdb8ecd65ef90b01297b",
"versionType": "git"
},
{
"lessThan": "8f71034649738fdeb6859b8d6cddf132024fac06",
"status": "affected",
"version": "cd6104572bca9e4afe0dcdb8ecd65ef90b01297b",
"versionType": "git"
},
{
"lessThan": "bd6e1d0230cca9575f5d118148f51e2a56b5373f",
"status": "affected",
"version": "cd6104572bca9e4afe0dcdb8ecd65ef90b01297b",
"versionType": "git"
},
{
"lessThan": "0a3fe972a7cb1404f693d6f1711f32bc1d244b1c",
"status": "affected",
"version": "cd6104572bca9e4afe0dcdb8ecd65ef90b01297b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Mitigate potential OOB by removing bogus memset()\n\nThe memset() in hid_report_raw_event() has the good intention of\nclearing out bogus data by zeroing the area from the end of the incoming\ndata string to the assumed end of the buffer. However, as we have\npreviously seen, doing so can easily result in OOB reads and writes in\nthe subsequent thread of execution.\n\nThe current suggestion from one of the HID maintainers is to remove the\nmemset() and simply return if the incoming event buffer size is not\nlarge enough to fill the associated report.\n\nSuggested-by Benjamin Tissoires \u003cbentiss@kernel.org\u003e\n\n[bentiss: changed the return value]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable HID report parsing can be reached by attacker-controlled Bluetooth HID devices sending crafted short input reports over an established HIDP interrupt/control channel. This is adjacent-network reachability rather than physical-only because Bluetooth HID is a supported HID transport.\nAC:L - The attacker controls the HID report descriptor/report IDs and the short report contents, and no race or condition outside the attacker\u0027s control is required. A malformed report can be sent repeatedly once the HID device is connected.\nPR:N - The adjacent HID peer does not need privileges on the target system to send the report data processed by the kernel. Local HIDP setup is performed by the host Bluetooth stack, but the attacker-controlled peer supplies the malicious descriptor and events.\nUI:N - After the malicious or compromised HID device is connected, exploitation is triggered by device-sent reports without any further victim action. Under the required higher-severity rule, pairing/connection uncertainty is not treated as required interaction.\nS:U - The corruption occurs in the Linux kernel HID processing context and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is an out-of-bounds memory access in kernel report handling, and descriptor-controlled parsing can drive reads beyond the supplied report object. Kernel memory corruption is plausibly usable to obtain sensitive kernel memory disclosure.\nI:H - The removed memset performed an out-of-bounds zero write past short report buffers for some call paths, including small stack/static translated reports. Kernel OOB writes are memory corruption and are defensibly scored as high integrity impact.\nA:H - The OOB write/read can corrupt kernel memory or fault during HID event processing, leading to an oops or system crash. The triggering report can be resent by the attacker-controlled HID peer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:51.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad4316edbc63949094edeee538517dd689df7b24"
},
{
"url": "https://git.kernel.org/stable/c/218b93b7e284de1aa40a53f8f130f84f7da38858"
},
{
"url": "https://git.kernel.org/stable/c/b37e6019fe420335d884e30535549a25f084e00d"
},
{
"url": "https://git.kernel.org/stable/c/8f71034649738fdeb6859b8d6cddf132024fac06"
},
{
"url": "https://git.kernel.org/stable/c/bd6e1d0230cca9575f5d118148f51e2a56b5373f"
},
{
"url": "https://git.kernel.org/stable/c/0a3fe972a7cb1404f693d6f1711f32bc1d244b1c"
}
],
"title": "HID: core: Mitigate potential OOB by removing bogus memset()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43048",
"datePublished": "2026-05-01T14:15:43.227Z",
"dateReserved": "2026-05-01T14:12:55.979Z",
"dateUpdated": "2026-10-30T12:24:51.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74733 (GCVE-0-2026-74733)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
Locking is disabled in the regmap config as this driver uses its own
lock. This means that all calls to regmap functions (read or write) must
hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do
this, and it was therefore possible that multiple threads could cause an
incorrect register to be read/written.
A previous patch partly fixed this, but only protected the write to the
interrupt mask register, and not the read from the direction register.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 58a5c93bd1a6e949267400080f07e57ffe05ec34 Version: e2ecdddca80dd845df42376e4b0197fe97018ba2 Version: bfc6444b57dc7186b6acc964705d7516cbaf3904 Version: bfc6444b57dc7186b6acc964705d7516cbaf3904 Version: bfc6444b57dc7186b6acc964705d7516cbaf3904 Version: bfc6444b57dc7186b6acc964705d7516cbaf3904 Version: de7cffa53149c7b48bd1bb29b02390c9f05b7f41 Version: 6.1.101 ≤ Version: 6.6.42 ≤ Version: 6.9.11 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:53.820928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:12.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-pca953x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58ed56c093a857c19f04cf3db1f02d2e793aec88",
"status": "affected",
"version": "58a5c93bd1a6e949267400080f07e57ffe05ec34",
"versionType": "git"
},
{
"lessThan": "5d05c4252c09ce10624be2197853c80bf87424e4",
"status": "affected",
"version": "e2ecdddca80dd845df42376e4b0197fe97018ba2",
"versionType": "git"
},
{
"lessThan": "41255e64eb9dd87b0b8675f4e47a9c67bcef6e39",
"status": "affected",
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"versionType": "git"
},
{
"lessThan": "bf3f37c2d40b51deb79aea910f28999d7c8c6b5a",
"status": "affected",
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"versionType": "git"
},
{
"lessThan": "e6a2f5f845f50b0c4299bace5111f56d3390a090",
"status": "affected",
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"versionType": "git"
},
{
"lessThan": "9dc325327babe7f159e84cbe9380a45342da0585",
"status": "affected",
"version": "bfc6444b57dc7186b6acc964705d7516cbaf3904",
"versionType": "git"
},
{
"status": "affected",
"version": "de7cffa53149c7b48bd1bb29b02390c9f05b7f41",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.101",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.42",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-pca953x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock\n\nLocking is disabled in the regmap config as this driver uses its own\nlock. This means that all calls to regmap functions (read or write) must\nhold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do\nthis, and it was therefore possible that multiple threads could cause an\nincorrect register to be read/written.\n\nA previous patch partly fixed this, but only protected the write to the\ninterrupt mask register, and not the read from the direction register."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable pca953x_irq_bus_sync_unlock() path is reached only through local kernel interfaces\u2014GPIO chardev ioctls (GPIO_V2_GET_LINE_IOCTL, GPIO_V2_LINE_SET_CONFIG_IOCTL, GPIO_V2_LINE_SET_VALUES_IOCTL), legacy sysfs GPIO, or concurrent in-kernel GPIO/IRQ ops\u2014not via any network or physical bus-facing attack surface.\nAC:L - An attacker drives both racing sides directly: one thread loops IRQ edge-detection setup/teardown (request_irq \u2192 irq_bus_sync_unlock) while another hammers GPIO value/direction writes holding i2c_lock; the original report reproduced the race ~1 in 1000 boots, so deliberate concurrency wins reliably.\nPR:L - Exploitation requires an open file descriptor on /dev/gpiochipN or sysfs GPIO access; on embedded, industrial, medical, and automotive boards using pca953x expanders, udev routinely grants gpio group membership to unprivileged local users.\nUI:N - No victim interaction is required\u2014the attacker performs all GPIO ioctl and IRQ configuration steps in its own threads without needing another user to mount, open, or configure devices.\nS:U - Corruption is confined to the kernel and the same on-board I2C GPIO expander; it does not cross VM, container, IOMMU, or other security-boundary scopes into a different authority.\nC:H - With regmap disable_locking=true, the unprotected pca953x_read_regs() direction read races locked regmap paths, corrupting the maple regcache and returning data from the wrong register\u2014yielding kernel heap UAF read and unintended register-state disclosure.\nI:H - Racing regmap transactions write interrupt-latch/direction data into wrong expander registers (documented output-register corruption), arbitrarily toggling safety-critical GPIO outputs; concurrent unsynchronized regcache writes provide a heap corruption/write primitive.\nA:H - Concurrent regcache maple-tree corruption from unsynchronized regmap access can trigger kernel oops/panic via double-free; miswritten interrupt masks or direction registers can wedge expander IRQ handling and GPIO consumers in a persistent denial-of-service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:25.982Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58ed56c093a857c19f04cf3db1f02d2e793aec88"
},
{
"url": "https://git.kernel.org/stable/c/5d05c4252c09ce10624be2197853c80bf87424e4"
},
{
"url": "https://git.kernel.org/stable/c/41255e64eb9dd87b0b8675f4e47a9c67bcef6e39"
},
{
"url": "https://git.kernel.org/stable/c/bf3f37c2d40b51deb79aea910f28999d7c8c6b5a"
},
{
"url": "https://git.kernel.org/stable/c/e6a2f5f845f50b0c4299bace5111f56d3390a090"
},
{
"url": "https://git.kernel.org/stable/c/9dc325327babe7f159e84cbe9380a45342da0585"
}
],
"title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74733",
"datePublished": "2026-08-22T15:33:21.579Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-10-30T12:30:25.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72494 (GCVE-0-2026-72494)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Replace waitqueue and flag with completion
The driver previously used a waitqueue along with an explicit
request_done flag, but without proper barriers around request_done.
An earlier patch by Gui-Dong Han <hanguidong02@gmail.com> attempted
to fix this by adding the missing memory barriers. Rather than
adding the barriers, this patch replaces the waitqueue+flag with
a completion, which is designed for this exact purpose.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520 Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520 Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520 Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520 Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520 Version: 44d9e52977a1b90b0db1c7f8b197c218e9226520 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:55.518866Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:26.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/hw.c",
"drivers/infiniband/hw/irdma/main.h",
"drivers/infiniband/hw/irdma/utils.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4dcd5afcc3516b07f0a506c338a49bccfd24589b",
"status": "affected",
"version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
"versionType": "git"
},
{
"lessThan": "7d89bff21c12e543d12ad70cb0103cf815891b24",
"status": "affected",
"version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
"versionType": "git"
},
{
"lessThan": "8de303efe2ff4fcbf240dfc6eb3469e1e8f18a3f",
"status": "affected",
"version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
"versionType": "git"
},
{
"lessThan": "706591cccdd3ac2c0ddc8c2ed6c89a6be9865826",
"status": "affected",
"version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
"versionType": "git"
},
{
"lessThan": "bde37aed0724c0139dea177f3aae8d989b6babb1",
"status": "affected",
"version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
"versionType": "git"
},
{
"lessThan": "d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd",
"status": "affected",
"version": "44d9e52977a1b90b0db1c7f8b197c218e9226520",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/hw.c",
"drivers/infiniband/hw/irdma/main.h",
"drivers/infiniband/hw/irdma/utils.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Replace waitqueue and flag with completion\n\nThe driver previously used a waitqueue along with an explicit\nrequest_done flag, but without proper barriers around request_done.\n\nAn earlier patch by Gui-Dong Han \u003changuidong02@gmail.com\u003e attempted\nto fix this by adding the missing memory barriers. Rather than\nadding the barriers, this patch replaces the waitqueue+flag with\na completion, which is designed for this exact purpose."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Intel irdma CQP completion/wait synchronization is exercised from remote iWARP/RoCE connection management (SYN/listener/IEQ/AEQ) and deferred-completion events, not only local ibverbs; network peers drive the completion side of the race on internet-facing RDMA/NFS/SMB-Direct servers.\nAC:L - Attacker controls both sides by flooding concurrent connections/CQP ops remotely or via concurrent RDMA verbs locally; missing release/acquire ordering on request_done vs compl_info is triggerable at high operation rates without luck-dependent layout.\nPR:N - Remote CM and packet-processing paths issue/wait on CQP before MPA/application auth; local exploitation needs only standard unprivileged /dev/infiniband/uverbs* access (0666 under typical rdma-core udev rules), not init-namespace capabilities.\nUI:N - Exploitation needs only attacker-driven network or verbs traffic against an already-bound RDMA device/listener; no additional victim user action at attack time beyond normal server role.\nS:U - Impact stays within kernel/driver security domain (CQP request objects, NIC PF reset); no VM escape or cross-authority boundary.\nC:H - Without proper barriers the waiter can observe request_done before compl_info stores, return success with stale op_ret_val/error, and recycle the cqp_request while hardware still references scratch \u2192 UAF/read primitives.\nI:H - Premature recycle/double-put of dynamic cqp_requests enables attacker-influenced heap reuse; stale callbacks on reused objects and invalid kfree paths provide kernel write/control-flow corruption primitives.\nA:H - Lost request_done causes CQP timeout \u2192 ice_rdma_request_reset PF reset; wrong completion state can leave mod_qp_waitq in uninterruptible wait; UAF/panic paths cause kernel crash/hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:31.628Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4dcd5afcc3516b07f0a506c338a49bccfd24589b"
},
{
"url": "https://git.kernel.org/stable/c/7d89bff21c12e543d12ad70cb0103cf815891b24"
},
{
"url": "https://git.kernel.org/stable/c/8de303efe2ff4fcbf240dfc6eb3469e1e8f18a3f"
},
{
"url": "https://git.kernel.org/stable/c/706591cccdd3ac2c0ddc8c2ed6c89a6be9865826"
},
{
"url": "https://git.kernel.org/stable/c/bde37aed0724c0139dea177f3aae8d989b6babb1"
},
{
"url": "https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd"
}
],
"title": "RDMA/irdma: Replace waitqueue and flag with completion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72494",
"datePublished": "2026-08-15T05:57:28.280Z",
"dateReserved": "2026-08-09T03:40:39.937Z",
"dateUpdated": "2026-10-30T12:29:31.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-37746 (GCVE-0-2025-37746)
Vulnerability from cvelistv5
Published
2025-05-01 12:55
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/dwc_pcie: fix duplicate pci_dev devices
During platform_device_register, wrongly using struct device
pci_dev as platform_data caused a kmemdup copy of pci_dev. Worse
still, accessing the duplicated device leads to list corruption as its
mutex content (e.g., list, magic) remains the same as the original.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/perf/dwc_pcie_pmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0778c3e01a9f382a5bc444a5271e013406642501",
"status": "affected",
"version": "af9597adc2f1e3609c67c9792a2469bb64e43ae9",
"versionType": "git"
},
{
"lessThan": "a71c6fc87b2b9905dc2e38887fe4122287216be9",
"status": "affected",
"version": "af9597adc2f1e3609c67c9792a2469bb64e43ae9",
"versionType": "git"
},
{
"lessThan": "7f35b429802a8065aa61e2a3f567089649f4d98e",
"status": "affected",
"version": "af9597adc2f1e3609c67c9792a2469bb64e43ae9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/perf/dwc_pcie_pmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.3",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/dwc_pcie: fix duplicate pci_dev devices\n\nDuring platform_device_register, wrongly using struct device\npci_dev as platform_data caused a kmemdup copy of pci_dev. Worse\nstill, accessing the duplicated device leads to list corruption as its\nmutex content (e.g., list, magic) remains the same as the original."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:23.821Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0778c3e01a9f382a5bc444a5271e013406642501"
},
{
"url": "https://git.kernel.org/stable/c/a71c6fc87b2b9905dc2e38887fe4122287216be9"
},
{
"url": "https://git.kernel.org/stable/c/7f35b429802a8065aa61e2a3f567089649f4d98e"
}
],
"title": "perf/dwc_pcie: fix duplicate pci_dev devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-37746",
"datePublished": "2025-05-01T12:55:53.385Z",
"dateReserved": "2025-04-16T04:51:23.936Z",
"dateUpdated": "2026-10-21T12:36:23.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72397 (GCVE-0-2026-72397)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the
vrm_version configured by the driver, while pmbus_reg2data_vid()
already switched on it. Any driver that selects a non-VR11 VID mode
and exposes a regulator (or hwmon vout setter) sent dangerously
wrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked
for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the
chip interprets as 1080 mV.
Mirror pmbus_reg2data_vid() so writes round-trip with reads.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:48:52.527560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:21.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cd0e037130806d7714c356eccefac6e1b92dbc34",
"status": "affected",
"version": "068c227056b9223fea1a759e08db2558d5cbb5ad",
"versionType": "git"
},
{
"lessThan": "125a5a4ad03c74ced4c2a55db45ef03505362ff9",
"status": "affected",
"version": "068c227056b9223fea1a759e08db2558d5cbb5ad",
"versionType": "git"
},
{
"lessThan": "5bd0d47640395f8a8c34446b62d1781b88869dfa",
"status": "affected",
"version": "068c227056b9223fea1a759e08db2558d5cbb5ad",
"versionType": "git"
},
{
"lessThan": "828cd614e2af053ca5e1d6da767bbd8a1b5cabfb",
"status": "affected",
"version": "068c227056b9223fea1a759e08db2558d5cbb5ad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()\n\npmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the\nvrm_version configured by the driver, while pmbus_reg2data_vid()\nalready switched on it. Any driver that selects a non-VR11 VID mode\nand exposes a regulator (or hwmon vout setter) sent dangerously\nwrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked\nfor 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the\nchip interprets as 1080 mV.\n\nMirror pmbus_reg2data_vid() so writes round-trip with reads."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is only reached from local host interfaces\u2014writable hwmon sysfs attributes (pmbus_set_sensor) and the PMBus regulator set_voltage path (pmbus_regulator_set_voltage)\u2014which encode values and issue I2C PMBUS_VOUT_COMMAND writes; there is no network, adjacent-radio, or direct physical-access entry point.\nAC:L - On systems with non-VR11 VID PMBus controllers (VR12/VR13/IMVP9/AMD/nvidia195mv), any voltage-setting write deterministically uses the wrong VR11 encoding with no race, timing window, or uncontrollable memory layout; the attacker fully controls the written millivolt value and can repeat the operation reliably.\nPR:L - Writable hwmon limit attributes are exposed as mode 0644 with no capability check in pmbus_set_sensor, so a local uid-0 context (including user-namespace root or container root with /sys access) can drive the bad encoding; regulator consumers can also be influenced from ordinary local workloads on affected server/GPU platforms.\nUI:N - Exploitation requires only the attacker (or attacker-controlled software) to write hwmon voltage limits or invoke regulator voltage changes; no separate victim interaction such as plugging hardware or approving a prompt is needed.\nS:U - Impact is confined to misprogramming PMBus voltage rails on the same host kernel authority; it does not cross VM, IOMMU, or sandbox boundaries and is not a guest-to-host escape.\nC:N - This is a write-side VID encoding logic error, not kernel memory corruption; reads use the correct pmbus_reg2data_vid path and the flaw does not disclose kernel pointers, arbitrary memory, or other confidential data.\nI:H - Incorrect VID-to-register conversion sends dangerously wrong PMBUS_VOUT_COMMAND values to hardware (e.g., 200 mV requested on nvidia195mv becomes 1080 mV applied), corrupting critical CPU/GPU/board power-rail configuration and potentially causing permanent hardware damage.\nA:H - Severe over- or under-voltage on core power rails can trigger immediate hardware protection shutdowns, system hangs/resets, and sustained denial of service on data-center, HPC, and GPU server deployments using affected PMBus VRM controllers."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:48.405Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cd0e037130806d7714c356eccefac6e1b92dbc34"
},
{
"url": "https://git.kernel.org/stable/c/125a5a4ad03c74ced4c2a55db45ef03505362ff9"
},
{
"url": "https://git.kernel.org/stable/c/5bd0d47640395f8a8c34446b62d1781b88869dfa"
},
{
"url": "https://git.kernel.org/stable/c/828cd614e2af053ca5e1d6da767bbd8a1b5cabfb"
}
],
"title": "hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72397",
"datePublished": "2026-08-15T05:56:23.675Z",
"dateReserved": "2026-08-09T03:40:39.924Z",
"dateUpdated": "2026-10-21T12:44:48.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53178 (GCVE-0-2026-53178)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
Add guards to ensure ie_length is large enough before subtracting
fixed IE offsets to prevent unsigned integer underflow.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d3fcee1b78a533c256077f1300dd236801397cf7 Version: d3fcee1b78a533c256077f1300dd236801397cf7 Version: d3fcee1b78a533c256077f1300dd236801397cf7 Version: d3fcee1b78a533c256077f1300dd236801397cf7 Version: d3fcee1b78a533c256077f1300dd236801397cf7 Version: 1b786350924cc0fa30d4434470b32f24e8ddd107 Version: 5.10.273 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18143799ad51a32b1351e4e1591b6285a0a9d7dd",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
},
{
"lessThan": "8863ac3a4fedf86b0ef5b8ecc37fbaa52f2a8160",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
},
{
"lessThan": "637e0ea73f690028796ee2fc72a2ac4ec32968c6",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
},
{
"lessThan": "542d65a6dbd9733baab96313c9fe76a76e93f484",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
},
{
"lessThan": "88e994c57a79f62d5338231d8d37ee8dd98baffe",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
},
{
"status": "affected",
"version": "1b786350924cc0fa30d4434470b32f24e8ddd107",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.273",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.273",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction\n\nAdd guards to ensure ie_length is large enough before subtracting\nfixed IE offsets to prevent unsigned integer underflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable rtl8723bs path processes 802.11 beacon/probe response information from nearby WiFi radios during scan/join/roam handling, so the attacker must be within wireless range rather than on an IP network.\nAC:L - An attacker can craft and transmit malformed management-frame data and trigger repeated scan/join candidate processing; no race or hard-to-control memory layout condition is required to reach the vulnerable IE walker.\nPR:N - The over-the-air management frames are processed before any WiFi authentication with the attacker-controlled AP/BSS, so no local or authenticated privileges are required.\nUI:N - Once the interface is scanning or attempting WPS/join/roam, the driver processes received management frames without a per-attack victim action.\nS:U - The impact is within the kernel/driver security authority and does not cross a hypervisor, IOMMU, or separate security scope boundary.\nC:H - The WPS path can underflow the IE length and pass a huge unsigned bound to `rtw_get_wps_ie`, causing an unbounded out-of-bounds kernel memory read.\nI:N - The affected calls only scan/compare IE bytes and do not copy attacker data into an out-of-bounds destination or provide an apparent write primitive.\nA:H - The out-of-bounds kernel read can fault or otherwise destabilize the kernel driver, making a kernel crash/oops a plausible outcome."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:42.902Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18143799ad51a32b1351e4e1591b6285a0a9d7dd"
},
{
"url": "https://git.kernel.org/stable/c/8863ac3a4fedf86b0ef5b8ecc37fbaa52f2a8160"
},
{
"url": "https://git.kernel.org/stable/c/637e0ea73f690028796ee2fc72a2ac4ec32968c6"
},
{
"url": "https://git.kernel.org/stable/c/542d65a6dbd9733baab96313c9fe76a76e93f484"
},
{
"url": "https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"
}
],
"title": "staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53178",
"datePublished": "2026-06-25T08:38:54.018Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-10-30T12:26:42.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74734 (GCVE-0-2026-74734)
Vulnerability from cvelistv5
Published
2026-08-26 14:36
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firewire: ohci: fix NULL pointer dereference in ar_context_release
During the error handling path of the driver's probe function, a NULL
pointer dereference can occur in ar_context_release().
When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping
fails), the devres cleanup mechanism invokes release_ohci(). This function
unconditionally calls ar_context_release() to clean up the asynchronous
receive contexts. However, if ar_context_init() was not yet called,
ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by
devres_alloc()).
ar_context_release() immediately dereferences ctx->ohci to get the dev
pointer before checking if the context was actually initialized, leading to
a crash:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543
Call Trace:
release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567
release_nodes drivers/base/devres.c:546 [inline]
devres_release_all+0x1a8/0x260 drivers/base/devres.c:576
device_unbind_cleanup drivers/base/dd.c:597 [inline]
really_probe+0x451/0xae0 drivers/base/dd.c:772
To fix this, move the assignment of the dev pointer after the !ctx->buffer
check. If ctx->buffer is NULL, it indicates that the context was never
successfully initialized and there is nothing to release, safely avoiding
the dereference of the uninitialized ctx->ohci pointer.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/ohci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3770a4794a14331c8ca6a674e49c021827521c2c",
"status": "affected",
"version": "5716e58aecdd4f7225c2e46ce903a839fc54f22f",
"versionType": "git"
},
{
"lessThan": "ca2fa74f3200ced6e0a940753ad99844c42ad7c8",
"status": "affected",
"version": "5716e58aecdd4f7225c2e46ce903a839fc54f22f",
"versionType": "git"
},
{
"lessThan": "ed5470771c7ed7f959230c4697f316af83426a90",
"status": "affected",
"version": "5716e58aecdd4f7225c2e46ce903a839fc54f22f",
"versionType": "git"
},
{
"lessThan": "7d228ba43279de2d191f25e139fad166409c2c06",
"status": "affected",
"version": "5716e58aecdd4f7225c2e46ce903a839fc54f22f",
"versionType": "git"
},
{
"lessThan": "42d217add8d80d6e7d9f58f80d11ea9b07ea113e",
"status": "affected",
"version": "5716e58aecdd4f7225c2e46ce903a839fc54f22f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firewire/ohci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: ohci: fix NULL pointer dereference in ar_context_release\n\nDuring the error handling path of the driver\u0027s probe function, a NULL\npointer dereference can occur in ar_context_release().\n\nWhen pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping\nfails), the devres cleanup mechanism invokes release_ohci(). This function\nunconditionally calls ar_context_release() to clean up the asynchronous\nreceive contexts. However, if ar_context_init() was not yet called,\nctx-\u003eohci remains NULL (as the fw_ohci structure is zero-initialized by\ndevres_alloc()).\n\nar_context_release() immediately dereferences ctx-\u003eohci to get the dev\npointer before checking if the context was actually initialized, leading to\na crash:\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nRIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543\nCall Trace:\n release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567\n release_nodes drivers/base/devres.c:546 [inline]\n devres_release_all+0x1a8/0x260 drivers/base/devres.c:576\n device_unbind_cleanup drivers/base/dd.c:597 [inline]\n really_probe+0x451/0xae0 drivers/base/dd.c:772\n\nTo fix this, move the assignment of the dev pointer after the !ctx-\u003ebuffer\ncheck. If ctx-\u003ebuffer is NULL, it indicates that the context was never\nsuccessfully initialized and there is nothing to release, safely avoiding\nthe dereference of the uninitialized ctx-\u003eohci pointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:20.638Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3770a4794a14331c8ca6a674e49c021827521c2c"
},
{
"url": "https://git.kernel.org/stable/c/ca2fa74f3200ced6e0a940753ad99844c42ad7c8"
},
{
"url": "https://git.kernel.org/stable/c/ed5470771c7ed7f959230c4697f316af83426a90"
},
{
"url": "https://git.kernel.org/stable/c/7d228ba43279de2d191f25e139fad166409c2c06"
},
{
"url": "https://git.kernel.org/stable/c/42d217add8d80d6e7d9f58f80d11ea9b07ea113e"
}
],
"title": "firewire: ohci: fix NULL pointer dereference in ar_context_release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74734",
"datePublished": "2026-08-26T14:36:48.753Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-10-21T12:46:20.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80705 (GCVE-0-2026-80705)
Vulnerability from cvelistv5
Published
2026-08-28 06:53
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: check if dml21_add_phantom_plane() is successful
Verify that the phantom plane was allocated to avoid a later
segfault.
(cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef7d731f1df63d6230e159996c0703aaf5132bac",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "bea1f73ad69eec36b757adb8e63beb3092f862ee",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "062cfd6c678f6647c8841f684d6dadab08d95512",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "000acb4ce7fb9feba3072ce468ad681f6585cd5d",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_utils.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check if dml21_add_phantom_plane() is successful\n\nVerify that the phantom plane was allocated to avoid a later\nsegfault.\n\n(cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:59.474Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef7d731f1df63d6230e159996c0703aaf5132bac"
},
{
"url": "https://git.kernel.org/stable/c/bea1f73ad69eec36b757adb8e63beb3092f862ee"
},
{
"url": "https://git.kernel.org/stable/c/062cfd6c678f6647c8841f684d6dadab08d95512"
},
{
"url": "https://git.kernel.org/stable/c/000acb4ce7fb9feba3072ce468ad681f6585cd5d"
}
],
"title": "drm/amd/display: check if dml21_add_phantom_plane() is successful",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80705",
"datePublished": "2026-08-28T06:53:07.045Z",
"dateReserved": "2026-08-26T14:34:25.787Z",
"dateUpdated": "2026-10-21T12:46:59.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99167 (GCVE-0-2026-99167)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix use-after-free in __tcf_action_put()
__tcf_action_put() decrements the reference count before decrementing the
binding count. Another thread can free the action between these operations,
causing the binding-count update to access freed memory. KASAN reports it
as:
BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340
Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64
Hold the action IDR mutex across both counter updates and IDR removal,
keeping cleanup outside the lock.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 Version: 16af6067392c40e454e49eec834843ab03643d96 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d83a3fc03bc595dd39b79ad61288738fbb1f2ba",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "fd01abed2568209f7daaf60e5ee68ae4a4744f48",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "fcc7d734ceccfab8ec3398c5b34f8e775d459507",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "fde33eb9955d819af282d5f5e84684eaec248291",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "969ad6f2b266f383b44194d50d15631969b26222",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "2465d27ef90de9105c2bffb6c35f8ce08918e642",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "2e012e431aa271ef3c84206f48854f539c03bff0",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
},
{
"lessThan": "7b16eb911091aae237a8673da94e4dfb9cd21d54",
"status": "affected",
"version": "16af6067392c40e454e49eec834843ab03643d96",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix use-after-free in __tcf_action_put()\n\n__tcf_action_put() decrements the reference count before decrementing the\nbinding count. Another thread can free the action between these operations,\ncausing the binding-count update to access freed memory. KASAN reports it\nas:\n\n BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340\n Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64\n\nHold the action IDR mutex across both counter updates and IDR removal,\nkeeping cleanup outside the lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the patched __tcf_action_put() through local NETLINK_ROUTE messages: sendmsg() -\u003e rtnetlink_rcv_msg() -\u003e tc_new_tfilter()/tc_del_tfilter() -\u003e tcf_action_destroy(). No received network packet supplies the action release operation.\nAC:L - RTM_NEWTFILTER and RTM_DELTFILTER are unlocked for flower on clsact/ingress; the attacker can race a failing bind request\u0027s tcf_action_destroy() against deletion cleanup of the same indexed action. One put takes tcfa_refcnt 2-\u003e1 before tcfa_bindcnt while the other takes 1-\u003e0 and frees it, so both sides are attacker-controlled.\nPR:L - rtnetlink_rcv_msg() requires netlink_net_capable(skb, CAP_NET_ADMIN), but checks the user namespace owning the socket\u0027s network namespace. An unprivileged user can use unshare(CLONE_NEWUSER|CLONE_NEWNET) to obtain that capability in the new namespace and configure its clsact/flower objects.\nUI:N - After creating the namespace and TC objects, the attacker alone sends the racing RTM_NEWTFILTER and RTM_DELTFILTER messages; no victim action is required.\nS:U - __tcf_action_put() corrupts memory in the same host kernel that processes and authorizes the NETLINK_ROUTE requests; exploitation does not cross a VM or IOMMU security boundary.\nC:H - After free_tcf() queues p for reclamation through kfree_rcu(), the stale path retains p and later accesses the reclaimed tcfa_bindcnt slot. Action-heap grooming can turn corruption of a replacement object into control-flow execution and arbitrary kernel-memory disclosure.\nI:H - atomic_dec(\u0026p-\u003etcfa_bindcnt) performs a 32-bit write after the tc_action allocation has been reclaimed; spraying a same-cache replacement can corrupt its refcount, length, or control data and enable kernel code execution or arbitrary modification.\nA:H - The reported KASAN slab-use-after-free is the stale atomic_dec() write in __tcf_action_put(); corrupting the replacement object can cause an oops or panic, and the attacker can repeatedly attempt the netlink race."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:30.175Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d83a3fc03bc595dd39b79ad61288738fbb1f2ba"
},
{
"url": "https://git.kernel.org/stable/c/fd01abed2568209f7daaf60e5ee68ae4a4744f48"
},
{
"url": "https://git.kernel.org/stable/c/fcc7d734ceccfab8ec3398c5b34f8e775d459507"
},
{
"url": "https://git.kernel.org/stable/c/fde33eb9955d819af282d5f5e84684eaec248291"
},
{
"url": "https://git.kernel.org/stable/c/969ad6f2b266f383b44194d50d15631969b26222"
},
{
"url": "https://git.kernel.org/stable/c/2465d27ef90de9105c2bffb6c35f8ce08918e642"
},
{
"url": "https://git.kernel.org/stable/c/2e012e431aa271ef3c84206f48854f539c03bff0"
},
{
"url": "https://git.kernel.org/stable/c/7b16eb911091aae237a8673da94e4dfb9cd21d54"
}
],
"title": "net/sched: fix use-after-free in __tcf_action_put()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99167",
"datePublished": "2026-10-28T10:35:18.850Z",
"dateReserved": "2026-09-25T10:25:14.398Z",
"dateUpdated": "2026-10-31T12:44:30.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90154 (GCVE-0-2026-90154)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: scope session state changes to bound connections
ksmbd_all_conn_set_status() treats every connection whose transient
binding flag is set as belonging to the target SessionId. A logoff or
session replacement can consequently move an unrelated connection to
NEED_RECONNECT or NEED_SETUP.
Pass the target session itself and select connections using either the
connection-local session xarray or the session's permanent channel list.
Use the same association test while waiting for requests to drain.
Serialize session-wide status changes under request_lock and do not
overwrite EXITING or RELEASING. Protect the shutdown transition with the
same lock so a concurrent session update cannot revive a closing
connection.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/connection.c",
"fs/smb/server/connection.h",
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3deefd5fb1368e2577144b0961b1a5df26b587d1",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "3d66f3ec3c69fa242939a9f9e6815df33390b1bb",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "1ff0e41afbe73240a7d7b96d4e8e86d0aaf0fe0b",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "0875872718b98e8530fbc634e5aa7dbd3253b80d",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "c50e628122aed077695669e25b842e778511a43d",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/connection.c",
"fs/smb/server/connection.h",
"fs/smb/server/mgmt/user_session.c",
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: scope session state changes to bound connections\n\nksmbd_all_conn_set_status() treats every connection whose transient\nbinding flag is set as belonging to the target SessionId. A logoff or\nsession replacement can consequently move an unrelated connection to\nNEED_RECONNECT or NEED_SETUP.\n\nPass the target session itself and select connections using either the\nconnection-local session xarray or the session\u0027s permanent channel list.\nUse the same association test while waiting for requests to drain.\n\nSerialize session-wide status changes under request_lock and do not\noverwrite EXITING or RELEASING. Protect the shutdown transition with the\nsame lock so a concurrent session update cannot revive a closing\nconnection."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:09.901Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3deefd5fb1368e2577144b0961b1a5df26b587d1"
},
{
"url": "https://git.kernel.org/stable/c/3d66f3ec3c69fa242939a9f9e6815df33390b1bb"
},
{
"url": "https://git.kernel.org/stable/c/1ff0e41afbe73240a7d7b96d4e8e86d0aaf0fe0b"
},
{
"url": "https://git.kernel.org/stable/c/0875872718b98e8530fbc634e5aa7dbd3253b80d"
},
{
"url": "https://git.kernel.org/stable/c/c50e628122aed077695669e25b842e778511a43d"
}
],
"title": "ksmbd: scope session state changes to bound connections",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90154",
"datePublished": "2026-09-17T16:06:47.046Z",
"dateReserved": "2026-09-11T19:38:34.789Z",
"dateUpdated": "2026-10-21T12:50:09.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74373 (GCVE-0-2026-74373)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: fix bio accounting for split md cloned bios
Use md_cloned_bio() to control bio accounting instead of relying
on r1bio_existed in raid1 or the io_accounting flag in raid10.
The previous logic does not reliably reflect whether a bio is an
md cloned bio. When a failed bio is split and resubmitted via
bio_submit_split_bioset() on the error path, this can lead to either
double accounting for md cloned bios, or missing accounting for bios
returned from bio_submit_split_bioset()
Fix this by using md_cloned_bio() to detect md cloned bios and
skip accounting accordingly.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c",
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91d0fc000d8cc40fcb4285e6160dd1ce98c56201",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "235d16ae715104b981a4fbc9434398e3816773b1",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "bcf30e14d2bd509c57e93021b46aedc878896e7b",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "bb8d7ea74206b419aa05d7773a15a923b668c9f0",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "ba976e3501111d11c550848b3b7341a73035f582",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c",
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: fix bio accounting for split md cloned bios\n\nUse md_cloned_bio() to control bio accounting instead of relying\non r1bio_existed in raid1 or the io_accounting flag in raid10.\n\nThe previous logic does not reliably reflect whether a bio is an\nmd cloned bio. When a failed bio is split and resubmitted via\nbio_submit_split_bioset() on the error path, this can lead to either\ndouble accounting for md cloned bios, or missing accounting for bios\nreturned from bio_submit_split_bioset()\n\nFix this by using md_cloned_bio() to detect md cloned bios and\nskip accounting accordingly."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:30.565Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91d0fc000d8cc40fcb4285e6160dd1ce98c56201"
},
{
"url": "https://git.kernel.org/stable/c/235d16ae715104b981a4fbc9434398e3816773b1"
},
{
"url": "https://git.kernel.org/stable/c/bcf30e14d2bd509c57e93021b46aedc878896e7b"
},
{
"url": "https://git.kernel.org/stable/c/bb8d7ea74206b419aa05d7773a15a923b668c9f0"
},
{
"url": "https://git.kernel.org/stable/c/ba976e3501111d11c550848b3b7341a73035f582"
}
],
"title": "md/raid1,raid10: fix bio accounting for split md cloned bios",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74373",
"datePublished": "2026-08-15T05:58:52.990Z",
"dateReserved": "2026-08-15T05:44:03.889Z",
"dateUpdated": "2026-10-21T12:45:30.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99085 (GCVE-0-2026-99085)
Vulnerability from cvelistv5
Published
2026-10-23 12:45
Modified
2026-10-23 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
A CPU going down has to empty its own rq. Its hotplug thread waits in
sched_cpu_wait_empty() until nothing else is left, and the only thing that
wakes it is balance_push(), which runs from __schedule() on the dying CPU
and pushes off the migratable tasks the CPU picks.
sched_ext breaks this. A task sitting on a user DSQ or held by the BPF
scheduler is still counted on its rq, but an inactive CPU no longer calls
ops.dispatch() and can't pull the task back. The dying CPU goes idle with
the task still counted, and one of two things happens:
- Another CPU consumes the task. The rq empties without a __schedule() on
the dying CPU, so the hotplug thread is never woken and cpu_down() hangs
holding cpu_hotplug_lock.
- The task is affine only to the dying CPU. Nothing can move it, and the
offline stalls until the watchdog ejects the BPF scheduler.
When the rq goes offline, re-enqueue every task on it that isn't already on
the local DSQ. An enqueue on an offline rq lands on the local DSQ, so the
dying CPU itself picks the tasks and balance_push() pushes them off, the
same as for the other sched classes. From then on no sched_ext path on
another CPU can pull a task off the rq.
ops.dispatch() currently stops as soon as the CPU goes inactive, and CPU
hotplug then waits for an RCU grace period before taking the rq offline. A
BPF-held task affine only to the dying CPU and preempted inside an RCU
read-side critical section would block that grace period, and the rq would
never go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps
running until the rq goes offline. Only the dying CPU's own hotplug thread
clears the flag during teardown, and task_can_run_on_remote_rq() still keeps
other rqs' tasks off the CPU.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "638ee6bca19750934ea13f9c325f46fd8ae60064",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "173ff9d03ec6373c3158b6e630af33a9b36fd216",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "d35a535d3e3e71f92a051d94e415f43612c4edfc",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/inlines.h",
"kernel/sched/ext/sub.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler\n\nA CPU going down has to empty its own rq. Its hotplug thread waits in\nsched_cpu_wait_empty() until nothing else is left, and the only thing that\nwakes it is balance_push(), which runs from __schedule() on the dying CPU\nand pushes off the migratable tasks the CPU picks.\n\nsched_ext breaks this. A task sitting on a user DSQ or held by the BPF\nscheduler is still counted on its rq, but an inactive CPU no longer calls\nops.dispatch() and can\u0027t pull the task back. The dying CPU goes idle with\nthe task still counted, and one of two things happens:\n\n- Another CPU consumes the task. The rq empties without a __schedule() on\n the dying CPU, so the hotplug thread is never woken and cpu_down() hangs\n holding cpu_hotplug_lock.\n- The task is affine only to the dying CPU. Nothing can move it, and the\n offline stalls until the watchdog ejects the BPF scheduler.\n\nWhen the rq goes offline, re-enqueue every task on it that isn\u0027t already on\nthe local DSQ. An enqueue on an offline rq lands on the local DSQ, so the\ndying CPU itself picks the tasks and balance_push() pushes them off, the\nsame as for the other sched classes. From then on no sched_ext path on\nanother CPU can pull a task off the rq.\n\nops.dispatch() currently stops as soon as the CPU goes inactive, and CPU\nhotplug then waits for an RCU grace period before taking the rq offline. A\nBPF-held task affine only to the dying CPU and preempted inside an RCU\nread-side critical section would block that grace period, and the rq would\nnever go offline. Test SCX_RQ_ONLINE directly so that ops.dispatch() keeps\nrunning until the rq goes offline. Only the dying CPU\u0027s own hotplug thread\nclears the flag during teardown, and task_can_run_on_remote_rq() still keeps\nother rqs\u0027 tasks off the CPU."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:45:03.465Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f79cd7a2df3768323fbfb9b0f96adff08fb7eb4c"
},
{
"url": "https://git.kernel.org/stable/c/638ee6bca19750934ea13f9c325f46fd8ae60064"
},
{
"url": "https://git.kernel.org/stable/c/173ff9d03ec6373c3158b6e630af33a9b36fd216"
},
{
"url": "https://git.kernel.org/stable/c/d35a535d3e3e71f92a051d94e415f43612c4edfc"
}
],
"title": "sched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99085",
"datePublished": "2026-10-23T12:45:03.465Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-23T12:45:03.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92520 (GCVE-0-2026-92520)
Vulnerability from cvelistv5
Published
2026-09-17 16:10
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Zero queue and stack outputs on lock failure
Queue and stack pop/peek helpers accept an uninitialized output buffer
because the verifier expects the helper to initialize it. The empty-map
error path clears the buffer, but a failed lock acquisition returns
-EBUSY without writing it.
Clear the output before returning -EBUSY so BPF programs cannot observe
uninitialized stack contents after a failed helper call.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e388671635acf470f0986d874389148fd234620b Version: a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 Version: a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 Version: a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 Version: a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 Version: a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 Version: 40e34ea01748e5b8afdd40a172868be1e1ab0ede Version: 388c9d3eefaea99828ee5000c693128a5b41ee7c Version: acabf5df49aa3a4f9c96200102d893351b511a88 Version: 232f0ba4d69263af5912e279fcc32fef2882b1dc Version: 6.1.56 ≤ Version: 5.4.258 ≤ Version: 5.10.198 ≤ Version: 5.15.134 ≤ Version: 6.5.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/queue_stack_maps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6468e8ac026b44ae2a78114b80f9d1b9164d0f6c",
"status": "affected",
"version": "e388671635acf470f0986d874389148fd234620b",
"versionType": "git"
},
{
"lessThan": "a6090eeb289c5fa45f7b629befac2bd3c19a6dae",
"status": "affected",
"version": "a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8",
"versionType": "git"
},
{
"lessThan": "23b4bcc79bab5285275912b94e98c286f281de75",
"status": "affected",
"version": "a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8",
"versionType": "git"
},
{
"lessThan": "1534c4bff3aaca19c4c9a82f93e9b81f7c983de3",
"status": "affected",
"version": "a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8",
"versionType": "git"
},
{
"lessThan": "e2396b8a562073787e627a5f483f1bc5c452fa6a",
"status": "affected",
"version": "a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8",
"versionType": "git"
},
{
"lessThan": "7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232",
"status": "affected",
"version": "a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8",
"versionType": "git"
},
{
"status": "affected",
"version": "40e34ea01748e5b8afdd40a172868be1e1ab0ede",
"versionType": "git"
},
{
"status": "affected",
"version": "388c9d3eefaea99828ee5000c693128a5b41ee7c",
"versionType": "git"
},
{
"status": "affected",
"version": "acabf5df49aa3a4f9c96200102d893351b511a88",
"versionType": "git"
},
{
"status": "affected",
"version": "232f0ba4d69263af5912e279fcc32fef2882b1dc",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.56",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.258",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.198",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.134",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/queue_stack_maps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.258",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.198",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.134",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Zero queue and stack outputs on lock failure\n\nQueue and stack pop/peek helpers accept an uninitialized output buffer\nbecause the verifier expects the helper to initialize it. The empty-map\nerror path clears the buffer, but a failed lock acquisition returns\n-EBUSY without writing it.\n\nClear the output before returning -EBUSY so BPF programs cannot observe\nuninitialized stack contents after a failed helper call."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:45.323Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6468e8ac026b44ae2a78114b80f9d1b9164d0f6c"
},
{
"url": "https://git.kernel.org/stable/c/a6090eeb289c5fa45f7b629befac2bd3c19a6dae"
},
{
"url": "https://git.kernel.org/stable/c/23b4bcc79bab5285275912b94e98c286f281de75"
},
{
"url": "https://git.kernel.org/stable/c/1534c4bff3aaca19c4c9a82f93e9b81f7c983de3"
},
{
"url": "https://git.kernel.org/stable/c/e2396b8a562073787e627a5f483f1bc5c452fa6a"
},
{
"url": "https://git.kernel.org/stable/c/7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232"
}
],
"title": "bpf: Zero queue and stack outputs on lock failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-92520",
"datePublished": "2026-09-17T16:10:27.447Z",
"dateReserved": "2026-09-16T12:21:13.874Z",
"dateUpdated": "2026-10-30T12:35:45.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23143 (GCVE-0-2026-23143)
Vulnerability from cvelistv5
Published
2026-02-14 15:36
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix misalignment bug in struct virtnet_info
Use the new TRAILING_OVERLAP() helper to fix a misalignment bug
along with the following warning:
drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
This helper creates a union between a flexible-array member (FAM)
and a set of members that would otherwise follow it (in this case
`u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];`). This
overlays the trailing members (rss_hash_key_data) onto the FAM
(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.
The static_assert() ensures this alignment remains.
Notice that due to tail padding in flexible `struct
virtio_net_rss_config_trailer`, `rss_trailer.hash_key_data`
(at offset 83 in struct virtnet_info) and `rss_hash_key_data` (at
offset 84 in struct virtnet_info) are misaligned by one byte. See
below:
struct virtio_net_rss_config_trailer {
__le16 max_tx_vq; /* 0 2 */
__u8 hash_key_length; /* 2 1 */
__u8 hash_key_data[]; /* 3 0 */
/* size: 4, cachelines: 1, members: 3 */
/* padding: 1 */
/* last cacheline: 4 bytes */
};
struct virtnet_info {
...
struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */
/* XXX last struct has 1 byte of padding */
u8 rss_hash_key_data[40]; /* 84 40 */
...
/* size: 832, cachelines: 13, members: 48 */
/* sum members: 801, holes: 8, sum holes: 31 */
/* paddings: 2, sum paddings: 5 */
};
After changes, those members are correctly aligned at offset 795:
struct virtnet_info {
...
union {
struct virtio_net_rss_config_trailer rss_trailer; /* 792 4 */
struct {
unsigned char __offset_to_hash_key_data[3]; /* 792 3 */
u8 rss_hash_key_data[40]; /* 795 40 */
}; /* 792 43 */
}; /* 792 44 */
...
/* size: 840, cachelines: 14, members: 47 */
/* sum members: 801, holes: 8, sum holes: 35 */
/* padding: 4 */
/* paddings: 1, sum paddings: 4 */
/* last cacheline: 8 bytes */
};
As a result, the RSS key passed to the device is shifted by 1
byte: the last byte is cut off, and instead a (possibly
uninitialized) byte is added at the beginning.
As a last note `struct virtio_net_rss_config_hdr *rss_hdr;` is also
moved to the end, since it seems those three members should stick
around together. :)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1e9614a142eff34c93e94a15a71ad0e806799c4",
"status": "affected",
"version": "4c47aff10f6f0a2506dc2126c17ccd4c42bfa211",
"versionType": "git"
},
{
"lessThan": "ae48108c2310f1dd700e0dbb655c2f1d92ed00fc",
"status": "affected",
"version": "ed3100e90d0d120a045a551b85eb43cf2527e885",
"versionType": "git"
},
{
"lessThan": "4156c3745f06bc197094b9ee97a9584e69ed00bf",
"status": "affected",
"version": "ed3100e90d0d120a045a551b85eb43cf2527e885",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.91",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix misalignment bug in struct virtnet_info\n\nUse the new TRAILING_OVERLAP() helper to fix a misalignment bug\nalong with the following warning:\n\ndrivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]\n\nThis helper creates a union between a flexible-array member (FAM)\nand a set of members that would otherwise follow it (in this case\n`u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];`). This\noverlays the trailing members (rss_hash_key_data) onto the FAM\n(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.\nThe static_assert() ensures this alignment remains.\n\nNotice that due to tail padding in flexible `struct\nvirtio_net_rss_config_trailer`, `rss_trailer.hash_key_data`\n(at offset 83 in struct virtnet_info) and `rss_hash_key_data` (at\noffset 84 in struct virtnet_info) are misaligned by one byte. See\nbelow:\n\nstruct virtio_net_rss_config_trailer {\n __le16 max_tx_vq; /* 0 2 */\n __u8 hash_key_length; /* 2 1 */\n __u8 hash_key_data[]; /* 3 0 */\n\n /* size: 4, cachelines: 1, members: 3 */\n /* padding: 1 */\n /* last cacheline: 4 bytes */\n};\n\nstruct virtnet_info {\n...\n struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */\n\n /* XXX last struct has 1 byte of padding */\n\n u8 rss_hash_key_data[40]; /* 84 40 */\n...\n /* size: 832, cachelines: 13, members: 48 */\n /* sum members: 801, holes: 8, sum holes: 31 */\n /* paddings: 2, sum paddings: 5 */\n};\n\nAfter changes, those members are correctly aligned at offset 795:\n\nstruct virtnet_info {\n...\n union {\n struct virtio_net_rss_config_trailer rss_trailer; /* 792 4 */\n struct {\n unsigned char __offset_to_hash_key_data[3]; /* 792 3 */\n u8 rss_hash_key_data[40]; /* 795 40 */\n }; /* 792 43 */\n }; /* 792 44 */\n...\n /* size: 840, cachelines: 14, members: 47 */\n /* sum members: 801, holes: 8, sum holes: 35 */\n /* padding: 4 */\n /* paddings: 1, sum paddings: 4 */\n /* last cacheline: 8 bytes */\n};\n\nAs a result, the RSS key passed to the device is shifted by 1\nbyte: the last byte is cut off, and instead a (possibly\nuninitialized) byte is added at the beginning.\n\nAs a last note `struct virtio_net_rss_config_hdr *rss_hdr;` is also\nmoved to the end, since it seems those three members should stick\naround together. :)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:54.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1e9614a142eff34c93e94a15a71ad0e806799c4"
},
{
"url": "https://git.kernel.org/stable/c/ae48108c2310f1dd700e0dbb655c2f1d92ed00fc"
},
{
"url": "https://git.kernel.org/stable/c/4156c3745f06bc197094b9ee97a9584e69ed00bf"
}
],
"title": "virtio_net: Fix misalignment bug in struct virtnet_info",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23143",
"datePublished": "2026-02-14T15:36:08.834Z",
"dateReserved": "2026-01-13T15:37:45.973Z",
"dateUpdated": "2026-10-21T12:38:54.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90177 (GCVE-0-2026-90177)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check pointer type for all atomic RMW paths
Atomic RMW verification records an instruction pointer type only when the
current destination is PTR_TO_ARENA. A second path can therefore reach the
same instruction with an ordinary pointer without comparing it against the
saved arena type.
The post-verification fixup uses the saved type to rewrite the instruction
to BPF_PROBE_ATOMIC for every path. Record the actual destination type for
all atomic RMW paths so the existing mismatch check rejects incompatible
uses of one instruction.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b14dabe9656c1029abf3aa01e69c0d62f37f2f88",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
},
{
"lessThan": "d4ba9d888ac0a8f12c78071fff73e1205a0b9293",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
},
{
"lessThan": "eb287c6e81dedef92da01eb947f380d0aae513c3",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
},
{
"lessThan": "4bc49ae344d65cfcef738f281ac575cf73ca2fc5",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check pointer type for all atomic RMW paths\n\nAtomic RMW verification records an instruction pointer type only when the\ncurrent destination is PTR_TO_ARENA. A second path can therefore reach the\nsame instruction with an ordinary pointer without comparing it against the\nsaved arena type.\n\nThe post-verification fixup uses the saved type to rewrite the instruction\nto BPF_PROBE_ATOMIC for every path. Record the actual destination type for\nall atomic RMW paths so the existing mismatch check rejects incompatible\nuses of one instruction."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled input is the BPF instruction stream copied in bpf_prog_load() from bpf(2) BPF_PROG_LOAD (__sys_bpf). do_check_insn() then check_atomic() then check_atomic_rmw() sees a mixed PTR_TO_ARENA versus kernel-pointer atomic; that bytecode is local syscall input, not a remote protocol payload.\nAC:L - The attacker authors both verifier paths: one branch with a PTR_TO_ARENA destination and another with PTR_TO_MAP_VALUE or PTR_TO_STACK at the same BPF_ATOMIC RMW. check_atomic_rmw() records only the arena type, bpf_convert_ctx_accesses() rewrites it to BPF_PROBE_ATOMIC, and bpf_prog_test_run_syscall() takes the non-arena path on demand.\nPR:L - The mixed path needs a BPF_MAP_TYPE_ARENA map; check_map_prog_compatibility() rejects that unless env-\u003ebpf_capable and env-\u003eallow_ptr_leaks (bpf_token_capable(CAP_BPF) and bpf_token_capable(CAP_PERFMON)). bpf_token_capable() uses ns_capable() on a delegated token userns, so this is not init-namespace root.\nUI:N - The attacker creates the arena with BPF_MAP_CREATE, loads the mixed-path program with BPF_PROG_LOAD, and executes it via bpf_prog_test_run() to bpf_prog_test_run_syscall(); no other user must mount, open a file, or otherwise cooperate.\nS:U - The confused BPF_PROBE_ATOMIC is JITed as emit_atomic_rmw_index() adding arena kern_vm_start (R12) onto a kernel map or stack pointer and runs in the host kernel; that is host memory corruption, not a KVM/Xen guest-to-host escape or IOMMU bypass.\nC:H - After bpf_convert_ctx_accesses() rewrites the shared RMW to BPF_PROBE_ATOMIC, the non-arena path executes lock xchg/cmpxchg/fetch-add at (PTR_TO_MAP_VALUE or PTR_TO_STACK + bpf_arena_get_kern_vm_start()). BPF_FETCH, XCHG, and CMPXCHG return the old value from that address, an arbitrary kernel read.\nI:H - The same instruction performs an attacker-chosen atomic RMW (BPF_ADD/AND/OR/XOR/XCHG/CMPXCHG in check_atomic_rmw) at kernel_ptr+kern_vm_start. With CONFIG_VMAP_STACK or a vmalloc map, that sum is a canonical direct-map address, giving a kernel write primitive.\nA:H - An atomic RMW into the direct map corrupts live kernel state and can panic; a non-canonical or unmapped sum that a JIT does not cover with an exception table oopses. Type-confused kernel atomics are Availability High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:19.113Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b14dabe9656c1029abf3aa01e69c0d62f37f2f88"
},
{
"url": "https://git.kernel.org/stable/c/d4ba9d888ac0a8f12c78071fff73e1205a0b9293"
},
{
"url": "https://git.kernel.org/stable/c/eb287c6e81dedef92da01eb947f380d0aae513c3"
},
{
"url": "https://git.kernel.org/stable/c/4bc49ae344d65cfcef738f281ac575cf73ca2fc5"
}
],
"title": "bpf: Check pointer type for all atomic RMW paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90177",
"datePublished": "2026-09-17T16:07:03.097Z",
"dateReserved": "2026-09-11T19:38:34.791Z",
"dateUpdated": "2026-10-21T12:50:19.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90359 (GCVE-0-2026-90359)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject >8 byte return values on return-reading trampoline paths
btf_distill_func_proto() builds the function model used for the
fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has
accepted a 16-byte __int128 return value since the trampoline was
introduced: __get_type_size() returns the integer's type size, and the
return-type check only rejected ret < 0.
But the BPF trampoline preserves only 8 bytes of the return value (RAX on
x86, i.e. R0). For an attach type that reads the target's return value the
second half (RDX / R3) is neither saved nor restored, so a program
attached to a function returning a 16-byte value corrupts the value seen
by the real caller and itself observes only half of it. struct_ops
trampolines have the same limitation.
This affects the attach types that read the target's return value: fexit,
fmod_ret and fsession (plus the _multi variants of fexit and fsession),
and struct_ops. fentry/fentry_multi run before the target returns and are
unaffected.
Reject a >8 byte return value for these attach types in
bpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for
struct_ops in bpf_struct_ops_desc_init().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/bpf_struct_ops.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "de54ba33690d2dd3c4aa686c9693505644285b0b",
"status": "affected",
"version": "fec56f5890d93fc2ed74166c397dc186b1c25951",
"versionType": "git"
},
{
"lessThan": "9a9e902bd0556052534641f7d5f868c6dc4b84ae",
"status": "affected",
"version": "fec56f5890d93fc2ed74166c397dc186b1c25951",
"versionType": "git"
},
{
"lessThan": "d36ac53fc83baf843c51b7afd6d2471f36b713d8",
"status": "affected",
"version": "fec56f5890d93fc2ed74166c397dc186b1c25951",
"versionType": "git"
},
{
"lessThan": "c48796aa6c392cde93946e5d5a9a1f1b1cf72feb",
"status": "affected",
"version": "fec56f5890d93fc2ed74166c397dc186b1c25951",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/bpf_struct_ops.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject \u003e8 byte return values on return-reading trampoline paths\n\nbtf_distill_func_proto() builds the function model used for the\nfentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has\naccepted a 16-byte __int128 return value since the trampoline was\nintroduced: __get_type_size() returns the integer\u0027s type size, and the\nreturn-type check only rejected ret \u003c 0.\n\nBut the BPF trampoline preserves only 8 bytes of the return value (RAX on\nx86, i.e. R0). For an attach type that reads the target\u0027s return value the\nsecond half (RDX / R3) is neither saved nor restored, so a program\nattached to a function returning a 16-byte value corrupts the value seen\nby the real caller and itself observes only half of it. struct_ops\ntrampolines have the same limitation.\n\nThis affects the attach types that read the target\u0027s return value: fexit,\nfmod_ret and fsession (plus the _multi variants of fexit and fsession),\nand struct_ops. fentry/fentry_multi run before the target returns and are\nunaffected.\n\nReject a \u003e8 byte return value for these attach types in\nbpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for\nstruct_ops in bpf_struct_ops_desc_init()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:16.798Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/de54ba33690d2dd3c4aa686c9693505644285b0b"
},
{
"url": "https://git.kernel.org/stable/c/9a9e902bd0556052534641f7d5f868c6dc4b84ae"
},
{
"url": "https://git.kernel.org/stable/c/d36ac53fc83baf843c51b7afd6d2471f36b713d8"
},
{
"url": "https://git.kernel.org/stable/c/c48796aa6c392cde93946e5d5a9a1f1b1cf72feb"
}
],
"title": "bpf: Reject \u003e8 byte return values on return-reading trampoline paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90359",
"datePublished": "2026-09-17T16:09:04.187Z",
"dateReserved": "2026-09-11T19:38:34.806Z",
"dateUpdated": "2026-10-21T12:51:16.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80692 (GCVE-0-2026-80692)
Vulnerability from cvelistv5
Published
2026-08-28 06:52
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
There is theoretical UAF if the conn is freed while the hci_sync task
is running.
Hold refcount to avoid that.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c Version: 881559af5f5c545f6828e7c74d79813eb886d523 Version: 881559af5f5c545f6828e7c74d79813eb886d523 Version: 881559af5f5c545f6828e7c74d79813eb886d523 Version: 881559af5f5c545f6828e7c74d79813eb886d523 Version: 5dd0bd277a0a936708a33ecc447dce77a08cbde6 Version: 6.6.51 ≤ Version: 6.8.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:08.082830Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:33.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805",
"status": "affected",
"version": "d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c",
"versionType": "git"
},
{
"lessThan": "301a4e2e89313dee10f0e8cb084daedbbe4a3dce",
"status": "affected",
"version": "881559af5f5c545f6828e7c74d79813eb886d523",
"versionType": "git"
},
{
"lessThan": "a4de6fc95b2f36967fc247ae51cad2171194f7cd",
"status": "affected",
"version": "881559af5f5c545f6828e7c74d79813eb886d523",
"versionType": "git"
},
{
"lessThan": "9a77f296aff4b2ca5f2928ab3a3220c82d8b4074",
"status": "affected",
"version": "881559af5f5c545f6828e7c74d79813eb886d523",
"versionType": "git"
},
{
"lessThan": "2f5d635ad5906b0235bc0c870e8beba3116e1e98",
"status": "affected",
"version": "881559af5f5c545f6828e7c74d79813eb886d523",
"versionType": "git"
},
{
"status": "affected",
"version": "5dd0bd277a0a936708a33ecc447dce77a08cbde6",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.51",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks\n\nThere is theoretical UAF if the conn is freed while the hci_sync task\nis running.\n\nHold refcount to avoid that."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Bluetooth HCI outgoing ACL/LE connection setup (hci_connect_acl_sync/hci_connect_le_sync) is driven by adjacent radio peers supplying HCI events (connection complete/failures, command status) while hci_cmd_sync_work blocks on controller replies on phones and laptops.\nAC:L - Race between hci_cmd_sync_work using a bare hci_conn pointer and hci_conn_del/hci_conn_failed/create_le_conn_complete teardown; attacker controls both sides by concurrently initiating L2CAP/MGMT connects and aborting or inducing remote HCI failure events until the window hits.\nPR:N - Adjacent Bluetooth peers need no Linux credentials; freeing runs on unauthenticated HCI connection events, and local triggering works via unprivileged AF_BLUETOOTH L2CAP connect() without CAP_NET_ADMIN or special namespaces.\nUI:N - Background Bluetooth auto-reconnect, pairing flows, or listening socket-driven outgoing connects create BT_OPEN hci_conn objects without deliberate user action; attacker timing of connect/teardown does not require social engineering.\nS:U - Kernel heap UAF within the Bluetooth stack enables local privilege escalation in the same kernel domain but does not cross VM, IOMMU, or sandbox boundaries.\nC:H - Freed struct hci_conn is dereferenced in hci_acl_create_conn_sync, hci_le_create_conn_sync, and create_le_conn_complete (e.g., conn-\u003epkt_type, conn-\u003edst, conn-\u003ele_conn_timeout), enabling slab reuse and arbitrary kernel memory disclosure.\nI:H - Post-free writes occur to conn fields (state, flags, timers) and function-pointer members (cleanup, connect_cfm_cb), providing groomable heap corruption suitable for arbitrary kernel write and code execution.\nA:H - UAF during hci_cmd_sync_work on connection setup reliably causes kernel oops/panic and can be retriggered by repeated connect/abort cycles from adjacent or local attackers."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:52.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805"
},
{
"url": "https://git.kernel.org/stable/c/301a4e2e89313dee10f0e8cb084daedbbe4a3dce"
},
{
"url": "https://git.kernel.org/stable/c/a4de6fc95b2f36967fc247ae51cad2171194f7cd"
},
{
"url": "https://git.kernel.org/stable/c/9a77f296aff4b2ca5f2928ab3a3220c82d8b4074"
},
{
"url": "https://git.kernel.org/stable/c/2f5d635ad5906b0235bc0c870e8beba3116e1e98"
}
],
"title": "Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80692",
"datePublished": "2026-08-28T06:52:55.529Z",
"dateReserved": "2026-08-26T14:34:25.785Z",
"dateUpdated": "2026-10-21T12:46:52.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39830 (GCVE-0-2025-39830)
Vulnerability from cvelistv5
Published
2025-09-16 13:08
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
In the error path of hws_pool_buddy_init(), the buddy allocator cleanup
doesn't free the allocator structure itself, causing a memory leak.
Add the missing kfree() to properly release all allocated memory.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-39830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T18:17:36.992991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T18:22:56.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4ccdbf50dd88a2a7399409e68887dd8077f6a562",
"status": "affected",
"version": "c61afff94373641695cc81999e9bb10408ea84d5",
"versionType": "git"
},
{
"lessThan": "86d13a6f49cb68aa91bd718b1b627e72e77285c1",
"status": "affected",
"version": "c61afff94373641695cc81999e9bb10408ea84d5",
"versionType": "git"
},
{
"lessThan": "2c0a959bebdc1ada13cf9a8242f177c5400299e6",
"status": "affected",
"version": "c61afff94373641695cc81999e9bb10408ea84d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path\n\nIn the error path of hws_pool_buddy_init(), the buddy allocator cleanup\ndoesn\u0027t free the allocator structure itself, causing a memory leak.\n\nAdd the missing kfree() to properly release all allocated memory."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:25.183Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4ccdbf50dd88a2a7399409e68887dd8077f6a562"
},
{
"url": "https://git.kernel.org/stable/c/86d13a6f49cb68aa91bd718b1b627e72e77285c1"
},
{
"url": "https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6"
}
],
"title": "net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39830",
"datePublished": "2025-09-16T13:08:48.110Z",
"dateReserved": "2025-04-16T07:20:57.140Z",
"dateUpdated": "2026-10-21T12:37:25.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63879 (GCVE-0-2026-63879)
Vulnerability from cvelistv5
Published
2026-07-19 14:54
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix amdgpu_hmm_range_get_pages
The notifier sequence must only be read once or otherwise we could work
with invalid pages.
While at it also fix the coding style, e.g. drop the pre-initialized
return value and use the common define for 2G range.
(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:32:44.866799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:53.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e35cf322897dd4921248d11311a89c865b534c14",
"status": "affected",
"version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
"versionType": "git"
},
{
"lessThan": "93a9f121de6383f20290840d025ee28fda5f53b5",
"status": "affected",
"version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
"versionType": "git"
},
{
"lessThan": "fa34d3e14cb763b50702e8a0f7d4cfd877a73ab9",
"status": "affected",
"version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
"versionType": "git"
},
{
"lessThan": "2fd24407457a6b181ba827705678da70e528dcd0",
"status": "affected",
"version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
"versionType": "git"
},
{
"lessThan": "962d684b5dc0741dcd93485d41b450de402d5592",
"status": "affected",
"version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix amdgpu_hmm_range_get_pages\n\nThe notifier sequence must only be read once or otherwise we could work\nwith invalid pages.\n\nWhile at it also fix the coding style, e.g. drop the pre-initialized\nreturn value and use the common define for 2G range.\n\n(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a \u003e2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:43.701Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e35cf322897dd4921248d11311a89c865b534c14"
},
{
"url": "https://git.kernel.org/stable/c/93a9f121de6383f20290840d025ee28fda5f53b5"
},
{
"url": "https://git.kernel.org/stable/c/fa34d3e14cb763b50702e8a0f7d4cfd877a73ab9"
},
{
"url": "https://git.kernel.org/stable/c/2fd24407457a6b181ba827705678da70e528dcd0"
},
{
"url": "https://git.kernel.org/stable/c/962d684b5dc0741dcd93485d41b450de402d5592"
}
],
"title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63879",
"datePublished": "2026-07-19T14:54:51.698Z",
"dateReserved": "2026-07-19T07:54:57.018Z",
"dateUpdated": "2026-10-21T12:42:43.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72337 (GCVE-0-2026-72337)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: 6lowpan: avoid untracked enable work
lowpan_enable_set() allocates a temporary work item and schedules
do_enable_set() on system_wq, then returns to debugfs. The debugfs active
operation has ended at that point, but the worker still executes module
text and manipulates enable_6lowpan and listen_chan.
bt_6lowpan_exit() removes the debugfs files and immediately closes and
puts listen_chan. It has no pointer to the queued work item, so it cannot
cancel or flush it before tearing down the state that the worker uses.
The buggy scenario involves two paths, with each column showing the order
within that path:
debugfs enable write module exit
1. lowpan_enable_set() allocates 1. bt_6lowpan_exit() removes
set_enable work the debugfs file
2. schedule_work() queues 2. bt_6lowpan_exit() closes
do_enable_set() and puts listen_chan
3. the write operation returns 3. module teardown can continue
4. do_enable_set() later runs
against stale state
Run the enable state transition synchronously in lowpan_enable_set()
instead. The simple debugfs setter can sleep, and this file already handles
the 6LoWPAN control write synchronously under the same set_lock. Once the
setter returns, debugfs removal covers the whole operation and exit can no
longer race with an untracked work item.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in do_enable_set+0x113/0x2e0
Workqueue: events do_enable_set [bluetooth_6lowpan]
The buggy address belongs to the object at ffff888109cb8000
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 90305829635d90a5053ec99a261035b4ce0a2649 Version: 90305829635d90a5053ec99a261035b4ce0a2649 Version: 90305829635d90a5053ec99a261035b4ce0a2649 Version: 90305829635d90a5053ec99a261035b4ce0a2649 Version: 90305829635d90a5053ec99a261035b4ce0a2649 Version: 90305829635d90a5053ec99a261035b4ce0a2649 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/6lowpan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4137ad60d23ace43c7fc857bd12167750c85e89d",
"status": "affected",
"version": "90305829635d90a5053ec99a261035b4ce0a2649",
"versionType": "git"
},
{
"lessThan": "333a39f134dd0bc614ef6658e9ccd448080443d1",
"status": "affected",
"version": "90305829635d90a5053ec99a261035b4ce0a2649",
"versionType": "git"
},
{
"lessThan": "9061d0c19e97bb8d0aa235d0a571a5d6d0be7477",
"status": "affected",
"version": "90305829635d90a5053ec99a261035b4ce0a2649",
"versionType": "git"
},
{
"lessThan": "31cc289d5b179a37be439043306f518376a58187",
"status": "affected",
"version": "90305829635d90a5053ec99a261035b4ce0a2649",
"versionType": "git"
},
{
"lessThan": "feb3fc2c38ed52003142f31e04109719b200c049",
"status": "affected",
"version": "90305829635d90a5053ec99a261035b4ce0a2649",
"versionType": "git"
},
{
"lessThan": "352a59dc1f4a41314b6f827c17e16af7ca88271a",
"status": "affected",
"version": "90305829635d90a5053ec99a261035b4ce0a2649",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/6lowpan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: 6lowpan: avoid untracked enable work\n\nlowpan_enable_set() allocates a temporary work item and schedules\ndo_enable_set() on system_wq, then returns to debugfs. The debugfs active\noperation has ended at that point, but the worker still executes module\ntext and manipulates enable_6lowpan and listen_chan.\n\nbt_6lowpan_exit() removes the debugfs files and immediately closes and\nputs listen_chan. It has no pointer to the queued work item, so it cannot\ncancel or flush it before tearing down the state that the worker uses.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\ndebugfs enable write module exit\n1. lowpan_enable_set() allocates 1. bt_6lowpan_exit() removes\n set_enable work the debugfs file\n2. schedule_work() queues 2. bt_6lowpan_exit() closes\n do_enable_set() and puts listen_chan\n3. the write operation returns 3. module teardown can continue\n4. do_enable_set() later runs\n against stale state\n\nRun the enable state transition synchronously in lowpan_enable_set()\ninstead. The simple debugfs setter can sleep, and this file already handles\nthe 6LoWPAN control write synchronously under the same set_lock. Once the\nsetter returns, debugfs removal covers the whole operation and exit can no\nlonger race with an untracked work item.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in do_enable_set+0x113/0x2e0\nWorkqueue: events do_enable_set [bluetooth_6lowpan]\nThe buggy address belongs to the object at ffff888109cb8000"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:07.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4137ad60d23ace43c7fc857bd12167750c85e89d"
},
{
"url": "https://git.kernel.org/stable/c/333a39f134dd0bc614ef6658e9ccd448080443d1"
},
{
"url": "https://git.kernel.org/stable/c/9061d0c19e97bb8d0aa235d0a571a5d6d0be7477"
},
{
"url": "https://git.kernel.org/stable/c/31cc289d5b179a37be439043306f518376a58187"
},
{
"url": "https://git.kernel.org/stable/c/feb3fc2c38ed52003142f31e04109719b200c049"
},
{
"url": "https://git.kernel.org/stable/c/352a59dc1f4a41314b6f827c17e16af7ca88271a"
}
],
"title": "Bluetooth: 6lowpan: avoid untracked enable work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72337",
"datePublished": "2026-08-15T05:55:45.160Z",
"dateReserved": "2026-08-09T03:40:39.920Z",
"dateUpdated": "2026-10-30T12:29:07.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40338 (GCVE-0-2025-40338)
Vulnerability from cvelistv5
Published
2025-12-09 04:09
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: avs: Do not share the name pointer between components
By sharing 'name' directly, tearing down components may lead to
use-after-free errors. Duplicate the name to avoid that.
At the same time, update the order of operations - since commit
cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via
config") the framework does not override component->name if set before
invoking the initializer.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/intel/avs/pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e1440e0d8b2394adfc3f1ac0710e6419600d5c1",
"status": "affected",
"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba",
"versionType": "git"
},
{
"lessThan": "0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1",
"status": "affected",
"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba",
"versionType": "git"
},
{
"lessThan": "a80a82f567f7c6276d96409377d4691ea30d18a2",
"status": "affected",
"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba",
"versionType": "git"
},
{
"lessThan": "128bf29c992988f8b4f3829227339908fde5ec86",
"status": "affected",
"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba",
"versionType": "git"
},
{
"lessThan": "4dee5c1cc439b0d5ef87f741518268ad6a95b23d",
"status": "affected",
"version": "f1b3b320bd6519b16e3480f74f2926d106e3bcba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/intel/avs/pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Do not share the name pointer between components\n\nBy sharing \u0027name\u0027 directly, tearing down components may lead to\nuse-after-free errors. Duplicate the name to avoid that.\n\nAt the same time, update the order of operations - since commit\ncee28113db17 (\"ASoC: dmaengine_pcm: Allow passing component name via\nconfig\") the framework does not override component-\u003ename if set before\ninvoking the initializer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:04.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e1440e0d8b2394adfc3f1ac0710e6419600d5c1"
},
{
"url": "https://git.kernel.org/stable/c/0a187ea7a5b4e78b9be1f9c1507cff04f3ae4ab1"
},
{
"url": "https://git.kernel.org/stable/c/a80a82f567f7c6276d96409377d4691ea30d18a2"
},
{
"url": "https://git.kernel.org/stable/c/128bf29c992988f8b4f3829227339908fde5ec86"
},
{
"url": "https://git.kernel.org/stable/c/4dee5c1cc439b0d5ef87f741518268ad6a95b23d"
}
],
"title": "ASoC: Intel: avs: Do not share the name pointer between components",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40338",
"datePublished": "2025-12-09T04:09:54.753Z",
"dateReserved": "2025-04-16T07:20:57.186Z",
"dateUpdated": "2026-10-30T12:23:04.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43464 (GCVE-0-2026-43464)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The
referenced commit in the fixes tag corrected the assumption in the mlx5
driver that the XDP buffer layout doesn't change during a program
execution. However, this fix introduced another issue: the dropped
fragments still need to be counted on the driver side to avoid page
fragment reference counting issues.
Such issue can be observed with the
test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of
3600 and shrinking by 256 bytes (an upcoming selftest patch): the last
fragment gets released by the XDP code but doesn't get tracked by the
driver. This results in a negative pp_ref_count during page release and
the following splat:
WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137
Modules linked in: [...]
CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]
[...]
Call Trace:
<TASK>
mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]
mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]
mlx5e_close_rq+0x50/0x60 [mlx5_core]
mlx5e_close_queues+0x36/0x2c0 [mlx5_core]
mlx5e_close_channel+0x1c/0x50 [mlx5_core]
mlx5e_close_channels+0x45/0x80 [mlx5_core]
mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]
mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]
netif_set_mtu_ext+0xf1/0x230
do_setlink.isra.0+0x219/0x1180
rtnl_newlink+0x79f/0xb60
rtnetlink_rcv_msg+0x213/0x3a0
netlink_rcv_skb+0x48/0xf0
netlink_unicast+0x24a/0x350
netlink_sendmsg+0x1ee/0x410
__sock_sendmsg+0x38/0x60
____sys_sendmsg+0x232/0x280
___sys_sendmsg+0x78/0xb0
__sys_sendmsg+0x5f/0xb0
[...]
do_syscall_64+0x57/0xc50
This patch fixes the issue by doing page frag counting on all the
original XDP buffer fragments for all relevant XDP actions (XDP_TX ,
XDP_REDIRECT and XDP_PASS). This is basically reverting to the original
counting before the commit in the fixes tag.
As frag_page is still pointing to the original tail, the nr_frags
parameter to xdp_update_skb_frags_info() needs to be calculated
in a different way to reflect the new nr_frags.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 72328f25755ee966724f46e3a0e8e59bef2091ba Version: 0049fd63881505566824e88cfa624638f921c808 Version: afd5ba577c10639f62e8120df67dc70ea4b61176 Version: afd5ba577c10639f62e8120df67dc70ea4b61176 Version: afd5ba577c10639f62e8120df67dc70ea4b61176 Version: d969645b9b7810289bf3c353ea06957373756b8e Version: 6.6.115 ≤ Version: 6.12.56 ≤ Version: 6.17.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1106412414dc3ee62999115be10ca83199b02108",
"status": "affected",
"version": "72328f25755ee966724f46e3a0e8e59bef2091ba",
"versionType": "git"
},
{
"lessThan": "9488ee96b4f53d2aed474c744f0ed64f61d1dcc9",
"status": "affected",
"version": "0049fd63881505566824e88cfa624638f921c808",
"versionType": "git"
},
{
"lessThan": "c74557495efb4bd0adefdfc8678ecdbc82a06da3",
"status": "affected",
"version": "afd5ba577c10639f62e8120df67dc70ea4b61176",
"versionType": "git"
},
{
"lessThan": "03cb50e5b74fce8bf6d92b860371b66253cf0f8d",
"status": "affected",
"version": "afd5ba577c10639f62e8120df67dc70ea4b61176",
"versionType": "git"
},
{
"lessThan": "a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa",
"status": "affected",
"version": "afd5ba577c10639f62e8120df67dc70ea4b61176",
"versionType": "git"
},
{
"status": "affected",
"version": "d969645b9b7810289bf3c353ea06957373756b8e",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ\n\nXDP multi-buf programs can modify the layout of the XDP buffer when the\nprogram calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The\nreferenced commit in the fixes tag corrected the assumption in the mlx5\ndriver that the XDP buffer layout doesn\u0027t change during a program\nexecution. However, this fix introduced another issue: the dropped\nfragments still need to be counted on the driver side to avoid page\nfragment reference counting issues.\n\nSuch issue can be observed with the\ntest_xdp_native_adjst_tail_shrnk_data selftest when using a payload of\n3600 and shrinking by 256 bytes (an upcoming selftest patch): the last\nfragment gets released by the XDP code but doesn\u0027t get tracked by the\ndriver. This results in a negative pp_ref_count during page release and\nthe following splat:\n\n WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137\n Modules linked in: [...]\n CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core]\n [...]\n Call Trace:\n \u003cTASK\u003e\n mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core]\n mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core]\n mlx5e_close_rq+0x50/0x60 [mlx5_core]\n mlx5e_close_queues+0x36/0x2c0 [mlx5_core]\n mlx5e_close_channel+0x1c/0x50 [mlx5_core]\n mlx5e_close_channels+0x45/0x80 [mlx5_core]\n mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core]\n mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core]\n netif_set_mtu_ext+0xf1/0x230\n do_setlink.isra.0+0x219/0x1180\n rtnl_newlink+0x79f/0xb60\n rtnetlink_rcv_msg+0x213/0x3a0\n netlink_rcv_skb+0x48/0xf0\n netlink_unicast+0x24a/0x350\n netlink_sendmsg+0x1ee/0x410\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x232/0x280\n ___sys_sendmsg+0x78/0xb0\n __sys_sendmsg+0x5f/0xb0\n [...]\n do_syscall_64+0x57/0xc50\n\nThis patch fixes the issue by doing page frag counting on all the\noriginal XDP buffer fragments for all relevant XDP actions (XDP_TX ,\nXDP_REDIRECT and XDP_PASS). This is basically reverting to the original\ncounting before the commit in the fixes tag.\n\nAs frag_page is still pointing to the original tail, the nr_frags\nparameter to xdp_update_skb_frags_info() needs to be calculated\nin a different way to reflect the new nr_frags."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable mlx5e RX path is reached by packets received on a Mellanox Ethernet interface, before any network-layer authentication. A remote peer can supply the packet sizes and traffic needed to enter the multi-buffer receive path.\nAC:L - Once an affected deployment has an XDP multi-buffer program using layout-changing helpers, triggering only requires sending packets that span fragments and cause the program to shrink or pull data. The packet pattern is attacker-controlled and no race or hard-to-hit timing condition is required.\nPR:N - The attacker does not need local privileges or credentials to send packets to the affected interface. Attaching the XDP program is a deployment precondition, but the vulnerable receive path itself is unauthenticated packet processing.\nUI:N - No victim user action is needed after the affected interface and XDP program are in service. Packet reception alone drives the vulnerable code.\nS:U - The bug corrupts accounting inside the same kernel/network-device security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The investigated bug is a page-pool fragment reference accounting undercount that leads to negative reference counts and warnings, not an exposed arbitrary read or bounded information leak. The fixed code corrects lifetime accounting rather than a data disclosure path.\nI:N - The issue does not provide a demonstrated primitive for attacker-controlled data modification or control-flow hijack. The corruption is limited to page-pool reference accounting for receive buffers.\nA:H - The malformed accounting triggers WARN_ON splats in page_pool release and can be driven repeatedly through received traffic followed by normal queue teardown or reconfiguration. In severe reasonable deployments, including systems with panic_on_warn or exhausted RX page-pool resources, this can cause a kernel-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:49.291Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1106412414dc3ee62999115be10ca83199b02108"
},
{
"url": "https://git.kernel.org/stable/c/9488ee96b4f53d2aed474c744f0ed64f61d1dcc9"
},
{
"url": "https://git.kernel.org/stable/c/c74557495efb4bd0adefdfc8678ecdbc82a06da3"
},
{
"url": "https://git.kernel.org/stable/c/03cb50e5b74fce8bf6d92b860371b66253cf0f8d"
},
{
"url": "https://git.kernel.org/stable/c/a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa"
}
],
"title": "net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43464",
"datePublished": "2026-05-08T14:22:26.039Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-10-21T12:40:49.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43185 (GCVE-0-2026-43185)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value
from sp->max_recv_size and req->preferred_send_size to a signed
int before computing min_t(int, ...). A maliciously provided
preferred_send_size of 0x80000000 will return as smaller than
max_recv_size, and then be used to set the maximum allowed
alowed receive size for the next message.
By sending a second message with a large value (>1420 bytes)
the attacker can then achieve a heap buffer overflow.
This fix replaces min_t(int, ...) with min_t(u32)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf Version: 0626e6641f6b467447c81dd7678a69c66f7746cf Version: 0626e6641f6b467447c81dd7678a69c66f7746cf Version: 0626e6641f6b467447c81dd7678a69c66f7746cf Version: 0626e6641f6b467447c81dd7678a69c66f7746cf Version: 0626e6641f6b467447c81dd7678a69c66f7746cf |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/transport_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c",
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"versionType": "git"
},
{
"lessThan": "56eab82fa6fb5ca024b0514e249d40d9b23ee5a7",
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"versionType": "git"
},
{
"lessThan": "a110dbe928561d440e9e117d17331139a0bedace",
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"versionType": "git"
},
{
"lessThan": "ceae058eb707ddd0d68f0872f9d9f23b7c30c37b",
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"versionType": "git"
},
{
"lessThan": "55abc475d096da4a5356b6efb0cfdc6156bc1550",
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"versionType": "git"
},
{
"lessThan": "6b4f875aac344cdd52a1f34cc70ed2f874a65757",
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/transport_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix signededness bug in smb_direct_prepare_negotiation()\n\nsmb_direct_prepare_negotiation() casts an unsigned __u32 value\nfrom sp-\u003emax_recv_size and req-\u003epreferred_send_size to a signed\nint before computing min_t(int, ...). A maliciously provided\npreferred_send_size of 0x80000000 will return as smaller than\nmax_recv_size, and then be used to set the maximum allowed\nalowed receive size for the next message.\n\nBy sending a second message with a large value (\u003e1420 bytes)\nthe attacker can then achieve a heap buffer overflow.\n\nThis fix replaces min_t(int, ...) with min_t(u32)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable ksmbd SMB Direct negotiation is reached by a remote peer over the network via the RDMA listener on SMB Direct ports such as 445/5445.\nAC:L - An attacker can trigger the bug with a crafted negotiation request followed by an oversized data-transfer message; no race or victim-controlled timing is required.\nPR:N - The vulnerable path runs during SMB Direct transport negotiation before SMB authentication or session setup, so no credentials or prior privileges are required.\nUI:N - No victim user action is needed beyond the server exposing ksmbd SMB Direct; the attacker sends network protocol messages directly.\nS:U - The impact is kernel memory corruption within the same host security authority, not a cross-scope escape such as guest-to-host or IOMMU boundary bypass.\nC:H - The signedness bug lets the attacker turn a small allocated receive buffer into a huge posted RDMA receive target, causing attacker-controlled kernel heap memory corruption that can plausibly be leveraged for information disclosure.\nI:H - The second SMB Direct message causes an out-of-bounds write/DMA overwrite into kernel heap memory, which is high-integrity impact and plausibly exploitable for control-flow or data corruption.\nA:H - The heap buffer overflow is remotely triggerable pre-authentication and can crash or panic the kernel even without full code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:08.090Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c"
},
{
"url": "https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7"
},
{
"url": "https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace"
},
{
"url": "https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b"
},
{
"url": "https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550"
},
{
"url": "https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757"
}
],
"title": "ksmbd: fix signededness bug in smb_direct_prepare_negotiation()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43185",
"datePublished": "2026-05-06T11:27:56.386Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-10-30T12:25:08.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68729 (GCVE-0-2025-68729)
Vulnerability from cvelistv5
Published
2025-12-24 10:33
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix MSDU buffer types handling in RX error path
Currently, packets received on the REO exception ring from
unassociated peers are of MSDU buffer type, while the driver expects
link descriptor type packets. These packets are not parsed further due
to a return check on packet type in ath12k_hal_desc_reo_parse_err(),
but the associated skb is not freed. This may lead to kernel
crashes and buffer leaks.
Hence to fix, update the RX error handler to explicitly drop
MSDU buffer type packets received on the REO exception ring.
This prevents further processing of invalid packets and ensures
stability in the RX error handling path.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_rx.c",
"drivers/net/wireless/ath/ath12k/hal_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "abfbceda0d2391524ad1df88867b3f3af36d17c7",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "17a9b93283c6f0b799a338bbc50fa115012429d9",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "5ff5a9d71cdc49c3400f30583a784ad0a17d01ec",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "ab0554f51e5f2b9506e8a09e8accd02f00056729",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "36f9edbb9d0fc36c865c74f3c1ad8e1261ad3981",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_rx.c",
"drivers/net/wireless/ath/ath12k/hal_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix MSDU buffer types handling in RX error path\n\nCurrently, packets received on the REO exception ring from\nunassociated peers are of MSDU buffer type, while the driver expects\nlink descriptor type packets. These packets are not parsed further due\nto a return check on packet type in ath12k_hal_desc_reo_parse_err(),\nbut the associated skb is not freed. This may lead to kernel\ncrashes and buffer leaks.\n\nHence to fix, update the RX error handler to explicitly drop\nMSDU buffer type packets received on the REO exception ring.\nThis prevents further processing of invalid packets and ensures\nstability in the RX error handling path.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:23.713Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/abfbceda0d2391524ad1df88867b3f3af36d17c7"
},
{
"url": "https://git.kernel.org/stable/c/17a9b93283c6f0b799a338bbc50fa115012429d9"
},
{
"url": "https://git.kernel.org/stable/c/5ff5a9d71cdc49c3400f30583a784ad0a17d01ec"
},
{
"url": "https://git.kernel.org/stable/c/ab0554f51e5f2b9506e8a09e8accd02f00056729"
},
{
"url": "https://git.kernel.org/stable/c/36f9edbb9d0fc36c865c74f3c1ad8e1261ad3981"
}
],
"title": "wifi: ath12k: Fix MSDU buffer types handling in RX error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68729",
"datePublished": "2025-12-24T10:33:12.515Z",
"dateReserved": "2025-12-24T10:30:51.028Z",
"dateUpdated": "2026-10-21T12:38:23.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99002 (GCVE-0-2026-99002)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate pitch coming from userspace
Validate the pitch, alongside the box dimensions before trying
to copy data from the underlying surface. Fixes possible
out of bounds reads with cursor snooping.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 Version: 2ac863719e518ae1a8f328849e64ea26a222f079 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "073437615a8da528935146ca6a17292c0ca8ce19",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "f54b41644744f72c86e44a21733ac6fc910ca133",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "cbf7616464334b217ed07b8adacaed549f2a9433",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "f6d9c8abdf06a9c7efa799532d66ed8d5a50734c",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "76e5ddd7d9822c8c3492e0f50ba8978e093069ad",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "fcb137f6e7ed769f7ecad84364a33c451371b602",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
},
{
"lessThan": "21bc51cb89ced74d6645a138cc2f21184bc75094",
"status": "affected",
"version": "2ac863719e518ae1a8f328849e64ea26a222f079",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - DRM_IOCTL_VMW_EXECBUF passes a locally supplied SVGA_3D_CMD_SURFACE_DMA through vmw_execbuf_process(), vmw_cmd_dma(), and vmw_kms_cursor_snoop(); the malformed guest.pitch and copy box originate in this ioctl, not a network protocol.\nAC:L - The attacker can create the required 64x64 A8R8G8B8 scanout surface and choose the box, pitch, and source BO. A 63x64 box with pitch 256 deterministically reaches the corrupting partial-copy loop without a race or attacker-uncontrolled condition.\nPR:L - VMW_CREATE_SURFACE, VMW_ALLOC_DMABUF, and VMW_EXECBUF are DRM_RENDER_ALLOW on a DRIVER_RENDER device; drm_ioctl_permit() therefore requires no DRM master, authentication, or capability from an unprivileged render-node client.\nUI:N - The attacker creates the surface and BO and submits the malformed DMA command through their own file descriptor; no victim must mount, open, or display anything.\nS:U - vmw_kms_cursor_snoop() corrupts the guest kernel\u0027s own cursor-snooper allocation from guest userspace. The code demonstrates neither host-memory corruption nor a guest-to-host or IOMMU-boundary escape.\nC:H - The unchecked pitch causes out-of-bounds source reads, while the attacker-controlled heap overwrite can corrupt neighboring pointer-bearing objects and be developed into arbitrary guest-kernel read primitives.\nI:H - snooper.image is a u32 pointer, but the vulnerable loop uses the 256-byte image_pitch as an element stride; a 63x64 copy writes controlled 252-byte rows at 1024-byte intervals far beyond the 16-KiB allocation, enabling control-flow hijacking.\nA:H - An excessive pitch can fault while reading beyond the TTM mapping, and the partial-copy destination bug can overwrite roughly 48 KiB beyond the snooper image, causing an oops or kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:48.116Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/073437615a8da528935146ca6a17292c0ca8ce19"
},
{
"url": "https://git.kernel.org/stable/c/f54b41644744f72c86e44a21733ac6fc910ca133"
},
{
"url": "https://git.kernel.org/stable/c/cbf7616464334b217ed07b8adacaed549f2a9433"
},
{
"url": "https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d"
},
{
"url": "https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c"
},
{
"url": "https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad"
},
{
"url": "https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602"
},
{
"url": "https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094"
}
],
"title": "drm/vmwgfx: validate pitch coming from userspace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99002",
"datePublished": "2026-10-23T12:20:22.763Z",
"dateReserved": "2026-09-25T10:25:14.385Z",
"dateUpdated": "2026-10-30T12:40:48.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90104 (GCVE-0-2026-90104)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: zero referring call lists before decoding
decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so
each referring_call_list starts uninitialized. decode_rc_list() assigns
rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero
referring calls therefore leaves the pointer uninitialized, and
nfs4_callback_sequence() later passes stale slab contents to kfree().
Allocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is
NULL from the beginning, including valid empty referring call lists.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4aece6a19cf7f474f15eb861ba74db4479884ce3 Version: 4aece6a19cf7f474f15eb861ba74db4479884ce3 Version: 4aece6a19cf7f474f15eb861ba74db4479884ce3 Version: 4aece6a19cf7f474f15eb861ba74db4479884ce3 Version: 4aece6a19cf7f474f15eb861ba74db4479884ce3 Version: 4aece6a19cf7f474f15eb861ba74db4479884ce3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/callback_xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "810f6b3a29ac96fdc16909132b31627dae6824c2",
"status": "affected",
"version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
"versionType": "git"
},
{
"lessThan": "ed54460caf5b5aa65ec03c9a6032d831f39f19f5",
"status": "affected",
"version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
"versionType": "git"
},
{
"lessThan": "7510a5b9edec9d9536a4e69f10edfb2592e6cf7f",
"status": "affected",
"version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
"versionType": "git"
},
{
"lessThan": "f4d23937e1c41995c2f54af26c89b5e48a41c299",
"status": "affected",
"version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
"versionType": "git"
},
{
"lessThan": "f31f3c042e024aef437cda42f0424ae8d4594b6c",
"status": "affected",
"version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
"versionType": "git"
},
{
"lessThan": "8fa4804fe62ca4155a2d8fc2789d630376cbf2fc",
"status": "affected",
"version": "4aece6a19cf7f474f15eb861ba74db4479884ce3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/callback_xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.1: zero referring call lists before decoding\n\ndecode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so\neach referring_call_list starts uninitialized. decode_rc_list() assigns\nrcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero\nreferring calls therefore leaves the pointer uninitialized, and\nnfs4_callback_sequence() later passes stale slab contents to kfree().\n\nAllocate csa_rclists with kzalloc_objs() so every rcl_refcalls member is\nNULL from the beginning, including valid empty referring call lists."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - xs_read_stream_call()/rpcrdma_bc_receive_call() deliver a backchannel RPC_CALL on the established NFSv4.1 TCP or RPC/RDMA session into nfs4_callback_compound \u2192 process_op \u2192 decode_cb_sequence_args(); the attacker-controlled bytes are the CB_SEQUENCE csa_nrclists and rcl_nrefcalls XDR fields sent by the NFS server.\nAC:L - A single well-formed CB_SEQUENCE with csa_nrclists\u22651 and decode_rc_list() seeing rcl_nrefcalls==0 skips the rcl_refcalls assignment and still returns 0; nfs4_callback_sequence() then kfree()s that stale pointer. Empty referring_call_list4 is valid RFC 5661 XDR, so no race or victim-only state is required.\nPR:N - nfs_callback_authenticate() accepts RPC_AUTH_UNIX on the NFSv4.1 backchannel, and decode_cb_sequence_args() runs in process_op() before nfs4_find_client_sessionid(); the connected NFS server needs no account or capability on the client to send CB_SEQUENCE.\nUI:N - After nfs4_init_callback() has attached the backchannel (boot-time, autofs, or Kubernetes NFSv4.1 mounts), the server unilaterally sends CB_SEQUENCE; nfs4_callback_sequence() kfree()s rcl_refcalls with no further victim open, mount, or click.\nS:U - kfree of the stale rcl_refcalls pointer corrupts the NFS client\u0027s kmalloc heap in the same host kernel; it does not cross a VM, IOMMU, or guest/host boundary.\nC:H - nfs4_callback_sequence() kfree()s uninitialized rcl_refcalls left by kmalloc_objs() of csa_rclists when rcl_nrefcalls was 0. A prior CB_SEQUENCE that allocated then freed rcl_refcalls can leave that pointer in the reused slab object, a heap double-free/UAF read primitive.\nI:H - The same kfree of stale rcl_refcalls is a slab double-free of the referring_call array (size chosen by the attacker\u0027s earlier nrefcalls). Reclaim or spraying a replacement object over that free yields an arbitrary kernel write / control-flow hijack primitive.\nA:H - kfree of a non-NULL garbage rcl_refcalls pointer from a successful decode_cb_sequence_args() of an empty referring_call_list causes SLUB to BUG, oops, or panic even when the double-free is not fully exploited."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:08.837Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/810f6b3a29ac96fdc16909132b31627dae6824c2"
},
{
"url": "https://git.kernel.org/stable/c/ed54460caf5b5aa65ec03c9a6032d831f39f19f5"
},
{
"url": "https://git.kernel.org/stable/c/7510a5b9edec9d9536a4e69f10edfb2592e6cf7f"
},
{
"url": "https://git.kernel.org/stable/c/f4d23937e1c41995c2f54af26c89b5e48a41c299"
},
{
"url": "https://git.kernel.org/stable/c/f31f3c042e024aef437cda42f0424ae8d4594b6c"
},
{
"url": "https://git.kernel.org/stable/c/8fa4804fe62ca4155a2d8fc2789d630376cbf2fc"
}
],
"title": "NFSv4.1: zero referring call lists before decoding",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90104",
"datePublished": "2026-09-17T16:06:14.191Z",
"dateReserved": "2026-09-11T19:38:34.786Z",
"dateUpdated": "2026-10-30T12:34:08.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98038 (GCVE-0-2026-98038)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
bpf_refcount_acquire() is fallible for a borrowed reference because the
object may have reached a zero refcount. The verifier therefore keeps
KF_RET_NULL on the return value unless the argument is an owning reference.
An RCU-protected load of a local kptr is marked MEM_ALLOC, but it only
receives NON_OWN_REF when the pointee contains a graph node. A refcounted
object without a graph node consequently looks like an owning reference
even though the loaded register has no acquired reference state. If the
program drops the last real reference while remaining in the RCU critical
section, refcount_inc_not_zero() returns NULL while the verifier treats the
result as non-NULL.
Only classify the argument as owning when it is backed by a verifier-tracked
reference. This retains the non-NULL return for pointers from bpf_obj_new(),
bpf_kptr_xchg(), or an earlier successful acquisition, while requiring a
NULL check for borrowed RCU kptrs.
[ kkd: Rewrote commit log ]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "85bfc8b6db43502444c428eaa2de20bdd2fb9064",
"status": "affected",
"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8",
"versionType": "git"
},
{
"lessThan": "8d19e2cdfba9ba8c8eb6a459cd666bec00a1d2c6",
"status": "affected",
"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8",
"versionType": "git"
},
{
"lessThan": "85074498228a2500ea8b8039c49cc1ab8ad5328f",
"status": "affected",
"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8",
"versionType": "git"
},
{
"lessThan": "dc36739e5cc9f60485418a910b42bc95339218d2",
"status": "affected",
"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Keep refcount_acquire nullable for borrowed RCU kptrs\n\nbpf_refcount_acquire() is fallible for a borrowed reference because the\nobject may have reached a zero refcount. The verifier therefore keeps\nKF_RET_NULL on the return value unless the argument is an owning reference.\n\nAn RCU-protected load of a local kptr is marked MEM_ALLOC, but it only\nreceives NON_OWN_REF when the pointee contains a graph node. A refcounted\nobject without a graph node consequently looks like an owning reference\neven though the loaded register has no acquired reference state. If the\nprogram drops the last real reference while remaining in the RCU critical\nsection, refcount_inc_not_zero() returns NULL while the verifier treats the\nresult as non-NULL.\n\nOnly classify the argument as owning when it is backed by a verifier-tracked\nreference. This retains the non-NULL return for pointers from bpf_obj_new(),\nbpf_kptr_xchg(), or an earlier successful acquisition, while requiring a\nNULL check for borrowed RCU kptrs.\n\n[ kkd: Rewrote commit log ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:09.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/85bfc8b6db43502444c428eaa2de20bdd2fb9064"
},
{
"url": "https://git.kernel.org/stable/c/8d19e2cdfba9ba8c8eb6a459cd666bec00a1d2c6"
},
{
"url": "https://git.kernel.org/stable/c/85074498228a2500ea8b8039c49cc1ab8ad5328f"
},
{
"url": "https://git.kernel.org/stable/c/dc36739e5cc9f60485418a910b42bc95339218d2"
}
],
"title": "bpf: Keep refcount_acquire nullable for borrowed RCU kptrs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98038",
"datePublished": "2026-09-25T10:23:51.746Z",
"dateReserved": "2026-09-25T10:19:56.071Z",
"dateUpdated": "2026-10-21T12:54:09.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93282 (GCVE-0-2026-93282)
Vulnerability from cvelistv5
Published
2026-09-24 15:52
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix maximum allowed access checks
The DACL permission check looks for an ACE matching the current user and
falls back to the Everyone ACE. It does not consider an Authenticated
Users ACE, even though an authenticated session is a member of that
well-known group.
As a result, opening a file whose access is granted through S-1-5-11 can
incorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users
ACE as a fallback entry alongside Everyone.
The maximal access calculation also combines access masks from every ACE,
regardless of whether its SID applies to the current user. This can grant
rights belonging to an unrelated principal. Process only ACEs applying to
the user, Everyone, or Authenticated Users, and accumulate allowed and
denied masks in ACL order. Preserve explicitly requested access bits so
they are validated against the resulting maximal mask.
When ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD
instead of the generic STATUS_ACCESS_DENIED. Access to the system ACL
requires a security privilege that ksmbd does not grant.
For regular files, include FILE_EXECUTE in maximal access when the client
requested GENERIC_EXECUTE and the DACL grants the complete file-read set.
Keep a direct FILE_EXECUTE request subject to the explicit DACL bit. This
matches the POSIX file ACL mapping without broadening specific execute
requests.
Do not replace rights from an applicable NT ACE with a POSIX ACL entry.
The POSIX ACL is only a fallback when no user, Everyone, or Authenticated
Users ACE applies; otherwise it can incorrectly broaden the stored DACL.
This fixes smb2.maximum_allowed.maximum_allowed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/smbacl.c",
"fs/smb/server/smbacl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "faf0b894eedc7b2ebb36c48d04d412240dd0ea71",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "7c293e83d86cfd38124f51b27882ad631818bf48",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "37459edb69c094553026ee48c2cc2acc657f9f43",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "28289d880e6d11ae7ac77b81af3312453febf939",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "35d5c59fe6b1d9fe43fb14eb384f69ee1a120f9c",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "cc2f133e80eb2c4a04bfa77a2f207749fe2f516a",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/smbacl.c",
"fs/smb/server/smbacl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix maximum allowed access checks\n\nThe DACL permission check looks for an ACE matching the current user and\nfalls back to the Everyone ACE. It does not consider an Authenticated\nUsers ACE, even though an authenticated session is a member of that\nwell-known group.\n\nAs a result, opening a file whose access is granted through S-1-5-11 can\nincorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users\nACE as a fallback entry alongside Everyone.\n\nThe maximal access calculation also combines access masks from every ACE,\nregardless of whether its SID applies to the current user. This can grant\nrights belonging to an unrelated principal. Process only ACEs applying to\nthe user, Everyone, or Authenticated Users, and accumulate allowed and\ndenied masks in ACL order. Preserve explicitly requested access bits so\nthey are validated against the resulting maximal mask.\n\nWhen ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD\ninstead of the generic STATUS_ACCESS_DENIED. Access to the system ACL\nrequires a security privilege that ksmbd does not grant.\n\nFor regular files, include FILE_EXECUTE in maximal access when the client\nrequested GENERIC_EXECUTE and the DACL grants the complete file-read set.\nKeep a direct FILE_EXECUTE request subject to the explicit DACL bit. This\nmatches the POSIX file ACL mapping without broadening specific execute\nrequests.\n\nDo not replace rights from an applicable NT ACE with a POSIX ACL entry.\nThe POSIX ACL is only a fallback when no user, Everyone, or Authenticated\nUsers ACE applies; otherwise it can incorrectly broaden the stored DACL.\n\nThis fixes smb2.maximum_allowed.maximum_allowed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - SMB2_CREATE carries req-\u003eDesiredAccess into smb2_open(), which calls smb_check_perm_dacl() on the NT DACL from ksmbd_vfs_get_sd_xattr(); ksmbd_conn_handler_loop() delivers that CREATE on TCP/445 through __handle_ksmbd_work() after smb2_check_user_session()/smb2_get_ksmbd_tcon().\nAC:L - With FILE_MAXIMAL_ACCESS_LE set, smb_check_perm_dacl() does granted |= ace-\u003eaccess_req for every ACE regardless of SID, and when the user SID is not found it applies a POSIX ACL_USER/ACL_GROUP entry even if an Everyone ACE exists; one attacker-sent SMB2_CREATE triggers that with no race.\nPR:L - SMB2_CREATE is not in the smb2_check_user_session() pre-auth skip list (only NEGOTIATE/SESSION_SETUP/ECHO); __handle_ksmbd_work() requires SMB2_SESSION_VALID and smb2_get_ksmbd_tcon() before smb2_open(), so this is an authenticated share user, not a pre-auth or host-root path.\nUI:N - The attacker sends the SMB2_CREATE that smb2_open() uses to call smb_check_perm_dacl() on a file they name; no victim mount, click, or other interactive step is required.\nS:U - smb_check_perm_dacl() only miscomputes the access mask stored as fp-\u003edaccess for that ksmbd open; the extra rights stay inside the host kernel SMB server and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - When FILE_MAXIMAL_ACCESS_LE is set, granted ORs access_req from unrelated SIDs, and a POSIX ACL_USER match can replace a tighter Everyone ACE; *pdaccess becomes fp-\u003edaccess, so smb2_read() seeing FILE_READ_DATA_LE returns file contents the stored DACL would have denied with -EACCES.\nI:H - The same inflated mask can include FILE_WRITE_DATA, WRITE_DAC, or DELETE from another principal\u0027s ACE or from mode_to_access_flags() on a POSIX rwx/r-- entry; smb2_write(), smb2_set_info_sec(), and set_file_disposition_info() then allow writes, DACL replacement, or deletes the stored DACL would have rejected.\nA:N - smb_check_perm_dacl() only returns 0 with a wider granted mask or -EACCES mapped to STATUS_ACCESS_DENIED/STATUS_PRIVILEGE_NOT_HELD; the ACE walks stay inside the NTSD and do not oops, panic, hang, or crash ksmbd."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:38.607Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/faf0b894eedc7b2ebb36c48d04d412240dd0ea71"
},
{
"url": "https://git.kernel.org/stable/c/7c293e83d86cfd38124f51b27882ad631818bf48"
},
{
"url": "https://git.kernel.org/stable/c/37459edb69c094553026ee48c2cc2acc657f9f43"
},
{
"url": "https://git.kernel.org/stable/c/28289d880e6d11ae7ac77b81af3312453febf939"
},
{
"url": "https://git.kernel.org/stable/c/35d5c59fe6b1d9fe43fb14eb384f69ee1a120f9c"
},
{
"url": "https://git.kernel.org/stable/c/cc2f133e80eb2c4a04bfa77a2f207749fe2f516a"
}
],
"title": "ksmbd: fix maximum allowed access checks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93282",
"datePublished": "2026-09-24T15:52:24.603Z",
"dateReserved": "2026-09-17T16:02:15.098Z",
"dateUpdated": "2026-10-30T12:36:38.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74695 (GCVE-0-2026-74695)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
offload path) might already carry a ref-counted dst_entry assigned during
earlier RX or routing steps.
Calling skb_dst_set_noref() when skb already holds a ref-counted dst
overwrites skb->_skb_refdst, leaking the previous dst_entry reference
count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
skb_dst_check_unset():
WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
Drop any existing dst_entry reference with skb_dst_drop(skb) before
setting the non-referenced flowtable destination.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27 Version: 209dedf806d31095968f54323dbe62525b077b33 Version: 4.16.15 ≤ Version: 4.17.1 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74695",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:42.839344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:09.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "763f59b72ddaf18d0750d53083a74355f6c003c8",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "4db3b48a966ed479b99cc8319ea9e46d4f7c703b",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "274f544a32c08638ee887f2e27e3235b6b1237d4",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"status": "affected",
"version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
"versionType": "git"
},
{
"status": "affected",
"version": "209dedf806d31095968f54323dbe62525b077b33",
"versionType": "git"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.15",
"versionType": "semver"
},
{
"lessThan": "4.18",
"status": "affected",
"version": "4.17.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb-\u003e_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:19.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/763f59b72ddaf18d0750d53083a74355f6c003c8"
},
{
"url": "https://git.kernel.org/stable/c/4db3b48a966ed479b99cc8319ea9e46d4f7c703b"
},
{
"url": "https://git.kernel.org/stable/c/274f544a32c08638ee887f2e27e3235b6b1237d4"
},
{
"url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
},
{
"url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
},
{
"url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
}
],
"title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74695",
"datePublished": "2026-08-22T15:32:57.756Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-10-30T12:30:19.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98034 (GCVE-0-2026-98034)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark NULL kptr stores precise
check_map_kptr_access() permits a scalar store into an untrusted kptr
field only when the register is known to contain zero. Unlike other
verifier checks whose outcome depends on a scalar value, it does not mark
that register precise.
A state checkpoint reached with an imprecise zero can therefore prune a
second path that reaches the store with an arbitrary nonzero scalar. The
program can write attacker-controlled bits into the kptr field and load
them back as a PTR_TO_BTF_ID.
Call mark_chain_precision() before accepting a known-zero register. This
forces state equivalence to compare its scalar range and makes the verifier
visit and reject a path carrying a nonzero value.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45 Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45 Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45 Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45 Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45 Version: b5a8069835e5236824a84281592d29f859b33153 Version: 5.18.18 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4",
"status": "affected",
"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
"versionType": "git"
},
{
"lessThan": "b8b98d3d37908402ff63515fa4d7574235436ea8",
"status": "affected",
"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
"versionType": "git"
},
{
"lessThan": "bb667eb575c906f24c707986541a99424c5b07ea",
"status": "affected",
"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
"versionType": "git"
},
{
"lessThan": "86168208737bdd267d92d855d453d1d2f840df19",
"status": "affected",
"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
"versionType": "git"
},
{
"lessThan": "ecdc5043794c9184aa8e6c814603899479c46b35",
"status": "affected",
"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
"versionType": "git"
},
{
"status": "affected",
"version": "b5a8069835e5236824a84281592d29f859b33153",
"versionType": "git"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark NULL kptr stores precise\n\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\n\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\n\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:08.478Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4"
},
{
"url": "https://git.kernel.org/stable/c/b8b98d3d37908402ff63515fa4d7574235436ea8"
},
{
"url": "https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea"
},
{
"url": "https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19"
},
{
"url": "https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"
}
],
"title": "bpf: Mark NULL kptr stores precise",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98034",
"datePublished": "2026-09-25T10:23:49.352Z",
"dateReserved": "2026-09-25T10:19:56.070Z",
"dateUpdated": "2026-10-21T12:54:08.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74697 (GCVE-0-2026-74697)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
EOP (End of frame padding) on the AGG ring may cause overlapping of
zero padding at the end of one segment with the next segment's data.
If Relaxed Ordering (RO) is enabled, the zero padding may overwrite
valid data in the next segment and corrupt the data. Older chips
(P5 and older) do not automatically disable RO when EOP is enabled.
On some ARM systems, data corruption was reported on 57508 (P5)
chips with RO enabled.
Always disable EOP on all chips on the AGG rings when TPA is enabled
to fix the data corruption.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e Version: bfcd8d791ec18496772d117774398e336917f56e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74697",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:48.095926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:09.972Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68c181af7cd1ca9cbf29acd95911073bfd3c6397",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "7aee22a35978b44784612c156e358e375ddf5d16",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "410da4428b1f47bf9a84bdc0bcaa089d73ba2048",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "b61c4911204a0a2f900e538d64ceb608f6c9614d",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "927e2617a36f49752cb5613900ca21f40593f07d",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "aab3b5f4d8ec8598606ee011e219ef824ae25ca0",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "c1962ab4645a914a91ff492735881150ddc8a79e",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
},
{
"lessThan": "c3faf548a00f4c17100cc9204746975fa46a73b9",
"status": "affected",
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Disable EOP for TPA on all chips to prevent data corruption\n\nEOP (End of frame padding) on the AGG ring may cause overlapping of\nzero padding at the end of one segment with the next segment\u0027s data.\nIf Relaxed Ordering (RO) is enabled, the zero padding may overwrite\nvalid data in the next segment and corrupt the data. Older chips\n(P5 and older) do not automatically disable RO when EOP is enabled.\nOn some ARM systems, data corruption was reported on 57508 (P5)\nchips with RO enabled.\n\nAlways disable EOP on all chips on the AGG rings when TPA is enabled\nto fix the data corruption."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in bnxt_en hardware RX/TPA aggregation on incoming packets; remote TCP traffic reaches bnxt_msix\u2192napi\u2192bnxt_rx_pkt\u2192bnxt_tpa_end without local syscalls, matching network-reachable net driver guidance for internet-facing cloud servers with Broadcom NICs.\nAC:L - An attacker controls TCP segment sizes, timing, and retry volume to drive TPA aggregation on default NETIF_F_GRO_HW interfaces; the fix documents reproducible corruption on 57508/P5 ARM hosts with PCIe Relaxed Ordering, the scored deployment scenario.\nPR:N - The vulnerable receive fast path performs no authentication or capability checks on incoming frames; any remote peer sending TCP traffic to a host with an affected P5-or-older bnxt_en NIC can trigger hardware TPA aggregation and AGG-ring DMA corruption.\nUI:N - Hardware GRO/TPA is enabled by default on bnxt_en netdevs; exploitation requires only normal network exposure and attacker-sent traffic, with no victim mount, file open, or administrative action.\nS:U - Impact is corrupted RX skb payload data processed within the host kernel and network stack; it does not cross VM, container-host, or IOMMU security boundaries into a separate authority.\nC:N - EOP zero-padding overwrites valid segment bytes with zeros in page-pool RX buffers; there is no out-of-bounds read, UAF, or kernel-memory disclosure\u2014only destruction of receive-buffer contents.\nI:H - Hardware DMA corruption of TPA aggregation buffers modifies delivered skb payload bytes before napi_gro_receive, enabling remote integrity corruption of TCP/application data processed by the kernel and upper-layer services on affected hosts.\nA:L - No kernel oops or panic is documented, but repeated remote triggering can persistently corrupt received payloads, provoking TCP/application errors and degrading availability of correct network processing on affected Broadcom P5 NICs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:11.741Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68c181af7cd1ca9cbf29acd95911073bfd3c6397"
},
{
"url": "https://git.kernel.org/stable/c/7aee22a35978b44784612c156e358e375ddf5d16"
},
{
"url": "https://git.kernel.org/stable/c/410da4428b1f47bf9a84bdc0bcaa089d73ba2048"
},
{
"url": "https://git.kernel.org/stable/c/b61c4911204a0a2f900e538d64ceb608f6c9614d"
},
{
"url": "https://git.kernel.org/stable/c/927e2617a36f49752cb5613900ca21f40593f07d"
},
{
"url": "https://git.kernel.org/stable/c/aab3b5f4d8ec8598606ee011e219ef824ae25ca0"
},
{
"url": "https://git.kernel.org/stable/c/c1962ab4645a914a91ff492735881150ddc8a79e"
},
{
"url": "https://git.kernel.org/stable/c/c3faf548a00f4c17100cc9204746975fa46a73b9"
}
],
"title": "bnxt_en: Disable EOP for TPA on all chips to prevent data corruption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74697",
"datePublished": "2026-08-22T15:32:59.073Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-10-21T12:46:11.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40130 (GCVE-0-2025-40130)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
The cpu_latency_qos_add/remove/update_request interfaces lack internal
synchronization by design, requiring the caller to ensure thread safety.
The current implementation relies on the 'pm_qos_enabled' flag, which is
insufficient to prevent concurrent access and cannot serve as a proper
synchronization mechanism. This has led to data races and list
corruption issues.
A typical race condition call trace is:
[Thread A]
ufshcd_pm_qos_exit()
--> cpu_latency_qos_remove_request()
--> cpu_latency_qos_apply();
--> pm_qos_update_target()
--> plist_del <--(1) delete plist node
--> memset(req, 0, sizeof(*req));
--> hba->pm_qos_enabled = false;
[Thread B]
ufshcd_devfreq_target
--> ufshcd_devfreq_scale
--> ufshcd_scale_clks
--> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true
--> cpu_latency_qos_update_request
--> pm_qos_update_target
--> plist_del <--(3) plist node use-after-free
Introduces a dedicated mutex to serialize PM QoS operations, preventing
data races and ensuring safe access to PM QoS resources, including sysfs
interface reads.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufs-sysfs.c",
"drivers/ufs/core/ufshcd.c",
"include/ufs/ufshcd.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eee1b13526b8f1e6a2402973d95f9fa854771f57",
"status": "affected",
"version": "2777e73fc154e2e87233bdcc0e2402b33815198e",
"versionType": "git"
},
{
"lessThan": "d9df61afb8d23c475f1be3c714da2c34c156ab01",
"status": "affected",
"version": "2777e73fc154e2e87233bdcc0e2402b33815198e",
"versionType": "git"
},
{
"lessThan": "79dde5f7dc7c038eec903745dc1550cd4139980e",
"status": "affected",
"version": "2777e73fc154e2e87233bdcc0e2402b33815198e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufs-sysfs.c",
"drivers/ufs/core/ufshcd.c",
"include/ufs/ufshcd.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix data race in CPU latency PM QoS request handling\n\nThe cpu_latency_qos_add/remove/update_request interfaces lack internal\nsynchronization by design, requiring the caller to ensure thread safety.\nThe current implementation relies on the \u0027pm_qos_enabled\u0027 flag, which is\ninsufficient to prevent concurrent access and cannot serve as a proper\nsynchronization mechanism. This has led to data races and list\ncorruption issues.\n\nA typical race condition call trace is:\n\n[Thread A]\nufshcd_pm_qos_exit()\n --\u003e cpu_latency_qos_remove_request()\n --\u003e cpu_latency_qos_apply();\n --\u003e pm_qos_update_target()\n --\u003e plist_del \u003c--(1) delete plist node\n --\u003e memset(req, 0, sizeof(*req));\n --\u003e hba-\u003epm_qos_enabled = false;\n\n[Thread B]\nufshcd_devfreq_target\n --\u003e ufshcd_devfreq_scale\n --\u003e ufshcd_scale_clks\n --\u003e ufshcd_pm_qos_update \u003c--(2) pm_qos_enabled is true\n --\u003e cpu_latency_qos_update_request\n --\u003e pm_qos_update_target\n --\u003e plist_del \u003c--(3) plist node use-after-free\n\nIntroduces a dedicated mutex to serialize PM QoS operations, preventing\ndata races and ensuring safe access to PM QoS resources, including sysfs\ninterface reads."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:48.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eee1b13526b8f1e6a2402973d95f9fa854771f57"
},
{
"url": "https://git.kernel.org/stable/c/d9df61afb8d23c475f1be3c714da2c34c156ab01"
},
{
"url": "https://git.kernel.org/stable/c/79dde5f7dc7c038eec903745dc1550cd4139980e"
}
],
"title": "scsi: ufs: core: Fix data race in CPU latency PM QoS request handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40130",
"datePublished": "2025-11-12T10:23:21.605Z",
"dateReserved": "2025-04-16T07:20:57.170Z",
"dateUpdated": "2026-10-21T12:37:48.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43337 (GCVE-0-2026-43337)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
dcn401_init_hw() assumes that update_bw_bounding_box() is valid when
entering the update path. However, the existing condition:
((!fams2_enable && update_bw_bounding_box) || freq_changed)
does not guarantee this, as the freq_changed branch can evaluate to true
independently of the callback pointer.
This can result in calling update_bw_bounding_box() when it is NULL.
Fix this by separating the update condition from the pointer checks and
ensuring the callback, dc->clk_mgr, and bw_params are validated before
use.
Fixes the below:
../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362)
(cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477)
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4 Version: ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4 Version: ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4 Version: ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4 Version: e13689793b9c0e7b5749954e77f5f85e68fe7138 Version: 6.11.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcc51c81cb472eb460310c477460356dc4845ff7",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"lessThan": "10c13c111d0d7f8e101c742feff264fc98e3f9f7",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"lessThan": "2d4a6f0702c5211e0be8b688c5fc24f082ec74d6",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"lessThan": "e927b36ae18b66b49219eaa9f46edc7b4fdbb25e",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"status": "affected",
"version": "e13689793b9c0e7b5749954e77f5f85e68fe7138",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()\n\ndcn401_init_hw() assumes that update_bw_bounding_box() is valid when\nentering the update path. However, the existing condition:\n\n ((!fams2_enable \u0026\u0026 update_bw_bounding_box) || freq_changed)\n\ndoes not guarantee this, as the freq_changed branch can evaluate to true\nindependently of the callback pointer.\n\nThis can result in calling update_bw_bounding_box() when it is NULL.\n\nFix this by separating the update condition from the pointer checks and\nensuring the callback, dc-\u003eclk_mgr, and bw_params are validated before\nuse.\n\nFixes the below:\n../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed \u0027dc-\u003eres_pool-\u003efuncs-\u003eupdate_bw_bounding_box\u0027 could be null (see line 362)\n\n(cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:39.405Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcc51c81cb472eb460310c477460356dc4845ff7"
},
{
"url": "https://git.kernel.org/stable/c/10c13c111d0d7f8e101c742feff264fc98e3f9f7"
},
{
"url": "https://git.kernel.org/stable/c/2d4a6f0702c5211e0be8b688c5fc24f082ec74d6"
},
{
"url": "https://git.kernel.org/stable/c/e927b36ae18b66b49219eaa9f46edc7b4fdbb25e"
}
],
"title": "drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43337",
"datePublished": "2026-05-08T13:31:22.967Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-10-21T12:40:39.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46325 (GCVE-0-2026-46325)
Vulnerability from cvelistv5
Published
2026-06-09 12:25
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
The current implementation incorrectly handles memory regions (MRs) with
page sizes different from the system PAGE_SIZE. The core issue is that
rxe_set_page() is called with mr->page_size step increments, but the
page_list stores individual struct page pointers, each representing
PAGE_SIZE of memory.
ib_sg_to_page() has ensured that when i>=1 either
a) SG[i-1].dma_end and SG[i].dma_addr are contiguous
or
b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned.
This leads to incorrect iova-to-va conversion in scenarios:
1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K):
ibmr->iova = 0x181800
sg[0]: dma_addr=0x181800, len=0x800
sg[1]: dma_addr=0x173000, len=0x1000
Access iova = 0x181800 + 0x810 = 0x182010
Expected VA: 0x173010 (second SG, offset 0x10)
Before fix:
- index = (0x182010 >> 12) - (0x181800 >> 12) = 1
- page_offset = 0x182010 & 0xFFF = 0x10
- xarray[1] stores system page base 0x170000
- Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)
2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K):
ibmr->iova = 0x18f800
sg[0]: dma_addr=0x18f800, len=0x800
sg[1]: dma_addr=0x170000, len=0x1000
Access iova = 0x18f800 + 0x810 = 0x190010
Expected VA: 0x170010 (second SG, offset 0x10)
Before fix:
- index = (0x190010 >> 16) - (0x18f800 >> 16) = 1
- page_offset = 0x190010 & 0xFFFF = 0x10
- xarray[1] stores system page for dma_addr 0x170000
- Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)
Yi Zhang reported a kernel panic[1] years ago related to this defect.
Solution:
1. Replace xarray with pre-allocated rxe_mr_page array for sequential
indexing (all MR page indices are contiguous)
2. Each rxe_mr_page stores both struct page* and offset within the
system page
3. Handle MR page_size != PAGE_SIZE relationships:
- page_size > PAGE_SIZE: Split MR pages into multiple system pages
- page_size <= PAGE_SIZE: Store offset within system page
4. Add boundary checks and compatibility validation
This ensures correct iova-to-va conversion regardless of MR page size
and system PAGE_SIZE relationship, while improving performance through
array-based sequential access.
Tests on 4K and 64K PAGE_SIZE hosts:
- rdma-core/pytests
$ ./build/bin/run_tests.py --dev eth0_rxe
- blktest:
$ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd
[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 592627ccbdff0ec6fff00fc761142a76db750dd4 Version: 592627ccbdff0ec6fff00fc761142a76db750dd4 Version: 592627ccbdff0ec6fff00fc761142a76db750dd4 Version: 592627ccbdff0ec6fff00fc761142a76db750dd4 Version: 592627ccbdff0ec6fff00fc761142a76db750dd4 Version: 0e443760b8b7b1e6723f4408afa056b2bc4fea12 Version: 6.2.3 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:12.775005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:58.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mr.c",
"drivers/infiniband/sw/rxe/rxe_verbs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e327021bd73b134c18167e2cd2a52eb5597fcba6",
"status": "affected",
"version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
"versionType": "git"
},
{
"lessThan": "2a585a08a43c568ed6e9f27a97fd3d95106b9e68",
"status": "affected",
"version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
"versionType": "git"
},
{
"lessThan": "409c2c5508f3d30627bea576f8676de523cb906e",
"status": "affected",
"version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
"versionType": "git"
},
{
"lessThan": "836f6c13c9674027793f720be3f15ecd2b90b6ca",
"status": "affected",
"version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
"versionType": "git"
},
{
"lessThan": "12985e5915a0b8354796efadaaeb201eed115377",
"status": "affected",
"version": "592627ccbdff0ec6fff00fc761142a76db750dd4",
"versionType": "git"
},
{
"status": "affected",
"version": "0e443760b8b7b1e6723f4408afa056b2bc4fea12",
"versionType": "git"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mr.c",
"drivers/infiniband/sw/rxe/rxe_verbs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE\n\nThe current implementation incorrectly handles memory regions (MRs) with\npage sizes different from the system PAGE_SIZE. The core issue is that\nrxe_set_page() is called with mr-\u003epage_size step increments, but the\npage_list stores individual struct page pointers, each representing\nPAGE_SIZE of memory.\n\nib_sg_to_page() has ensured that when i\u003e=1 either\na) SG[i-1].dma_end and SG[i].dma_addr are contiguous\nor\nb) SG[i-1].dma_end and SG[i].dma_addr are mr-\u003epage_size aligned.\n\nThis leads to incorrect iova-to-va conversion in scenarios:\n\n1) page_size \u003c PAGE_SIZE (e.g., MR: 4K, system: 64K):\n ibmr-\u003eiova = 0x181800\n sg[0]: dma_addr=0x181800, len=0x800\n sg[1]: dma_addr=0x173000, len=0x1000\n\n Access iova = 0x181800 + 0x810 = 0x182010\n Expected VA: 0x173010 (second SG, offset 0x10)\n Before fix:\n - index = (0x182010 \u003e\u003e 12) - (0x181800 \u003e\u003e 12) = 1\n - page_offset = 0x182010 \u0026 0xFFF = 0x10\n - xarray[1] stores system page base 0x170000\n - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)\n\n2) page_size \u003e PAGE_SIZE (e.g., MR: 64K, system: 4K):\n ibmr-\u003eiova = 0x18f800\n sg[0]: dma_addr=0x18f800, len=0x800\n sg[1]: dma_addr=0x170000, len=0x1000\n\n Access iova = 0x18f800 + 0x810 = 0x190010\n Expected VA: 0x170010 (second SG, offset 0x10)\n Before fix:\n - index = (0x190010 \u003e\u003e 16) - (0x18f800 \u003e\u003e 16) = 1\n - page_offset = 0x190010 \u0026 0xFFFF = 0x10\n - xarray[1] stores system page for dma_addr 0x170000\n - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)\n\nYi Zhang reported a kernel panic[1] years ago related to this defect.\n\nSolution:\n1. Replace xarray with pre-allocated rxe_mr_page array for sequential\n indexing (all MR page indices are contiguous)\n2. Each rxe_mr_page stores both struct page* and offset within the\n system page\n3. Handle MR page_size != PAGE_SIZE relationships:\n - page_size \u003e PAGE_SIZE: Split MR pages into multiple system pages\n - page_size \u003c= PAGE_SIZE: Store offset within system page\n4. Add boundary checks and compatibility validation\n\nThis ensures correct iova-to-va conversion regardless of MR page size\nand system PAGE_SIZE relationship, while improving performance through\narray-based sequential access.\n\nTests on 4K and 64K PAGE_SIZE hosts:\n- rdma-core/pytests\n $ ./build/bin/run_tests.py --dev eth0_rxe\n- blktest:\n $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd\n\n[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when rxe processes incoming RoCE packets over UDP (port 4791) on the responder path for RDMA Read, Write, and Atomic operations, which is the standard network-facing deployment for software RoCE storage targets and RDMA services.\nAC:L - Once a victim host runs rxe with an FMR whose page_size differs from PAGE_SIZE, a remote peer can reliably trigger the defective iova-to-VA conversion by sending RDMA operations with IOVAs that cross MR page boundaries, as demonstrated in the fix commit\u0027s worked examples.\nPR:N - Exploitation requires no OS privileges on the victim host; a remote attacker only needs network reachability to an established RDMA session (e.g., NVMe-oF or rtrs client) and a valid rkey from that connection, not local root or CAP_NET_ADMIN on the target system.\nUI:N - No victim user action is required beyond normal operation of an RDMA-connected service; the attacker triggers the flaw by sending crafted RDMA packets over an existing queue pair.\nS:U - Impact is confined to kernel memory corruption and crashes within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Incorrect iova-to-VA mapping causes memcpy and atomic handlers to read from the wrong struct page, enabling disclosure of data from unintended pages within the MR mapping and constituting out-of-bounds kernel memory read.\nI:H - RDMA Write and Atomic Write operations using the buggy conversion write to incorrectly resolved virtual addresses, corrupting kernel memory outside the intended MR buffer and providing a memory-corruption primitive exploitable for further compromise.\nA:H - The fix commit cites a confirmed kernel panic from this defect, and misresolved page mappings in rxe_mr_copy() can cause oopses or crashes when accessing invalid or misaligned memory."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:37.480Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e327021bd73b134c18167e2cd2a52eb5597fcba6"
},
{
"url": "https://git.kernel.org/stable/c/2a585a08a43c568ed6e9f27a97fd3d95106b9e68"
},
{
"url": "https://git.kernel.org/stable/c/409c2c5508f3d30627bea576f8676de523cb906e"
},
{
"url": "https://git.kernel.org/stable/c/836f6c13c9674027793f720be3f15ecd2b90b6ca"
},
{
"url": "https://git.kernel.org/stable/c/12985e5915a0b8354796efadaaeb201eed115377"
}
],
"title": "RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46325",
"datePublished": "2026-06-09T12:25:52.792Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-10-21T12:41:37.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99117 (GCVE-0-2026-99117)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mcast: don't truncate the port group walk on teardown
__br_multicast_disable_port_ctx() and br_multicast_del_port() walk
port->mglist with hlist_for_each_entry_safe(). However,
br_multicast_find_del_pg() can also delete other entries from the same
list through br_multicast_fwd_src_remove() or __fwd_del_star_excl().
If such an entry is the iterator's saved next node, hlist_del_init()
clears its ->next and terminates the walk early. The reproducer triggers
this in both teardown walks, leaving port groups in the bridge mdb with
a dangling ->key.port after del_nbp() frees the port:
BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320
__mdb_fill_info+0x1191/0x1320
br_mdb_dump+0x594/0xe40
rtnl_mdb_dump+0x1cf/0x5d0
Use hlist_del_init_rcu() to unlink the group while preserving ->next.
br_multicast_del_pg() and the teardown walks run under
br->multicast_lock. The GC worker must acquire the same lock before
detaching the group for destruction, so the node remains alive while
the walk uses the preserved pointer.
Preserving ->next means a walk can now reach a group that an earlier
iteration already deleted as a side effect. That group is off mp->ports,
so br_multicast_find_del_pg() would fall through its port scan and hit
the trailing WARN_ON(1). Skip such groups at the top of that helper: a
port group is put on port->mglist when it is created and only unlinked
when it is deleted, so hlist_unhashed() identifies exactly this case.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 Version: b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be331b23c650de9518f8266b901d8abb9b36af77",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "ab836d56ff43f2e7927e88c83cd02c47a98a672e",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "b0db9f4ff402becff710ab27dbd9f6fe4850b47e",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "e69d4927dacd6ddaff09777a89efc0d3143d3b0d",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "8243d587a081e790ad96e80d48eef44d9f7ef005",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "b45e8c24608c992d1e2cea047eb5bcbfa537f86b",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
},
{
"lessThan": "5a3f7a683aee56e1f15c9d53041f3236767eaae7",
"status": "affected",
"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: don\u0027t truncate the port group walk on teardown\n\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport-\u003emglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\n\nIf such an entry is the iterator\u0027s saved next node, hlist_del_init()\nclears its -\u003enext and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling -\u003ekey.port after del_nbp() frees the port:\n\n BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n __mdb_fill_info+0x1191/0x1320\n br_mdb_dump+0x594/0xe40\n rtnl_mdb_dump+0x1cf/0x5d0\n\nUse hlist_del_init_rcu() to unlink the group while preserving -\u003enext.\nbr_multicast_del_pg() and the teardown walks run under\nbr-\u003emulticast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\n\nPreserving -\u003enext means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp-\u003eports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port-\u003emglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local RTM_SETLINK with IFLA_MASTER=0 reaches rtnl_setlink()\u2192do_set_master()\u2192br_del_if()\u2192del_nbp()\u2192br_multicast_del_port()\u2192br_multicast_find_del_pg()\u2192patched br_multicast_del_pg(); IGMPv3 reports can prepare membership state but cannot perform the required port teardown.\nAC:L - By adding several temporary (S,G) entries before corresponding IGMPv3 MODE_IS_INCLUDE reports, the attacker deterministically orders port-\u003emglist so cascading deletion removes each saved next node; detaching the port then triggers both truncated walks without a race or external timing.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN in the socket\u0027s network namespace for RTM_NEWMDB and RTM_SETLINK. set_cred_user_ns() grants that capability to an unprivileged caller in a new user and network namespace, so ordinary local access suffices.\nUI:N - The attacker creates the bridge and memberships, injects the IGMPv3 reports, detaches the port, and requests RTM_GETMDB without requiring another user to act.\nS:U - The dangling net_bridge_port pointer and surviving bridge MDB groups remain within the host kernel\u0027s security authority; exploitation from a user-created network namespace is ordinary kernel privilege escalation, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - The surviving port group retains pg-\u003ekey.port after release_nbp() frees the net_bridge_port; RTM_GETMDB reaches __mdb_fill_info(), which follows reclaimed port-\u003edev and returns derived data, allowing heap reclamation to steer kernel reads through the dangling pointer.\nI:H - When a surviving source expires, br_multicast_group_src_expired() reaches br_multicast_del_pg() through the dangling key.port; br_multicast_port_ngroups_dec() then writes mdb_n_entries through freed or reclaimed port memory, supporting memory corruption and control-flow exploitation.\nA:H - The demonstrated RTM_GETMDB path produces a KASAN slab-use-after-free in __mdb_fill_info(), while surviving source or port-group timers also dereference the freed port; these paths can oops or panic the kernel and are repeatable from the attacker\u0027s namespace."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:18.238Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be331b23c650de9518f8266b901d8abb9b36af77"
},
{
"url": "https://git.kernel.org/stable/c/ab836d56ff43f2e7927e88c83cd02c47a98a672e"
},
{
"url": "https://git.kernel.org/stable/c/025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8"
},
{
"url": "https://git.kernel.org/stable/c/b0db9f4ff402becff710ab27dbd9f6fe4850b47e"
},
{
"url": "https://git.kernel.org/stable/c/e69d4927dacd6ddaff09777a89efc0d3143d3b0d"
},
{
"url": "https://git.kernel.org/stable/c/8243d587a081e790ad96e80d48eef44d9f7ef005"
},
{
"url": "https://git.kernel.org/stable/c/b45e8c24608c992d1e2cea047eb5bcbfa537f86b"
},
{
"url": "https://git.kernel.org/stable/c/5a3f7a683aee56e1f15c9d53041f3236767eaae7"
}
],
"title": "net: bridge: mcast: don\u0027t truncate the port group walk on teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99117",
"datePublished": "2026-10-28T10:34:33.874Z",
"dateReserved": "2026-09-25T10:25:14.392Z",
"dateUpdated": "2026-10-31T12:43:18.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74754 (GCVE-0-2026-74754)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: pair EH runtime PM get and put
shost->eh_noresume is currently consulted twice in one error handling
iteration: once before scsi_autopm_get_host() and once again before
scsi_autopm_put_host().
That is racy when a PM-triggered error path flips shost->eh_noresume
while the SCSI EH thread is still running.
The problem flow looks like this:
PM path
ufshcd_set_dev_pwr_mode()
shost->eh_noresume = 1
ufshcd_execute_start_stop <-- trigger EH
...
shost->eh_noresume = 0
EH path
scsi_error_handler()
if (!shost->eh_noresume)
scsi_autopm_get_host() <-- skipped
...
if (!shost->eh_noresume)
scsi_autopm_put_host() <-- executed later
In that case one EH iteration can skip autoresume on entry and still
drop a runtime PM reference on exit. That leaves an unmatched runtime PM
put and can trigger a runtime PM usage count underflow.
Fix this by making eh_noresume a regular bool so it can be accessed with
READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use
that snapshot for both runtime PM get and put decisions.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ae0751ffc77e7f21629970fdab5528c573e637f8 Version: ae0751ffc77e7f21629970fdab5528c573e637f8 Version: ae0751ffc77e7f21629970fdab5528c573e637f8 Version: ae0751ffc77e7f21629970fdab5528c573e637f8 Version: ae0751ffc77e7f21629970fdab5528c573e637f8 Version: ae0751ffc77e7f21629970fdab5528c573e637f8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_error.c",
"drivers/ufs/core/ufshcd.c",
"include/scsi/scsi_host.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9aca00c74730f4bc12d0717d33db637a16ccdfea",
"status": "affected",
"version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
"versionType": "git"
},
{
"lessThan": "1ec5f6aa38ea990af37c49af7a4bb3db00da7f9d",
"status": "affected",
"version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
"versionType": "git"
},
{
"lessThan": "0038a2a75a15d163f428c93103c6d02d4d231a7a",
"status": "affected",
"version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
"versionType": "git"
},
{
"lessThan": "fdc93f4a801077efbf1b87570ade8d8f325de62f",
"status": "affected",
"version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
"versionType": "git"
},
{
"lessThan": "e83eed1bea142c8fe852fd53156845b88252ecd8",
"status": "affected",
"version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
"versionType": "git"
},
{
"lessThan": "872f486259ae0bc6b73ca4735a15d013241f73e9",
"status": "affected",
"version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_error.c",
"drivers/ufs/core/ufshcd.c",
"include/scsi/scsi_host.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: pair EH runtime PM get and put\n\nshost-\u003eeh_noresume is currently consulted twice in one error handling\niteration: once before scsi_autopm_get_host() and once again before\nscsi_autopm_put_host().\n\nThat is racy when a PM-triggered error path flips shost-\u003eeh_noresume\nwhile the SCSI EH thread is still running.\n\nThe problem flow looks like this:\nPM path\n ufshcd_set_dev_pwr_mode()\n shost-\u003eeh_noresume = 1\n ufshcd_execute_start_stop \u003c-- trigger EH\n ...\n shost-\u003eeh_noresume = 0\n\nEH path\n scsi_error_handler()\n if (!shost-\u003eeh_noresume)\n scsi_autopm_get_host() \u003c-- skipped\n ...\n if (!shost-\u003eeh_noresume)\n scsi_autopm_put_host() \u003c-- executed later\n\nIn that case one EH iteration can skip autoresume on entry and still\ndrop a runtime PM reference on exit. That leaves an unmatched runtime PM\nput and can trigger a runtime PM usage count underflow.\n\nFix this by making eh_noresume a regular bool so it can be accessed with\nREAD_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use\nthat snapshot for both runtime PM get and put decisions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:32.806Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9aca00c74730f4bc12d0717d33db637a16ccdfea"
},
{
"url": "https://git.kernel.org/stable/c/1ec5f6aa38ea990af37c49af7a4bb3db00da7f9d"
},
{
"url": "https://git.kernel.org/stable/c/0038a2a75a15d163f428c93103c6d02d4d231a7a"
},
{
"url": "https://git.kernel.org/stable/c/fdc93f4a801077efbf1b87570ade8d8f325de62f"
},
{
"url": "https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8"
},
{
"url": "https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9"
}
],
"title": "scsi: core: pair EH runtime PM get and put",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74754",
"datePublished": "2026-08-26T14:37:00.766Z",
"dateReserved": "2026-08-15T05:44:03.931Z",
"dateUpdated": "2026-10-30T12:30:32.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99092 (GCVE-0-2026-99092)
Vulnerability from cvelistv5
Published
2026-10-26 14:52
Modified
2026-10-26 14:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: patch: fix handling of bpf-jit execmem addresses
Commit 8718e5a3090b ("riscv: patch: skip fixmap mapping when kernel text
is already writable") gated the core_kernel_text() branch of patch_map()
on CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch
unchanged. That branch has a separate problem.
That branch only creates a temporary writable fixmap alias when
CONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is
directly writable and returns the address unchanged. That assumption no
longer holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack
unconditionally in alloc_new_pack(), independently of any
CONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only
regardless of what CONFIG_STRICT_MODULE_RWX says.
With CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only
address directly, the subsequent copy_to_kernel_nofault() takes a
page fault and returns -EFAULT. bpf_arch_text_copy() turns that into
-EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the
WARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed.
Note that BPF cannot be fixed the way kprobes was in
commit bdc46e507b59 ("riscv: mm: make EXECMEM_KPROBES writable without
CONFIG_STRICT_MODULE_RWX"). EXECMEM_BPF is already PAGE_KERNEL, i.e.
writable at allocation time; the read-only mapping is established
afterwards by generic code in alloc_new_pack(), which arch code cannot
influence. The only place this can be handled is patch_map().
This is the same problem that was fixed on arm64 by commit b1480ed230ac
("arm64: patching: fix handling of execmem addresses"), and the fix is
the same: CONFIG_EXECMEM is what actually tracks whether the vmalloc
area can hold executable memory that needs a temporary alias to be
written. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select
it.
Note that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv
selects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can
be disabled with CONFIG_MODULES=y as well, and the bug is reachable in
that configuration too.
The !CONFIG_MMU build is unaffected: it has its own __patch_insn_set()
and __patch_insn_write() implementations and never calls patch_map().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/patch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "562a35b9e0b3d9483d9472995219cadb3592db3d",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
},
{
"lessThan": "9e8fc7972b398e9dc2415ece283d8f64edac3858",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
},
{
"lessThan": "f71d6ea3843c8038c431c2699482f246aea37ca0",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
},
{
"lessThan": "a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06",
"status": "affected",
"version": "2c9e5d4a008293407836d29d35dfd4353615bd2f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kernel/patch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: patch: fix handling of bpf-jit execmem addresses\n\nCommit 8718e5a3090b (\"riscv: patch: skip fixmap mapping when kernel text\nis already writable\") gated the core_kernel_text() branch of patch_map()\non CONFIG_STRICT_KERNEL_RWX, and explicitly left the vmalloc branch\nunchanged. That branch has a separate problem.\n\nThat branch only creates a temporary writable fixmap alias when\nCONFIG_STRICT_MODULE_RWX is enabled, and otherwise assumes the target is\ndirectly writable and returns the address unchanged. That assumption no\nlonger holds: bpf_prog_pack_alloc calls set_memory_rox() on every pack\nunconditionally in alloc_new_pack(), independently of any\nCONFIG_STRICT_*_RWX option, so BPF text in the vmalloc area is read-only\nregardless of what CONFIG_STRICT_MODULE_RWX says.\n\nWith CONFIG_STRICT_MODULE_RWX=n, patch_map() returns the read-only\naddress directly, the subsequent copy_to_kernel_nofault() takes a\npage fault and returns -EFAULT. bpf_arch_text_copy() turns that into\n-EINVAL, which propagates through bpf_jit_binary_pack_finalize() to the\nWARN_ON() in bpf_int_jit_compile() and leaves the program un-JITed.\n\nNote that BPF cannot be fixed the way kprobes was in\ncommit bdc46e507b59 (\"riscv: mm: make EXECMEM_KPROBES writable without\nCONFIG_STRICT_MODULE_RWX\"). EXECMEM_BPF is already PAGE_KERNEL, i.e.\nwritable at allocation time; the read-only mapping is established\nafterwards by generic code in alloc_new_pack(), which arch code cannot\ninfluence. The only place this can be handled is patch_map().\n\nThis is the same problem that was fixed on arm64 by commit b1480ed230ac\n(\"arm64: patching: fix handling of execmem addresses\"), and the fix is\nthe same: CONFIG_EXECMEM is what actually tracks whether the vmalloc\narea can hold executable memory that needs a temporary alias to be\nwritten. CONFIG_BPF_JIT, CONFIG_KPROBES and CONFIG_MODULES all select\nit.\n\nNote that this is not limited to CONFIG_MODULES=n. Unlike arm64, riscv\nselects CONFIG_ARCH_OPTIONAL_KERNEL_RWX, so CONFIG_STRICT_MODULE_RWX can\nbe disabled with CONFIG_MODULES=y as well, and the bug is reachable in\nthat configuration too.\n\nThe !CONFIG_MMU build is unaffected: it has its own __patch_insn_set()\nand __patch_insn_write() implementations and never calls patch_map()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:00.860Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/562a35b9e0b3d9483d9472995219cadb3592db3d"
},
{
"url": "https://git.kernel.org/stable/c/9e8fc7972b398e9dc2415ece283d8f64edac3858"
},
{
"url": "https://git.kernel.org/stable/c/f71d6ea3843c8038c431c2699482f246aea37ca0"
},
{
"url": "https://git.kernel.org/stable/c/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06"
}
],
"title": "riscv: patch: fix handling of bpf-jit execmem addresses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99092",
"datePublished": "2026-10-26T14:52:00.860Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-26T14:52:00.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71227 (GCVE-0-2025-71227)
Vulnerability from cvelistv5
Published
2026-02-18 14:21
Modified
2026-11-05 21:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't WARN for connections on invalid channels
It's not clear (to me) how exactly syzbot managed to hit this,
but it seems conceivable that e.g. regulatory changed and has
disabled a channel between scanning (channel is checked to be
usable by cfg80211_get_ies_channel_number) and connecting on
the channel later.
With one scenario that isn't covered elsewhere described above,
the warning isn't good, replace it with a (more informative)
error message.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:15:25.256662Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:10.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6acc2d23f13d60874981b4828ba156ba01c86510",
"status": "affected",
"version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
"versionType": "git"
},
{
"lessThan": "c02b1d244a5d799696ca74d3fba6539c8d76195f",
"status": "affected",
"version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
"versionType": "git"
},
{
"lessThan": "579cf5939f8f4c4f88c75862d0c573fb13567b74",
"status": "affected",
"version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
"versionType": "git"
},
{
"lessThan": "10d3ff7e5812c8d70300f6fa8f524009a06aa7e1",
"status": "affected",
"version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
"versionType": "git"
},
{
"lessThan": "99067b58a408a384d2a45c105eb3dce980a862ce",
"status": "affected",
"version": "f2d9d270c15ae0139b54a7e7466d738327e97e03",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.10",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t WARN for connections on invalid channels\n\nIt\u0027s not clear (to me) how exactly syzbot managed to hit this,\nbut it seems conceivable that e.g. regulatory changed and has\ndisabled a channel between scanning (channel is checked to be\nusable by cfg80211_get_ies_channel_number) and connecting on\nthe channel later.\n\nWith one scenario that isn\u0027t covered elsewhere described above,\nthe warning isn\u0027t good, replace it with a (more informative)\nerror message."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:33.421Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6acc2d23f13d60874981b4828ba156ba01c86510"
},
{
"url": "https://git.kernel.org/stable/c/c02b1d244a5d799696ca74d3fba6539c8d76195f"
},
{
"url": "https://git.kernel.org/stable/c/579cf5939f8f4c4f88c75862d0c573fb13567b74"
},
{
"url": "https://git.kernel.org/stable/c/10d3ff7e5812c8d70300f6fa8f524009a06aa7e1"
},
{
"url": "https://git.kernel.org/stable/c/99067b58a408a384d2a45c105eb3dce980a862ce"
}
],
"title": "wifi: mac80211: don\u0027t WARN for connections on invalid channels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71227",
"datePublished": "2026-02-18T14:21:48.422Z",
"dateReserved": "2026-02-14T16:26:02.970Z",
"dateUpdated": "2026-11-05T21:23:10.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90144 (GCVE-0-2026-90144)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dpll: fix NULL deref in dpll_device_ops() during teardown race
When the last owner of a dpll device unregisters while a foreign driver
still holds a pin on it via dpll_pin_on_pin_register(), the dpll object
stays alive with an empty registration list. A pin notification queued
before the unregister (e.g. ice reacting to zl3073x_i2c removal) then
walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and
dereferences the missing registration. dpll_lock cannot help because the
notification work was queued before the unregistering driver took the
lock.
Treat the empty registration list as a legitimate transient state. Make
dpll_priv() and dpll_device_ops() return NULL in that case and make
every pin netlink path that resolves a device from a pin skip such
dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and
returns -ENODEV when there is none, the pin dumpit skips such a pin
instead of aborting the dump, dpll_msg_add_pin_dplls() and the
frequency, esync, reference sync and phase adjust set paths skip dead
refs, and dpll_pin_parent_device_set() validates the parent with
dpll_device_get_by_id(). dpll_pin_register() is the last caller that
dereferenced the device ops without a check, so move its frequency
monitor validation under dpll_lock and tolerate a missing registration
there as well.
The empty registration list is equivalent to a cleared DPLL_REGISTERED
mark, both transitions happen under dpll_lock in dpll_device_register()
and dpll_device_unregister(). A pin notification for a pin whose dplls
are all gone is now dropped with -ENODEV instead of crashing, all
callers in the core ignore that return value.
WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40,
CPU#83: kworker/u576:3/23471
Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ...
Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice]
RIP: 0010:dpll_device_ops+0x24/0x40
Call Trace:
<TASK>
dpll_cmd_pin_get_one+0x336/0x520
dpll_pin_event_send+0x82/0x140
dpll_pin_on_pin_unregister+0xbb/0x160
ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice]
process_one_work+0x19e/0x370
worker_thread+0x1a6/0x310
kthread+0xe4/0x120
ret_from_fork+0x1a1/0x270
ret_from_fork_asm+0x1a/0x30
</TASK>
---[ end trace 0000000000000000 ]---
BUG: kernel NULL pointer dereference, address: 0000000000000010
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dpll/dpll_core.c",
"drivers/dpll/dpll_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d9661d6ef60bee705a3bb220dc59f10d9155c31",
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"versionType": "git"
},
{
"lessThan": "d39da3ff8d39c31761bf1698bc02a5a206722136",
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"versionType": "git"
},
{
"lessThan": "fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b",
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"versionType": "git"
},
{
"lessThan": "33f016b23a219fe034213849b51436b8e79df251",
"status": "affected",
"version": "9431063ad323ac864750aeba4d304389bc42ca4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dpll/dpll_core.c",
"drivers/dpll/dpll_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpll: fix NULL deref in dpll_device_ops() during teardown race\n\nWhen the last owner of a dpll device unregisters while a foreign driver\nstill holds a pin on it via dpll_pin_on_pin_register(), the dpll object\nstays alive with an empty registration list. A pin notification queued\nbefore the unregister (e.g. ice reacting to zl3073x_i2c removal) then\nwalks pin-\u003edpll_refs into dpll_device_ops(), which trips the WARN_ON and\ndereferences the missing registration. dpll_lock cannot help because the\nnotification work was queued before the unregistering driver took the\nlock.\n\nTreat the empty registration list as a legitimate transient state. Make\ndpll_priv() and dpll_device_ops() return NULL in that case and make\nevery pin netlink path that resolves a device from a pin skip such\ndplls. dpll_cmd_pin_get_one() picks a ref with a live registration and\nreturns -ENODEV when there is none, the pin dumpit skips such a pin\ninstead of aborting the dump, dpll_msg_add_pin_dplls() and the\nfrequency, esync, reference sync and phase adjust set paths skip dead\nrefs, and dpll_pin_parent_device_set() validates the parent with\ndpll_device_get_by_id(). dpll_pin_register() is the last caller that\ndereferenced the device ops without a check, so move its frequency\nmonitor validation under dpll_lock and tolerate a missing registration\nthere as well.\n\nThe empty registration list is equivalent to a cleared DPLL_REGISTERED\nmark, both transitions happen under dpll_lock in dpll_device_register()\nand dpll_device_unregister(). A pin notification for a pin whose dplls\nare all gone is now dropped with -ENODEV instead of crashing, all\ncallers in the core ignore that return value.\n\n WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40,\n CPU#83: kworker/u576:3/23471\n Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ...\n Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice]\n RIP: 0010:dpll_device_ops+0x24/0x40\n Call Trace:\n \u003cTASK\u003e\n dpll_cmd_pin_get_one+0x336/0x520\n dpll_pin_event_send+0x82/0x140\n dpll_pin_on_pin_unregister+0xbb/0x160\n ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice]\n process_one_work+0x19e/0x370\n worker_thread+0x1a6/0x310\n kthread+0xe4/0x120\n ret_from_fork+0x1a1/0x270\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:03.630Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d9661d6ef60bee705a3bb220dc59f10d9155c31"
},
{
"url": "https://git.kernel.org/stable/c/d39da3ff8d39c31761bf1698bc02a5a206722136"
},
{
"url": "https://git.kernel.org/stable/c/fdbf04e3e01a872d0ef2149f846f1a3e3cb54f5b"
},
{
"url": "https://git.kernel.org/stable/c/33f016b23a219fe034213849b51436b8e79df251"
}
],
"title": "dpll: fix NULL deref in dpll_device_ops() during teardown race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90144",
"datePublished": "2026-09-17T16:06:40.413Z",
"dateReserved": "2026-09-11T19:38:34.789Z",
"dateUpdated": "2026-10-21T12:50:03.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97561 (GCVE-0-2026-97561)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-30 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
When the administrator mounts with forceuid or forcegid (uid=/gid=
mount options), they expect all files to appear owned by the specified
user/group. However, several code paths unconditionally called
sid_to_id() to overwrite cf_uid/cf_gid with server-provided values,
ignoring the administrator's explicit override:
- smb311_posix_info_to_fattr() (stat via POSIX extensions)
- cifs_posix_to_fattr() (readdir via POSIX extensions)
- parse_sec_desc() (CIFS ACL ownership mapping)
This allowed an untrusted server to dictate local file ownership even
when the mount was configured to force specific uid/gid values.
Fix all three call sites to check CIFS_MOUNT_OVERR_UID and
CIFS_MOUNT_OVERR_GID before calling sid_to_id(), following the
same pattern already used by cifs_unix_basic_to_fattr() for unix
extensions.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9409ae58e0759d010b347e7b19ebc90ab5d4b98f Version: 9409ae58e0759d010b347e7b19ebc90ab5d4b98f Version: 9409ae58e0759d010b347e7b19ebc90ab5d4b98f Version: 9409ae58e0759d010b347e7b19ebc90ab5d4b98f Version: 9409ae58e0759d010b347e7b19ebc90ab5d4b98f Version: 9409ae58e0759d010b347e7b19ebc90ab5d4b98f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifsacl.c",
"fs/smb/client/inode.c",
"fs/smb/client/readdir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89a3b4704af2208e381c55037ff2d1e2365b83e4",
"status": "affected",
"version": "9409ae58e0759d010b347e7b19ebc90ab5d4b98f",
"versionType": "git"
},
{
"lessThan": "be6eccccec867c22d7c65fab4ea4e91ec3d5b8c6",
"status": "affected",
"version": "9409ae58e0759d010b347e7b19ebc90ab5d4b98f",
"versionType": "git"
},
{
"lessThan": "bc35de451c128d399ad185d6269f8847e97cd1c9",
"status": "affected",
"version": "9409ae58e0759d010b347e7b19ebc90ab5d4b98f",
"versionType": "git"
},
{
"lessThan": "6ac7a29691558bed18e2df1780636b8aa0fd13d5",
"status": "affected",
"version": "9409ae58e0759d010b347e7b19ebc90ab5d4b98f",
"versionType": "git"
},
{
"lessThan": "e1b74f8f8c1d13190b09fe623b729d36b7ac22a8",
"status": "affected",
"version": "9409ae58e0759d010b347e7b19ebc90ab5d4b98f",
"versionType": "git"
},
{
"lessThan": "18a72975e9f35aadecc75b031f693f2d1f49308f",
"status": "affected",
"version": "9409ae58e0759d010b347e7b19ebc90ab5d4b98f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifsacl.c",
"fs/smb/client/inode.c",
"fs/smb/client/readdir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: honor forceuid/forcegid when mapping SIDs to uid/gid\n\nWhen the administrator mounts with forceuid or forcegid (uid=/gid=\nmount options), they expect all files to appear owned by the specified\nuser/group. However, several code paths unconditionally called\nsid_to_id() to overwrite cf_uid/cf_gid with server-provided values,\nignoring the administrator\u0027s explicit override:\n\n - smb311_posix_info_to_fattr() (stat via POSIX extensions)\n - cifs_posix_to_fattr() (readdir via POSIX extensions)\n - parse_sec_desc() (CIFS ACL ownership mapping)\n\nThis allowed an untrusted server to dictate local file ownership even\nwhen the mount was configured to force specific uid/gid values.\n\nFix all three call sites to check CIFS_MOUNT_OVERR_UID and\nCIFS_MOUNT_OVERR_GID before calling sid_to_id(), following the\nsame pattern already used by cifs_unix_basic_to_fattr() for unix\nextensions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:37:25.329Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89a3b4704af2208e381c55037ff2d1e2365b83e4"
},
{
"url": "https://git.kernel.org/stable/c/be6eccccec867c22d7c65fab4ea4e91ec3d5b8c6"
},
{
"url": "https://git.kernel.org/stable/c/bc35de451c128d399ad185d6269f8847e97cd1c9"
},
{
"url": "https://git.kernel.org/stable/c/6ac7a29691558bed18e2df1780636b8aa0fd13d5"
},
{
"url": "https://git.kernel.org/stable/c/e1b74f8f8c1d13190b09fe623b729d36b7ac22a8"
},
{
"url": "https://git.kernel.org/stable/c/18a72975e9f35aadecc75b031f693f2d1f49308f"
}
],
"title": "smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97561",
"datePublished": "2026-09-25T10:21:50.067Z",
"dateReserved": "2026-09-24T16:01:01.155Z",
"dateUpdated": "2026-10-30T12:37:25.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74527 (GCVE-0-2026-74527)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Block VFs from clobbering special CGX PKIND state
PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND
programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must
not reset the LMAC RX PKIND or default TX parse config over the PF setup.
Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip
cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates
when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 94d942c5fb970ac2166216838b278613decfa9a0 Version: 94d942c5fb970ac2166216838b278613decfa9a0 Version: 94d942c5fb970ac2166216838b278613decfa9a0 Version: 94d942c5fb970ac2166216838b278613decfa9a0 Version: 94d942c5fb970ac2166216838b278613decfa9a0 Version: 94d942c5fb970ac2166216838b278613decfa9a0 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74527",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:11.086821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:53.016Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/cgx.c",
"drivers/net/ethernet/marvell/octeontx2/af/cgx.h",
"drivers/net/ethernet/marvell/octeontx2/af/rvu.h",
"drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c",
"drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c",
"drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f24f7ce6fb2d1ae080a05371afddba30a3e0b919",
"status": "affected",
"version": "94d942c5fb970ac2166216838b278613decfa9a0",
"versionType": "git"
},
{
"lessThan": "1106b26e86ac1e7e4d1f634bcd532c5d44e60620",
"status": "affected",
"version": "94d942c5fb970ac2166216838b278613decfa9a0",
"versionType": "git"
},
{
"lessThan": "7e888d7dd11519330ba6c6a28391d55891463a6a",
"status": "affected",
"version": "94d942c5fb970ac2166216838b278613decfa9a0",
"versionType": "git"
},
{
"lessThan": "a76243488740a07c81c9adf431685bb7f7c31d8c",
"status": "affected",
"version": "94d942c5fb970ac2166216838b278613decfa9a0",
"versionType": "git"
},
{
"lessThan": "d3c6b0f48f126a36955b3fb4154a59d0b3621d97",
"status": "affected",
"version": "94d942c5fb970ac2166216838b278613decfa9a0",
"versionType": "git"
},
{
"lessThan": "3bd438a58e910db5dc369aa25dfed1fc95f1b596",
"status": "affected",
"version": "94d942c5fb970ac2166216838b278613decfa9a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/cgx.c",
"drivers/net/ethernet/marvell/octeontx2/af/cgx.h",
"drivers/net/ethernet/marvell/octeontx2/af/rvu.h",
"drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c",
"drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c",
"drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Block VFs from clobbering special CGX PKIND state\n\nPF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND\nprogramming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must\nnot reset the LMAC RX PKIND or default TX parse config over the PF setup.\n\nAdd cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip\ncgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates\nwhen the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a malicious SR-IOV VF tenant to send NIX_LF_ALLOC mailbox messages over PCI BAR registers during netdev bring-up; the vulnerable AF code is not reachable from remote network packets.\nAC:L - In the target OcteonTX2 DSA/HiGig multi-tenant deployment, a VF reliably triggers the bug by opening its netdev; no races or attacker-uncontrollable memory layout are needed once HiGig/EDSA parsing is enabled on the shared LMAC.\nPR:L - The attacker is a cloud/NFV tenant with an assigned OcteonTX2 VF; triggering NIX LF allocation during interface up requires only guest-level netdev privileges (e.g., CAP_NET_ADMIN in the VM), not host root or init-namespace admin rights.\nUI:N - No victim interaction is required; the clobber occurs automatically when the attacker brings up or reinitializes their VF network interface through the standard driver probe/open path.\nS:C - A VF guest corrupts host-managed shared CGX LMAC hardware PKIND and NPC parse configuration, impacting the PF and other functions on that port beyond the VF\u0027s own security authority\u2014crossing the VM/tenant isolation boundary.\nC:H - Resetting HiGig/EDSA RX PKIND misconfigures NPC packet parsing for the entire shared LMAC, potentially misdelivering or exposing fabric/switch-tagged traffic intended for the PF or other tenants to the attacker\u0027s VF.\nI:H - The VF forcibly overwrites shared LMAC RX PKIND via cgx_set_pkind() and programs default TX parse config, corrupting host-controlled switching-header parsing that governs how transmitted and received fabric traffic is processed on the port.\nA:H - Clobbering special HiGig/EDSA PKIND state breaks correct packet parsing for all PF/VF traffic on the shared LMAC, causing sustained loss of connectivity and denial of network service to the host and co-located tenants."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:06.747Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f24f7ce6fb2d1ae080a05371afddba30a3e0b919"
},
{
"url": "https://git.kernel.org/stable/c/1106b26e86ac1e7e4d1f634bcd532c5d44e60620"
},
{
"url": "https://git.kernel.org/stable/c/7e888d7dd11519330ba6c6a28391d55891463a6a"
},
{
"url": "https://git.kernel.org/stable/c/a76243488740a07c81c9adf431685bb7f7c31d8c"
},
{
"url": "https://git.kernel.org/stable/c/d3c6b0f48f126a36955b3fb4154a59d0b3621d97"
},
{
"url": "https://git.kernel.org/stable/c/3bd438a58e910db5dc369aa25dfed1fc95f1b596"
}
],
"title": "octeontx2-af: Block VFs from clobbering special CGX PKIND state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74527",
"datePublished": "2026-08-15T12:27:43.568Z",
"dateReserved": "2026-08-15T05:44:03.912Z",
"dateUpdated": "2026-10-30T12:30:06.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89682 (GCVE-0-2026-89682)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventing the shrinker and GC worker from
bearing the cost of closing files (see ffb402596147). However, the
queue lives in a separately-allocated struct nfsd_fcache_disposal that
is freed by nfsd_free_fcache_disposal_net() during per-net teardown.
The global shrinker, laundrette, and fsnotify callbacks can still be
inside nfsd_file_dispose_list_delayed() dereferencing that pointer,
causing a use-after-free.
Inline the spinlock and freeme list directly into struct nfsd_net (as
fcache_dispose_lock and fcache_dispose_list), eliminating the separately
allocated struct nfsd_fcache_disposal entirely. These fields now have
the same lifetime as the net namespace itself, so there is no dangling
pointer to chase.
nfsd_file_cache_start_net() now just initializes the inline fields and
cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains
the inline list directly instead of freeing a separate struct. The
alloc/free helpers are removed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1463b38e7cf34d4cc60f41daff459ad807b2e408 Version: 1463b38e7cf34d4cc60f41daff459ad807b2e408 Version: 1463b38e7cf34d4cc60f41daff459ad807b2e408 Version: 1463b38e7cf34d4cc60f41daff459ad807b2e408 Version: 1463b38e7cf34d4cc60f41daff459ad807b2e408 Version: 1463b38e7cf34d4cc60f41daff459ad807b2e408 Version: e8f923e1e9fcc0832a12c8a2461792e5a9544c03 Version: 3bc94fb44f10ef852723e1aeaac6794c5ab16aec Version: 5.10.220 ≤ Version: 5.15.154 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/filecache.c",
"fs/nfsd/netns.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41fe0e804bbf1110c0aba2ebdfc729efb240d8a6",
"status": "affected",
"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
"versionType": "git"
},
{
"lessThan": "e6c3a43d0a41f03abae3764fc82a59369360c7e0",
"status": "affected",
"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
"versionType": "git"
},
{
"lessThan": "9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67",
"status": "affected",
"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
"versionType": "git"
},
{
"lessThan": "ba0ee9e04b7a0356c28d5a2fe445db675d24e572",
"status": "affected",
"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
"versionType": "git"
},
{
"lessThan": "cadc9036d5a8209f89e7026ddba7cfb1c716b03c",
"status": "affected",
"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
"versionType": "git"
},
{
"lessThan": "bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4",
"status": "affected",
"version": "1463b38e7cf34d4cc60f41daff459ad807b2e408",
"versionType": "git"
},
{
"status": "affected",
"version": "e8f923e1e9fcc0832a12c8a2461792e5a9544c03",
"versionType": "git"
},
{
"status": "affected",
"version": "3bc94fb44f10ef852723e1aeaac6794c5ab16aec",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.220",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.154",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/filecache.c",
"fs/nfsd/netns.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.220",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.154",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net\n\nnfsd_file_dispose_list_delayed() defers fput() to nfsd service threads\nvia a per-net freeme queue, preventing the shrinker and GC worker from\nbearing the cost of closing files (see ffb402596147). However, the\nqueue lives in a separately-allocated struct nfsd_fcache_disposal that\nis freed by nfsd_free_fcache_disposal_net() during per-net teardown.\nThe global shrinker, laundrette, and fsnotify callbacks can still be\ninside nfsd_file_dispose_list_delayed() dereferencing that pointer,\ncausing a use-after-free.\n\nInline the spinlock and freeme list directly into struct nfsd_net (as\nfcache_dispose_lock and fcache_dispose_list), eliminating the separately\nallocated struct nfsd_fcache_disposal entirely. These fields now have\nthe same lifetime as the net namespace itself, so there is no dangling\npointer to chase.\n\nnfsd_file_cache_start_net() now just initializes the inline fields and\ncannot fail due to allocation. nfsd_file_cache_shutdown_net() drains\nthe inline list directly instead of freeing a separate struct. The\nalloc/free helpers are removed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfsd_file_dispose_list_delayed() runs in the in-kernel NFS server filecache on nfsd_files cached from remote OPEN/READ/WRITE over TCP/UDP 2049; a network NFS client populates that cache and can drive delayed dispose via the global GC laundrette, shrinker, or fsnotify from REMOVE, matching kernel guidance that nfsd is Network.\nAC:H - The UAF requires nfsd_free_fcache_disposal_net() to kfree the separately allocated per-net nfsd_fcache_disposal during nfsd_file_cache_shutdown_net() while the global shrinker, laundrette, or fsnotify still dereference it\u2014a victim-side nfsd restart, shutdown, or netns teardown the remote attacker cannot cause, only race against.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with IP-based exports, so a remote peer that can reach the export self-asserts credentials with no cryptographic authentication and can OPEN/READ files into the filecache; no local Linux account or capability is required.\nUI:N - The attacker issues NFS operations that populate and reclaim the filecache themselves; nfsd per-net teardown is an environmental race counted under Attack Complexity, not an interactive victim action such as mounting a filesystem or opening a file.\nS:U - The use-after-free corrupts host-kernel slab (struct nfsd_fcache_disposal) within the same OS security authority as nfsd and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a slab use-after-free of the kmalloc\u0027d nfsd_fcache_disposal object; reclaim or spray of the freed object lets dispose_list_delayed read attacker-controlled lock and list_head fields, enabling arbitrary kernel disclosure per UAF guidance.\nI:H - spin_lock and list_move_tail on the freed disposal object write into reclaimed slab, corrupting list nodes and lock state and yielding a groomable write or control-flow hijack primitive characteristic of exploitable kernel UAFs.\nA:H - Use-after-free of the disposal spinlock and list from shrinker, GC worker, or fsnotify context causes kernel oops, panic, or list-corruption hangs, fully disrupting availability of the NFS server host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:40.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41fe0e804bbf1110c0aba2ebdfc729efb240d8a6"
},
{
"url": "https://git.kernel.org/stable/c/e6c3a43d0a41f03abae3764fc82a59369360c7e0"
},
{
"url": "https://git.kernel.org/stable/c/9c8ac7c2b9b150e13b7ad0d0fae54f17747dce67"
},
{
"url": "https://git.kernel.org/stable/c/ba0ee9e04b7a0356c28d5a2fe445db675d24e572"
},
{
"url": "https://git.kernel.org/stable/c/cadc9036d5a8209f89e7026ddba7cfb1c716b03c"
},
{
"url": "https://git.kernel.org/stable/c/bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4"
}
],
"title": "nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89682",
"datePublished": "2026-09-11T19:46:04.882Z",
"dateReserved": "2026-09-11T19:38:34.748Z",
"dateUpdated": "2026-10-30T12:32:40.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99135 (GCVE-0-2026-99135)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix infinite loop on discard with large tag size
When integrity_metadata handles a discard, it fills a buffer with
DISCARD_FILLER and writes it over the tags, max_blocks blocks at a
time. If the kmalloc fails, the buffer is the on-stack array
checksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the
tag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size
is never decremented and the loop never terminates.
Fix this by using sizeof(checksums_onstack) as max_size. The array has
MAX_TAG_SIZE bytes since commit b93b6643e9b5 ("dm integrity: fix a
crash with unusually large tag size"), so max_blocks is at least 1.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 Version: 84597a44a9d86ac949900441cea7da0af0f2f473 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f41a224b3c9d66c7b59afc7cae02a8b214f3c684",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "c66f5c6ccfa832d28b44a66c01e3468c246adac4",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "41a18e6c6e2c4a912494a035c17ecfe79c68b9e6",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "bbc154a7da4e075aef720ef051aff6094400eb66",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "c4cba6670fa199415689f67108e96b0ba469d767",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "fc512700f1413fed652dac22fa1c4e837210b9c0",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "251b44b424920df9204e88a81fb3f78fa48ddd99",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
},
{
"lessThan": "18d80c77b4c7dd20699e81cedfbbff4e9d198f28",
"status": "affected",
"version": "84597a44a9d86ac949900441cea7da0af0f2f473",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix infinite loop on discard with large tag size\n\nWhen integrity_metadata handles a discard, it fills a buffer with\nDISCARD_FILLER and writes it over the tags, max_blocks blocks at a\ntime. If the kmalloc fails, the buffer is the on-stack array\nchecksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the\ntag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size\nis never decremented and the loop never terminates.\n\nFix this by using sizeof(checksums_onstack) as max_size. The array has\nMAX_TAG_SIZE bytes since commit b93b6643e9b5 (\"dm integrity: fix a\ncrash with unusually large tag size\"), so max_blocks is at least 1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:08.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f41a224b3c9d66c7b59afc7cae02a8b214f3c684"
},
{
"url": "https://git.kernel.org/stable/c/c66f5c6ccfa832d28b44a66c01e3468c246adac4"
},
{
"url": "https://git.kernel.org/stable/c/41a18e6c6e2c4a912494a035c17ecfe79c68b9e6"
},
{
"url": "https://git.kernel.org/stable/c/bbc154a7da4e075aef720ef051aff6094400eb66"
},
{
"url": "https://git.kernel.org/stable/c/c4cba6670fa199415689f67108e96b0ba469d767"
},
{
"url": "https://git.kernel.org/stable/c/fc512700f1413fed652dac22fa1c4e837210b9c0"
},
{
"url": "https://git.kernel.org/stable/c/251b44b424920df9204e88a81fb3f78fa48ddd99"
},
{
"url": "https://git.kernel.org/stable/c/18d80c77b4c7dd20699e81cedfbbff4e9d198f28"
}
],
"title": "dm-integrity: fix infinite loop on discard with large tag size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99135",
"datePublished": "2026-10-28T10:34:47.902Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:08.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98916 (GCVE-0-2026-98916)
Vulnerability from cvelistv5
Published
2026-10-23 11:55
Modified
2026-10-26 06:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: check link is beaconing for color change
When trying to do a color change, validate that the link is
beaconing first, to avoid calling the driver with an invalid
link.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51423d370739aa3f701fdfbfcc52ecf321dfd71a",
"status": "affected",
"version": "b4b9f0a32d3106ba4d0bbd07312dc35d1f2152dc",
"versionType": "git"
},
{
"lessThan": "dc4713539da73d2d2c03d064b22b0e6ab38bd361",
"status": "affected",
"version": "b4b9f0a32d3106ba4d0bbd07312dc35d1f2152dc",
"versionType": "git"
},
{
"lessThan": "e50965c702cfd41eb83464565f6272d4d4bfc00c",
"status": "affected",
"version": "b4b9f0a32d3106ba4d0bbd07312dc35d1f2152dc",
"versionType": "git"
},
{
"lessThan": "55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4",
"status": "affected",
"version": "b4b9f0a32d3106ba4d0bbd07312dc35d1f2152dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: check link is beaconing for color change\n\nWhen trying to do a color change, validate that the link is\nbeaconing first, to avoid calling the driver with an invalid\nlink."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T06:56:47.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51423d370739aa3f701fdfbfcc52ecf321dfd71a"
},
{
"url": "https://git.kernel.org/stable/c/dc4713539da73d2d2c03d064b22b0e6ab38bd361"
},
{
"url": "https://git.kernel.org/stable/c/e50965c702cfd41eb83464565f6272d4d4bfc00c"
},
{
"url": "https://git.kernel.org/stable/c/55308cee9c2196f39cd1ce8ee6c1fed9e12a00d4"
}
],
"title": "wifi: nl80211: check link is beaconing for color change",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98916",
"datePublished": "2026-10-23T11:55:20.958Z",
"dateReserved": "2026-09-25T10:25:14.380Z",
"dateUpdated": "2026-10-26T06:56:47.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99143 (GCVE-0-2026-99143)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Keep the predicate limit separate from program capacity
predicate_parse() adds two to nr_preds to reserve the terminal TRUE
and FALSE entries. It also uses that increased value as the limit for
parsed predicates. If the initial count is smaller than the number
actually parsed, the program can fill the allocation and subsequent
accesses can go past its end.
Keep nr_preds as the predicate limit and use a separate value for the
allocation size. This leaves space for both terminal entries and a
zeroed entry when parsing stops at the limit.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4fcbae8b27350565026807e77c96541d9e7a349",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "37049f8c56d377e46a8ef1ff93178a39a68a9c9c",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "2058a1fe791bb30fd6e4875a7ada3237076c8541",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "68ecc9510bb82dd78585c02bd5357f34ee16b153",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
},
{
"lessThan": "803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445",
"status": "affected",
"version": "39f7c41c908bc82947ce47cdd021520ff486c53f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Keep the predicate limit separate from program capacity\n\npredicate_parse() adds two to nr_preds to reserve the terminal TRUE\nand FALSE entries. It also uses that increased value as the limit for\nparsed predicates. If the initial count is smaller than the number\nactually parsed, the program can fill the allocation and subsequent\naccesses can go past its end.\n\nKeep nr_preds as the predicate limit and use a separate value for the\nallocation size. This leaves space for both terminal entries and a\nzeroed entry when parsing stops at the limit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker supplies the expression through ioctl(PERF_EVENT_IOC_SET_FILTER) on a local PERF_TYPE_TRACEPOINT fd; perf_event_set_filter() calls ftrace_profile_set_filter(), create_filter(), process_preds(), and the patched predicate_parse(). No network protocol carries the input.\nAC:L - parse_pred() accepts CPUS{0\\n\u0027} because cpulist_parse() stops at the newline, while calc_stack() treats the quote as hiding later predicates; two such operands deterministically make predicate_parse() append TRUE/FALSE out of bounds. No race or external state is needed.\nPR:L - With sample_type=0, exclude_kernel=1, and a self target, sys_perf_event_open() creates a tracepoint counting fd without capabilities because perf_trace_event_perm() returns for the non-RAW event before perf_allow_tracepoint(). The fd owner can invoke SET_FILTER.\nUI:N - The same unprivileged process opens its own perf event and submits the crafted filter; no action by another user or administrator is required.\nS:U - predicate_parse() corrupts heap memory inside the same host kernel that enforces perf access; resulting local kernel privilege escalation does not cross a VM, IOMMU, or other security authority.\nC:H - prog[N] and prog[N+1] are accessed beyond the allocated array, and the limit error path can pass an out-of-range pred pointer to free_predicate(). On affected merged-kmalloc deployments, grooming pointer-bearing neighboring objects makes kernel-memory disclosure possible.\nI:H - The terminal target and pred stores overwrite adjacent heap words with 1 and NULL; on merged kmalloc caches an attacker can groom victim objects, allowing the out-of-bounds write to corrupt kernel control or security state and support privilege escalation.\nA:H - The out-of-bounds terminal stores or error-path processing of an adjacent pred pointer can cause invalid dereferences, invalid frees, and a kernel oops or panic; the attacker can repeat SET_FILTER submissions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:49.775Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4fcbae8b27350565026807e77c96541d9e7a349"
},
{
"url": "https://git.kernel.org/stable/c/37049f8c56d377e46a8ef1ff93178a39a68a9c9c"
},
{
"url": "https://git.kernel.org/stable/c/2058a1fe791bb30fd6e4875a7ada3237076c8541"
},
{
"url": "https://git.kernel.org/stable/c/68ecc9510bb82dd78585c02bd5357f34ee16b153"
},
{
"url": "https://git.kernel.org/stable/c/803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445"
}
],
"title": "tracing: Keep the predicate limit separate from program capacity",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99143",
"datePublished": "2026-10-28T10:34:54.527Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-31T12:43:49.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53292 (GCVE-0-2026-53292)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
syzbot reported a kernel BUG triggered from pn_socket_sendmsg() via
pn_socket_autobind():
kernel BUG at net/phonet/socket.c:213!
RIP: 0010:pn_socket_autobind net/phonet/socket.c:213 [inline]
RIP: 0010:pn_socket_sendmsg+0x240/0x250 net/phonet/socket.c:421
Call Trace:
sock_sendmsg_nosec+0x112/0x150 net/socket.c:797
__sock_sendmsg net/socket.c:812 [inline]
__sys_sendto+0x402/0x590 net/socket.c:2280
...
pn_socket_autobind() calls pn_socket_bind() with port 0 and, on
-EINVAL, assumes the socket was already bound and asserts that the
port is non-zero:
err = pn_socket_bind(sock, ..., sizeof(struct sockaddr_pn));
if (err != -EINVAL)
return err;
BUG_ON(!pn_port(pn_sk(sock->sk)->sobject));
return 0; /* socket was already bound */
However pn_socket_bind() also returns -EINVAL when sk->sk_state is not
TCP_CLOSE, even when the socket has never been bound and pn_port() is
still 0. In that case the BUG_ON() fires and panics the kernel from a
user-triggerable path.
Treat the "bind returned -EINVAL but pn_port() is still 0" case as a
regular error and propagate -EINVAL to the caller instead of crashing.
Existing callers already translate a non-zero return from
pn_socket_autobind() into -ENOBUFS/-EAGAIN, so returning -EINVAL here
only changes behaviour from panic to a normal errno.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ba113a94b7503ee23ffe819e7045134b0c1d31de Version: ba113a94b7503ee23ffe819e7045134b0c1d31de Version: ba113a94b7503ee23ffe819e7045134b0c1d31de Version: ba113a94b7503ee23ffe819e7045134b0c1d31de Version: ba113a94b7503ee23ffe819e7045134b0c1d31de Version: ba113a94b7503ee23ffe819e7045134b0c1d31de |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/phonet/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6972021488e3142f30a89d8035eebeefbbe65656",
"status": "affected",
"version": "ba113a94b7503ee23ffe819e7045134b0c1d31de",
"versionType": "git"
},
{
"lessThan": "4255c8f756b78d07800baf3320bdbdc130c54193",
"status": "affected",
"version": "ba113a94b7503ee23ffe819e7045134b0c1d31de",
"versionType": "git"
},
{
"lessThan": "363c7fcac553dc2aa12fc90c6e5e6eba87500269",
"status": "affected",
"version": "ba113a94b7503ee23ffe819e7045134b0c1d31de",
"versionType": "git"
},
{
"lessThan": "5459933a799aaf642cbeb35fdf7e78c59bf2fb9b",
"status": "affected",
"version": "ba113a94b7503ee23ffe819e7045134b0c1d31de",
"versionType": "git"
},
{
"lessThan": "6db58ee730bf434d1afca91b91826e26688856ed",
"status": "affected",
"version": "ba113a94b7503ee23ffe819e7045134b0c1d31de",
"versionType": "git"
},
{
"lessThan": "5b0c911bcdbd982f7748d11c0b39ec5808eae2de",
"status": "affected",
"version": "ba113a94b7503ee23ffe819e7045134b0c1d31de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/phonet/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind\n\nsyzbot reported a kernel BUG triggered from pn_socket_sendmsg() via\npn_socket_autobind():\n\n kernel BUG at net/phonet/socket.c:213!\n RIP: 0010:pn_socket_autobind net/phonet/socket.c:213 [inline]\n RIP: 0010:pn_socket_sendmsg+0x240/0x250 net/phonet/socket.c:421\n Call Trace:\n sock_sendmsg_nosec+0x112/0x150 net/socket.c:797\n __sock_sendmsg net/socket.c:812 [inline]\n __sys_sendto+0x402/0x590 net/socket.c:2280\n ...\n\npn_socket_autobind() calls pn_socket_bind() with port 0 and, on\n-EINVAL, assumes the socket was already bound and asserts that the\nport is non-zero:\n\n err = pn_socket_bind(sock, ..., sizeof(struct sockaddr_pn));\n if (err != -EINVAL)\n return err;\n BUG_ON(!pn_port(pn_sk(sock-\u003esk)-\u003esobject));\n return 0; /* socket was already bound */\n\nHowever pn_socket_bind() also returns -EINVAL when sk-\u003esk_state is not\nTCP_CLOSE, even when the socket has never been bound and pn_port() is\nstill 0. In that case the BUG_ON() fires and panics the kernel from a\nuser-triggerable path.\n\nTreat the \"bind returned -EINVAL but pn_port() is still 0\" case as a\nregular error and propagate -EINVAL to the caller instead of crashing.\nExisting callers already translate a non-zero return from\npn_socket_autobind() into -ENOBUFS/-EAGAIN, so returning -EINVAL here\nonly changes behaviour from panic to a normal errno."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:55.765Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6972021488e3142f30a89d8035eebeefbbe65656"
},
{
"url": "https://git.kernel.org/stable/c/4255c8f756b78d07800baf3320bdbdc130c54193"
},
{
"url": "https://git.kernel.org/stable/c/363c7fcac553dc2aa12fc90c6e5e6eba87500269"
},
{
"url": "https://git.kernel.org/stable/c/5459933a799aaf642cbeb35fdf7e78c59bf2fb9b"
},
{
"url": "https://git.kernel.org/stable/c/6db58ee730bf434d1afca91b91826e26688856ed"
},
{
"url": "https://git.kernel.org/stable/c/5b0c911bcdbd982f7748d11c0b39ec5808eae2de"
}
],
"title": "net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53292",
"datePublished": "2026-06-26T19:40:51.470Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-10-30T12:26:55.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74407 (GCVE-0-2026-74407)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: cancel SSR work items during PCI shutdown
A reboot can crash the kernel if it overlaps with WLAN firmware crash
recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown
path while freeing DMA-backed MHI contexts.
Simplified trace:
dma_free_attrs
mhi_deinit_dev_ctxt [mhi]
ath11k_pci_power_down [ath11k_pci]
ath11k_pci_shutdown [ath11k_pci]
device_shutdown
kernel_restart
On the host side, SSR is driven by the MHI RDDM callback, which queues
reset_work to perform device recovery. reset_work power-cycles the device
by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The
power-down phase deinitializes MHI and frees DMA resources.
Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR
recovery flow. As a result, the shutdown path
(ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR
recovery sequence.
Fix this by canceling SSR-related work items during PCI shutdown, marking
the device as unregistering, and serializing the RDDM callback path that
checks and queues reset_work. This ensures that no new SSR recovery work
can be queued once teardown has started, and that any in-flight recovery
work is fully synchronized before device power-down, preventing MHI
teardown and DMA resource freeing from running more than once.
Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k
devices do not queue reset_work in normal SSR flows.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 13da397f884d9c9a3fb6616206eeb6c6ab097287 Version: 13da397f884d9c9a3fb6616206eeb6c6ab097287 Version: 13da397f884d9c9a3fb6616206eeb6c6ab097287 Version: 13da397f884d9c9a3fb6616206eeb6c6ab097287 Version: 13da397f884d9c9a3fb6616206eeb6c6ab097287 Version: 13da397f884d9c9a3fb6616206eeb6c6ab097287 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:54.888138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:43.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/mhi.c",
"drivers/net/wireless/ath/ath11k/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7630eb217166435e8a6dd501fa4ad304e2264407",
"status": "affected",
"version": "13da397f884d9c9a3fb6616206eeb6c6ab097287",
"versionType": "git"
},
{
"lessThan": "f82d42577ee4a191b0ad0f0a3b49fc1935dff845",
"status": "affected",
"version": "13da397f884d9c9a3fb6616206eeb6c6ab097287",
"versionType": "git"
},
{
"lessThan": "daeb44fb8d700654f37f54d1ee36cd67645d0d34",
"status": "affected",
"version": "13da397f884d9c9a3fb6616206eeb6c6ab097287",
"versionType": "git"
},
{
"lessThan": "6dd3701facc0cee62d6682e49eed64499f9d0e43",
"status": "affected",
"version": "13da397f884d9c9a3fb6616206eeb6c6ab097287",
"versionType": "git"
},
{
"lessThan": "53dd29e8aeb2a1b5f079178551836b85fc6b53df",
"status": "affected",
"version": "13da397f884d9c9a3fb6616206eeb6c6ab097287",
"versionType": "git"
},
{
"lessThan": "8c79aac429b583301f387374ff37c59be671df87",
"status": "affected",
"version": "13da397f884d9c9a3fb6616206eeb6c6ab097287",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/mhi.c",
"drivers/net/wireless/ath/ath11k/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cancel SSR work items during PCI shutdown\n\nA reboot can crash the kernel if it overlaps with WLAN firmware crash\nrecovery (SSR). The crash is a NULL pointer dereference in the MHI teardown\npath while freeing DMA-backed MHI contexts.\n\nSimplified trace:\n dma_free_attrs\n mhi_deinit_dev_ctxt [mhi]\n ath11k_pci_power_down [ath11k_pci]\n ath11k_pci_shutdown [ath11k_pci]\n device_shutdown\n kernel_restart\n\nOn the host side, SSR is driven by the MHI RDDM callback, which queues\nreset_work to perform device recovery. reset_work power-cycles the device\nby calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The\npower-down phase deinitializes MHI and frees DMA resources.\n\nShutdown/reboot runs fully asynchronously with this RDDM-driven SSR\nrecovery flow. As a result, the shutdown path\n(ath11k_pci_shutdown() -\u003e ath11k_pci_power_down()) can race with the SSR\nrecovery sequence.\n\nFix this by canceling SSR-related work items during PCI shutdown, marking\nthe device as unregistering, and serializing the RDDM callback path that\nchecks and queues reset_work. This ensures that no new SSR recovery work\ncan be queued once teardown has started, and that any in-flight recovery\nwork is fully synchronized before device power-down, preventing MHI\nteardown and DMA resource freeing from running more than once.\n\nNote: This issue only affects PCI/MHI-based devices. AHB-based ath11k\ndevices do not queue reset_work in normal SSR flows.\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - WiFi ath11k PCI/MHI devices (QCA6390/WCN6855 laptops, workstations, gateways) enter SSR when WLAN firmware faults; MHI RDDM interrupts queue reset_work recovery that races kernel_restart PCI shutdown (ath11k_pci_shutdown) on the same driver.\nAC:L - An adjacent attacker controls SSR timing by repeatedly inducing firmware crashes via crafted/malicious 802.11 traffic, keeping reset_work active until shutdown overlaps; this is an attacker-driven race, not luck-dependent memory layout or rare kernel config.\nPR:N - No Linux account or kernel capability is needed to trigger the SSR leg\u2014firmware crash/RDDM recovery is driven by over-the-air WLAN events; concurrent device_shutdown during automated maintenance or fleet reboots can overlap without attacker CAP_SYS_BOOT.\nUI:N - Only an active ath11k WLAN interface is required (default on WiFi-equipped systems); no victim clicks, network joins, or manual reboot actions are needed because unattended updates and scheduled maintenance reboots can overlap SSR automatically.\nS:U - Impact is kernel panic/oops from unsynchronized MHI DMA teardown within the host kernel security boundary; this does not cross VM, container, or IOMMU trust domains.\nC:H - Concurrent mhi_unprepare_after_power_down/mhi_deinit_dev_ctxt from reset_work and ath11k_pci_shutdown can double-free coherent DMA rings/contexts or dereference freed MHI state, enabling arbitrary kernel memory reads and information disclosure.\nI:H - Racing power-down paths free the same MHI DMA-backed ring/context memory twice, corrupting kernel DMA allocator metadata and enabling controlled reallocation for arbitrary kernel writes, control-flow hijack, and privilege escalation.\nA:H - NULL pointer dereference and/or double dma_free in mhi_deinit_dev_ctxt during PCI shutdown overlapping SSR reliably causes kernel oops/panic, denying availability and potentially aborting reboot on affected Qualcomm ath11k PCI systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:00.729Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7630eb217166435e8a6dd501fa4ad304e2264407"
},
{
"url": "https://git.kernel.org/stable/c/f82d42577ee4a191b0ad0f0a3b49fc1935dff845"
},
{
"url": "https://git.kernel.org/stable/c/daeb44fb8d700654f37f54d1ee36cd67645d0d34"
},
{
"url": "https://git.kernel.org/stable/c/6dd3701facc0cee62d6682e49eed64499f9d0e43"
},
{
"url": "https://git.kernel.org/stable/c/53dd29e8aeb2a1b5f079178551836b85fc6b53df"
},
{
"url": "https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"
}
],
"title": "wifi: ath11k: cancel SSR work items during PCI shutdown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74407",
"datePublished": "2026-08-15T05:59:16.044Z",
"dateReserved": "2026-08-15T05:44:03.892Z",
"dateUpdated": "2026-10-30T12:30:00.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71074 (GCVE-0-2025-71074)
Vulnerability from cvelistv5
Published
2026-01-13 15:31
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
functionfs: fix the open/removal races
ffs_epfile_open() can race with removal, ending up with file->private_data
pointing to freed object.
There is a total count of opened files on functionfs (both ep0 and
dynamic ones) and when it hits zero, dynamic files get removed.
Unfortunately, that removal can happen while another thread is
in ffs_epfile_open(), but has not incremented the count yet.
In that case open will succeed, leaving us with UAF on any subsequent
read() or write().
The root cause is that ffs->opened is misused; atomic_dec_and_test() vs.
atomic_add_return() is not a good idea, when object remains visible all
along.
To untangle that
* serialize openers on ffs->mutex (both for ep0 and for dynamic files)
* have dynamic ones use atomic_inc_not_zero() and fail if we had
zero ->opened; in that case the file we are opening is doomed.
* have the inodes of dynamic files marked on removal (from the
callback of simple_recursive_removal()) - clear ->i_private there.
* have open of dynamic ones verify they hadn't been already removed,
along with checking that state is FFS_ACTIVE.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e002b3c1e6a0faa53329ef0d21e6351bcece6edb",
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"versionType": "git"
},
{
"lessThan": "585a656283c954337036422afcd9cb70dd4135e7",
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"versionType": "git"
},
{
"lessThan": "75240e5e51c6e6d67a3039384125fa54259a3926",
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"versionType": "git"
},
{
"lessThan": "e5bf5ee266633cb18fff6f98f0b7d59a62819eee",
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfunctionfs: fix the open/removal races\n\nffs_epfile_open() can race with removal, ending up with file-\u003eprivate_data\npointing to freed object.\n\nThere is a total count of opened files on functionfs (both ep0 and\ndynamic ones) and when it hits zero, dynamic files get removed.\nUnfortunately, that removal can happen while another thread is\nin ffs_epfile_open(), but has not incremented the count yet.\nIn that case open will succeed, leaving us with UAF on any subsequent\nread() or write().\n\nThe root cause is that ffs-\u003eopened is misused; atomic_dec_and_test() vs.\natomic_add_return() is not a good idea, when object remains visible all\nalong.\n\nTo untangle that\n\t* serialize openers on ffs-\u003emutex (both for ep0 and for dynamic files)\n\t* have dynamic ones use atomic_inc_not_zero() and fail if we had\nzero -\u003eopened; in that case the file we are opening is doomed.\n\t* have the inodes of dynamic files marked on removal (from the\ncallback of simple_recursive_removal()) - clear -\u003ei_private there.\n\t* have open of dynamic ones verify they hadn\u0027t been already removed,\nalong with checking that state is FFS_ACTIVE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The race is reached through local open, close, read, write, or ioctl operations on FunctionFS endpoint files. A USB host cannot directly invoke ffs_epfile_open(), so this is local rather than physical or network access.\nAC:L - The attacker can race opening a dynamic endpoint against closing the sole remaining ep0 descriptor and repeat the attempt with controlled threads. Both race sides and the freed allocation\u0027s endpoint-controlled size are attacker-controlled.\nPR:L - Mounting FunctionFS requires CAP_SYS_ADMIN in the initial user namespace, but endpoint opening has no capability check and uid/gid/fmode options permit delegation to non-root service accounts, as in [AOSP FunctionFS mounts](https://android.googlesource.com/device/google/gs201/%2B/587 5d29f/conf/init.gs201.usb.rc). A low-privileged local account with delegated endpoint access can therefore trigger the race.\nUI:N - The attacker independently performs endpoint configuration, concurrent open and close operations, and subsequent use of the stale descriptor without victim interaction.\nS:U - Exploitation corrupts memory within the kernel\u0027s existing security authority and constitutes ordinary local kernel compromise rather than crossing a VM or IOMMU boundary.\nC:H - The attacker-sized heap object contains numerous pointers and can be reclaimed before stale read, ioctl, or release operations, making kernel-memory disclosure through the UAF defensible.\nI:H - The stale object reaches mutex and list operations, atomic modification, xchg and kfree operations, and USB request handling, providing plausible arbitrary-write, arbitrary-free, and control-flow-hijacking primitives.\nA:H - Dereferencing the freed object, locking reclaimed mutexes, freeing attacker-influenced pointers, or triggering warnings under panic-on-warn can crash or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:24.377Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e002b3c1e6a0faa53329ef0d21e6351bcece6edb"
},
{
"url": "https://git.kernel.org/stable/c/585a656283c954337036422afcd9cb70dd4135e7"
},
{
"url": "https://git.kernel.org/stable/c/75240e5e51c6e6d67a3039384125fa54259a3926"
},
{
"url": "https://git.kernel.org/stable/c/e5bf5ee266633cb18fff6f98f0b7d59a62819eee"
}
],
"title": "functionfs: fix the open/removal races",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71074",
"datePublished": "2026-01-13T15:31:27.413Z",
"dateReserved": "2026-01-13T15:30:19.647Z",
"dateUpdated": "2026-10-30T12:23:24.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43234 (GCVE-0-2026-43234)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
team: avoid NETDEV_CHANGEMTU event when unregistering slave
syzbot is reporting
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
__netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
netdev_hold include/linux/netdevice.h:4429 [inline]
inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
team_del_slave drivers/net/team/team_core.c:1936 [inline]
team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
problem. Ido Schimmel found steps to reproduce
ip link add name team1 type team
ip link add name dummy1 mtu 1499 master team1 type dummy
ip netns add ns1
ip link set dev dummy1 netns ns1
ip -n ns1 link del dev dummy1
and also found that the same issue was fixed in the bond driver in
commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when
unregistering slave").
Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net:
hold netdev instance lock during sysfs operations") and commit 303a8487a657
("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 Version: 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43234",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:30:55.620925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:36.650Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9372774650ec960929cc2817bc5139a44a9a00db",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "1cf0ef73991880dd89aa1feaf547ab13e4767b85",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "dde2fa2a658802d0ff03cd4a0e7d4a5459ef18de",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "bce42728ac4887060a24a585c5122fbd24939db7",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "5268892de70f0b29bde341db863b234aa9259c08",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "bb4c698633c0e19717586a6524a33196cff01a32",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: avoid NETDEV_CHANGEMTU event when unregistering slave\n\nsyzbot is reporting\n\n unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3\n ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at\n __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]\n netdev_hold include/linux/netdevice.h:4429 [inline]\n inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286\n inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600\n notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85\n call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]\n netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886\n netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907\n dev_set_mtu+0x126/0x260 net/core/dev_api.c:248\n team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333\n team_del_slave drivers/net/team/team_core.c:1936 [inline]\n team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929\n notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85\n call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]\n call_netdevice_notifiers net/core/dev.c:2295 [inline]\n __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592\n do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060\n rtnl_changelink net/core/rtnetlink.c:3776 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3935 [inline]\n rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072\n rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958\n netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894\n\nproblem. Ido Schimmel found steps to reproduce\n\n ip link add name team1 type team\n ip link add name dummy1 mtu 1499 master team1 type dummy\n ip netns add ns1\n ip link set dev dummy1 netns ns1\n ip -n ns1 link del dev dummy1\n\nand also found that the same issue was fixed in the bond driver in\ncommit f51048c3e07b (\"bonding: avoid NETDEV_CHANGEMTU event when\nunregistering slave\").\n\nLet\u0027s do similar thing for the team driver, with commit ad7c7b2172c3 (\"net:\nhold netdev instance lock during sysfs operations\") and commit 303a8487a657\n(\"net: s/__dev_set_mtu/__netif_set_mtu/\") also applied."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:13.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9372774650ec960929cc2817bc5139a44a9a00db"
},
{
"url": "https://git.kernel.org/stable/c/1cf0ef73991880dd89aa1feaf547ab13e4767b85"
},
{
"url": "https://git.kernel.org/stable/c/dde2fa2a658802d0ff03cd4a0e7d4a5459ef18de"
},
{
"url": "https://git.kernel.org/stable/c/bce42728ac4887060a24a585c5122fbd24939db7"
},
{
"url": "https://git.kernel.org/stable/c/5268892de70f0b29bde341db863b234aa9259c08"
},
{
"url": "https://git.kernel.org/stable/c/bb4c698633c0e19717586a6524a33196cff01a32"
}
],
"title": "team: avoid NETDEV_CHANGEMTU event when unregistering slave",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43234",
"datePublished": "2026-05-06T11:28:30.212Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-11-06T15:32:36.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90162 (GCVE-0-2026-90162)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer publishing granted locks to prevent UAF/double-free race
In smb2_lock(), mid-batch granted locks are published to connection-wide
(conn->lock_list) and file-wide (fp->lock_list) lists immediately upon
vfs_lock_file() success, while also remaining tracked on the stack-local
rollback_list.
If a subsequent element in the same SMB2_LOCK request array fails
validation or execution, the thread jumps to out: and walks
rollback_list to undo previously granted locks. However, because the
granted lock was already published to conn->lock_list, a concurrent
UNLOCK request on the same connection can find the lock object and
kfree() it before the rollback loop executes.
When the granting thread subsequently walks rollback_list, it
dereferences and frees the already-freed ksmbd_lock structure, resulting
in a Use-After-Free and Double-Free (on both ksmbd_lock and struct
file_lock).
Fix this by deferring the publication of granted locks to
conn->lock_list and fp->lock_list until after the entire array of lock
elements has been processed without error. Mid-batch grants remain
tracked exclusively on the request-local rollback_list until the whole
batch succeeds, eliminating the race window.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1371a140722c1d6868f9acf69d601de7d4142bf",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "b68d4bb6b03a667c305626bd2c242fd162bac17e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "65f54ed0289e9a57e6c60b14347ccea4c318f1fc",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "ff6870cf3b7eccc69d03cbb6f23e3995d96e9a8d",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "a1d26dfb32919088e3638dca01068df3c4507433",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "29f74f0f2e6df3b393b7b66e810136d0c64e3c59",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer publishing granted locks to prevent UAF/double-free race\n\nIn smb2_lock(), mid-batch granted locks are published to connection-wide\n(conn-\u003elock_list) and file-wide (fp-\u003elock_list) lists immediately upon\nvfs_lock_file() success, while also remaining tracked on the stack-local\nrollback_list.\n\nIf a subsequent element in the same SMB2_LOCK request array fails\nvalidation or execution, the thread jumps to out: and walks\nrollback_list to undo previously granted locks. However, because the\ngranted lock was already published to conn-\u003elock_list, a concurrent\nUNLOCK request on the same connection can find the lock object and\nkfree() it before the rollback loop executes.\n\nWhen the granting thread subsequently walks rollback_list, it\ndereferences and frees the already-freed ksmbd_lock structure, resulting\nin a Use-After-Free and Double-Free (on both ksmbd_lock and struct\nfile_lock).\n\nFix this by deferring the publication of granted locks to\nconn-\u003elock_list and fp-\u003elock_list until after the entire array of lock\nelements has been processed without error. Mid-batch grants remain\ntracked exclusively on the request-local rollback_list until the whole\nbatch succeeds, eliminating the race window."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The attacker-controlled data is the SMB2 LOCK request (struct smb2_lock_req lock elements: Offset, Length, Flags) received on TCP/445 by ksmbd_conn_handler_loop(), queued with queue_ksmbd_work(), and dispatched to smb2_lock() via conn-\u003ecmds[SMB2_LOCK_HE]; the racing free is a second SMB2 LOCK with SMB2_LOCKFLAG_UNLOCK on the same FID.\nAC:L - The attacker drives both sides: smb2_lock() publishes a granted ksmbd_lock onto conn-\u003elock_list after vfs_lock_file() succeeds for lock element 0, then a later element in the same LockCount\u003e1 array fails (cmd\u003c0, missing SMB2_LOCKFLAG_MASK, or overlap) and walks rollback_list, while a concurrent SMB2 LOCK UNLOCK on ksmbd-io (WQ_PERCPU) kfree()s that object; the race is retryable.\nPR:L - SMB2_LOCK is not in the smb2_check_user_session() pre-auth skip list (only NEGOTIATE/SESSION_SETUP/ECHO); it requires SMB2_SESSION_VALID, smb2_get_ksmbd_tcon() for a tree id, and ksmbd_lookup_fd_slow() after smb2_open(). An ordinary authenticated share user suffices; this is not a pre-auth handshake.\nUI:N - The attacker completes SESSION_SETUP, TREE_CONNECT and CREATE on their own ksmbd TCP connection, then sends the multi-element SMB2 LOCK and concurrent UNLOCK; no victim mount, click, or administrator action is required.\nS:U - The UAF and double-free of ksmbd_lock and struct file_lock occur in the ksmbd-io worker on the host that accepted the SMB session and do not cross a VM, guest-to-host, or IOMMU/DMA boundary.\nC:H - UNLOCK\u0027s kfree(cmp_lock) leaves rollback reading smb_lock-\u003estart, smb_lock-\u003eend, smb_lock-\u003econn and smb_lock-\u003efl from a freed ksmbd_lock; reclaiming that slab or the associated file_lock_cache object with attacker-controlled contents yields an arbitrary kernel read.\nI:H - The same rollback path list_del()s smb_lock-\u003eflist and smb_lock-\u003eclist on the freed object, then locks_free_lock(smb_lock-\u003efl) and kfree(smb_lock) after UNLOCK already freed both, giving a double-free and list_del write primitive for heap corruption and control-flow hijack.\nA:H - Dereferencing the freed ksmbd_lock (including spin_lock on smb_lock-\u003econn-\u003ellist_lock) and double-freeing ksmbd_lock/file_lock oops or panic the ksmbd-io worker; the LOCK/UNLOCK pair can be repeated to crash the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:31.271Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1371a140722c1d6868f9acf69d601de7d4142bf"
},
{
"url": "https://git.kernel.org/stable/c/b68d4bb6b03a667c305626bd2c242fd162bac17e"
},
{
"url": "https://git.kernel.org/stable/c/65f54ed0289e9a57e6c60b14347ccea4c318f1fc"
},
{
"url": "https://git.kernel.org/stable/c/ff6870cf3b7eccc69d03cbb6f23e3995d96e9a8d"
},
{
"url": "https://git.kernel.org/stable/c/a1d26dfb32919088e3638dca01068df3c4507433"
},
{
"url": "https://git.kernel.org/stable/c/29f74f0f2e6df3b393b7b66e810136d0c64e3c59"
}
],
"title": "ksmbd: defer publishing granted locks to prevent UAF/double-free race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90162",
"datePublished": "2026-09-17T16:06:53.136Z",
"dateReserved": "2026-09-11T19:38:34.790Z",
"dateUpdated": "2026-10-30T12:34:31.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97503 (GCVE-0-2026-97503)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
/proc/irq/<n>/ directory names are built in `char name[10]` buffers
with `sprintf(name, "%u", irq)`.
Ten-digit IRQ numbers already need 11 bytes including the trailing NUL, and
current sparse-IRQ configurations allow interrupt numbers in that range.
Size the temporary name buffer for the current decimal form and switch
to bounded formatting when creating or removing the proc entry.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/irq/proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a8adf64fe7fd5d7c476769a043ee56eda7b775ce",
"status": "affected",
"version": "721255b9826bd11c7a38b585905fc2dd0fb94e52",
"versionType": "git"
},
{
"lessThan": "488bcd7fd3e9a2ad647b71b505a269fdb28753c4",
"status": "affected",
"version": "721255b9826bd11c7a38b585905fc2dd0fb94e52",
"versionType": "git"
},
{
"lessThan": "d4b22fbae70037299e96539c330e4a1054b28a91",
"status": "affected",
"version": "721255b9826bd11c7a38b585905fc2dd0fb94e52",
"versionType": "git"
},
{
"lessThan": "c2c7983c93f5d86962318be7e7298f1bc3feb1a6",
"status": "affected",
"version": "721255b9826bd11c7a38b585905fc2dd0fb94e52",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/irq/proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/proc: Size interrupt directory names for 10-digit interrupt numbers\n\n/proc/irq/\u003cn\u003e/ directory names are built in `char name[10]` buffers\nwith `sprintf(name, \"%u\", irq)`.\n\nTen-digit IRQ numbers already need 11 bytes including the trailing NUL, and\ncurrent sparse-IRQ configurations allow interrupt numbers in that range.\n\nSize the temporary name buffer for the current decimal form and switch\nto bounded formatting when creating or removing the proc entry."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:57.377Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a8adf64fe7fd5d7c476769a043ee56eda7b775ce"
},
{
"url": "https://git.kernel.org/stable/c/488bcd7fd3e9a2ad647b71b505a269fdb28753c4"
},
{
"url": "https://git.kernel.org/stable/c/d4b22fbae70037299e96539c330e4a1054b28a91"
},
{
"url": "https://git.kernel.org/stable/c/c2c7983c93f5d86962318be7e7298f1bc3feb1a6"
}
],
"title": "genirq/proc: Size interrupt directory names for 10-digit interrupt numbers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97503",
"datePublished": "2026-09-24T16:04:50.412Z",
"dateReserved": "2026-09-24T16:01:01.151Z",
"dateUpdated": "2026-10-21T12:52:57.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53368 (GCVE-0-2026-53368)
Vulnerability from cvelistv5
Published
2026-07-19 09:10
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion
with the checkpoint path, which can result in an incorrect inode block
marking state. The scenario is as follows:
create & write & fsync 'file A' write checkpoint
- f2fs_do_sync_file // inline inode
- f2fs_write_inode // inode folio is dirty
- f2fs_write_checkpoint
- f2fs_flush_merged_writes
- f2fs_sync_node_pages
- f2fs_fsync_node_pages // no dirty node
- f2fs_need_inode_block_update // return true
- f2fs_fsync_node_pages // inode dirtied
- f2fs_need_dentry_mark //return true
- f2fs_flush_nat_entries
- f2fs_write_checkpoint end
- __write_node_folio // inode with DENT_BIT_SHIFT set
SPO, "fsck --dry-run" find inode has already checkpointed but still
with DENT_BIT_SHIFT set
The state observed by f2fs_need_dentry_mark() can differ from the state
observed in __write_node_folio() after acquiring sbi->node_write. The
root cause is that the semantics of IS_CHECKPOINTED and
HAS_FSYNCED_INODE are only guaranteed after the checkpoint write has
fully completed.
This patch moves set_dentry_mark() into __write_node_folio() and
protects it with the sbi->node_write lock.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb1275802b482bc5854e434e212589fe253eab22",
"status": "affected",
"version": "88bd02c9472a166b706284a34a84f1243322d782",
"versionType": "git"
},
{
"lessThan": "270c519bca3a59b6140d176415aff16e4e06f9e3",
"status": "affected",
"version": "88bd02c9472a166b706284a34a84f1243322d782",
"versionType": "git"
},
{
"lessThan": "bedb710b63ae1bd617e65d0a8cf6cea1200b3753",
"status": "affected",
"version": "88bd02c9472a166b706284a34a84f1243322d782",
"versionType": "git"
},
{
"lessThan": "b28a83ea4934215b5de906c3ee4fbfbc651573e0",
"status": "affected",
"version": "88bd02c9472a166b706284a34a84f1243322d782",
"versionType": "git"
},
{
"lessThan": "019f9dda7f66e55eb94cd32e1d3fff5835f73fbc",
"status": "affected",
"version": "88bd02c9472a166b706284a34a84f1243322d782",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage\n\nf2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion\nwith the checkpoint path, which can result in an incorrect inode block\nmarking state. The scenario is as follows:\n\ncreate \u0026 write \u0026 fsync \u0027file A\u0027 write checkpoint\n- f2fs_do_sync_file // inline inode\n - f2fs_write_inode // inode folio is dirty\n - f2fs_write_checkpoint\n - f2fs_flush_merged_writes\n - f2fs_sync_node_pages\n - f2fs_fsync_node_pages // no dirty node\n - f2fs_need_inode_block_update // return true\n - f2fs_fsync_node_pages // inode dirtied\n - f2fs_need_dentry_mark //return true\n - f2fs_flush_nat_entries\n - f2fs_write_checkpoint end\n - __write_node_folio // inode with DENT_BIT_SHIFT set\n SPO, \"fsck --dry-run\" find inode has already checkpointed but still\n with DENT_BIT_SHIFT set\n\nThe state observed by f2fs_need_dentry_mark() can differ from the state\nobserved in __write_node_folio() after acquiring sbi-\u003enode_write. The\nroot cause is that the semantics of IS_CHECKPOINTED and\nHAS_FSYNCED_INODE are only guaranteed after the checkpoint write has\nfully completed.\n\nThis patch moves set_dentry_mark() into __write_node_folio() and\nprotects it with the sbi-\u003enode_write lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached via local filesystem syscalls (fsync/fdatasync on a writable file) on an F2FS mount. F2FS is primarily deployed on local flash storage (Android /data, ChromeOS, embedded), not as a network-facing attack surface.\nAC:L - An attacker controls both sides of the race by concurrently fsyncing an inline inode while triggering a checkpoint (e.g., via sync(2), heavy writeback, or background checkpoint/GC threads). No conditions outside attacker influence are required beyond routine concurrent I/O.\nPR:L - Exploitation requires only unprivileged write access to files on the F2FS filesystem plus the ability to issue fsync/sync syscalls. No CAP_SYS_ADMIN, mount privileges, or init-namespace root are needed.\nUI:N - No victim interaction is required; the attacker performs the write and fsync operations on files they can already modify.\nS:U - The impact is confined to F2FS on-disk metadata and recovery semantics within the same kernel/filesystem security boundary. There is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:N - The bug causes incorrect setting of the DENT_BIT_SHIFT recovery flag on a node block. It does not read kernel memory, leak pointers, or disclose data beyond what the attacker already wrote.\nI:H - The race writes incorrect dentry recovery metadata to disk (checkpointed inode still marked with DENT_BIT_SHIFT), producing fsck-detectable filesystem inconsistency and potentially breaking roll-forward recovery of fsynced data after sudden power-off.\nA:H - Corrupted recovery metadata can cause mount-time recovery failures (as seen in the related atomic-write variant returning -EINVAL from f2fs_recover_inode_page) and fsck-detected inconsistency after power loss, degrading filesystem availability on F2FS-backed systems such as Android devices."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:04.292Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb1275802b482bc5854e434e212589fe253eab22"
},
{
"url": "https://git.kernel.org/stable/c/270c519bca3a59b6140d176415aff16e4e06f9e3"
},
{
"url": "https://git.kernel.org/stable/c/bedb710b63ae1bd617e65d0a8cf6cea1200b3753"
},
{
"url": "https://git.kernel.org/stable/c/b28a83ea4934215b5de906c3ee4fbfbc651573e0"
},
{
"url": "https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"
}
],
"title": "f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53368",
"datePublished": "2026-07-19T09:10:29.573Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-10-30T12:27:04.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98047 (GCVE-0-2026-98047)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check ancestor frames for rbtree callbacks
bpf_rbtree_add() invokes its comparator while the caller holds the root
lock. The native insertion code retains raw parent and link pointers across
the callback, so the verifier prohibits unlocking, consuming tree nodes,
or changing RCU state from that callback.
in_rbtree_lock_required_cb() only checks the innermost verifier frame.
Static subprogram calls are permitted while holding a spin lock, and such a
call pushes a frame without in_callback_fn set. Consequently, all callback
restrictions disappear in the nested frame. The subprogram can unlock the
tree, remove and drop the node being compared, then relock. Native insertion
resumes with the stale parent pointer and links freed memory into the tree.
Walk all active frames for the rbtree callback instead. Benign static
subprograms remain permitted, while callback restrictions follow execution
into nested frames.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "252e9b476af723edd299a5c71c389ec018e46656",
"status": "affected",
"version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
"versionType": "git"
},
{
"lessThan": "b545fa447e09e6844868deb2bee228827fe54d15",
"status": "affected",
"version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
"versionType": "git"
},
{
"lessThan": "2410cb2ac0416dd2795a81984c8c73d7250bd8c4",
"status": "affected",
"version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
"versionType": "git"
},
{
"lessThan": "369f4ce734570bdfedaa4b5ca50e2a3f6a892728",
"status": "affected",
"version": "a44b1334aadd82203f661adb9adb41e53ad0e8d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check ancestor frames for rbtree callbacks\n\nbpf_rbtree_add() invokes its comparator while the caller holds the root\nlock. The native insertion code retains raw parent and link pointers across\nthe callback, so the verifier prohibits unlocking, consuming tree nodes,\nor changing RCU state from that callback.\n\nin_rbtree_lock_required_cb() only checks the innermost verifier frame.\nStatic subprogram calls are permitted while holding a spin lock, and such a\ncall pushes a frame without in_callback_fn set. Consequently, all callback\nrestrictions disappear in the nested frame. The subprogram can unlock the\ntree, remove and drop the node being compared, then relock. Native insertion\nresumes with the stale parent pointer and links freed memory into the tree.\n\nWalk all active frames for the rbtree callback instead. Benign static\nsubprograms remain permitted, while callback restrictions follow execution\ninto nested frames."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:13.942Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/252e9b476af723edd299a5c71c389ec018e46656"
},
{
"url": "https://git.kernel.org/stable/c/b545fa447e09e6844868deb2bee228827fe54d15"
},
{
"url": "https://git.kernel.org/stable/c/2410cb2ac0416dd2795a81984c8c73d7250bd8c4"
},
{
"url": "https://git.kernel.org/stable/c/369f4ce734570bdfedaa4b5ca50e2a3f6a892728"
}
],
"title": "bpf: Check ancestor frames for rbtree callbacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98047",
"datePublished": "2026-09-25T10:23:57.347Z",
"dateReserved": "2026-09-25T10:19:56.072Z",
"dateUpdated": "2026-10-21T12:54:13.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98067 (GCVE-0-2026-98067)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: disable LZ4 rolling decompression for now
LZ4 rolling decompression [1] was introduced to reduce the memory
footprint of temporary pages:
For many cases, it is needed for users to read small data within
a compressed extent (pcluster), either due to random small read, or
since uptodate folios (typically order-0) cannot be reused for
decompression again since decompression algorithm refills
already-uptodate folios.
Rolling decompression works because LZ4 is LZ77-based and only refers
to the most recent 64 KiB of decompressed data, so in theory only a
bounded rolling window of temporary pages is needed when decompressing.
It can save a lot of temporary memory, e.g.
601,960-byte data can be compressed into a 256k LZ4 compressed extent,
which means it needs 146 extra pages per request in the worst case if
rolling decompression is disabled.
However, the upstream LZ4 implementation is not under EROFS' control:
For example, the literal copy memmove() may still **copy long literals
backward** on x86 based on the address comparison even when the source
and destination ranges do not overlap (IOWs, inline decompression
doesn't need to be considered here). That breaks the rolling assumption
and makes the optimization broken.
Disable it for now to make sure the data correctness first since EROFS
is used everywhere now: The rolling window approach can be revived once
we either ensure that the official LZ4 code always copies forward for
non-overlapping ranges or maintain our own LZ4 implementation in EROFS.
The main impact is a higher runtime memory footprint; However, recent
commit 0f6273ab4637 ("erofs: add a reserved buffer pool for lz4
decompression") helps mitigate this when enabled but it's still not
perfect.
[1] https://www.usenix.org/conference/atc19/presentation/gao
§ 3.3 Decompression
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/decompressor.c",
"fs/erofs/internal.h",
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dcc5e6c9e4d06fe73fc61e730ee3e51dd115a4d8",
"status": "affected",
"version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
"versionType": "git"
},
{
"lessThan": "d923e53472b468a50a6cf41341531d5170c68371",
"status": "affected",
"version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
"versionType": "git"
},
{
"lessThan": "ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2",
"status": "affected",
"version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
"versionType": "git"
},
{
"lessThan": "c9a2db4b9950b59c571258e4bae74c271f62dd66",
"status": "affected",
"version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
"versionType": "git"
},
{
"lessThan": "82e664cf1219c459c33aae931b222cf951af9cb7",
"status": "affected",
"version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/decompressor.c",
"fs/erofs/internal.h",
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: disable LZ4 rolling decompression for now\n\nLZ4 rolling decompression [1] was introduced to reduce the memory\nfootprint of temporary pages:\n\n For many cases, it is needed for users to read small data within\n a compressed extent (pcluster), either due to random small read, or\n since uptodate folios (typically order-0) cannot be reused for\n decompression again since decompression algorithm refills\n already-uptodate folios.\n\nRolling decompression works because LZ4 is LZ77-based and only refers\nto the most recent 64 KiB of decompressed data, so in theory only a\nbounded rolling window of temporary pages is needed when decompressing.\n\nIt can save a lot of temporary memory, e.g.\n 601,960-byte data can be compressed into a 256k LZ4 compressed extent,\n which means it needs 146 extra pages per request in the worst case if\n rolling decompression is disabled.\n\nHowever, the upstream LZ4 implementation is not under EROFS\u0027 control:\nFor example, the literal copy memmove() may still **copy long literals\nbackward** on x86 based on the address comparison even when the source\nand destination ranges do not overlap (IOWs, inline decompression\ndoesn\u0027t need to be considered here). That breaks the rolling assumption\nand makes the optimization broken.\n\nDisable it for now to make sure the data correctness first since EROFS\nis used everywhere now: The rolling window approach can be revived once\nwe either ensure that the official LZ4 code always copies forward for\nnon-overlapping ranges or maintain our own LZ4 implementation in EROFS.\n\nThe main impact is a higher runtime memory footprint; However, recent\ncommit 0f6273ab4637 (\"erofs: add a reserved buffer pool for lz4\ndecompression\") helps mitigate this when enabled but it\u0027s still not\nperfect.\n\n[1] https://www.usenix.org/conference/atc19/presentation/gao\n \u00a7 3.3 Decompression"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:21.582Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dcc5e6c9e4d06fe73fc61e730ee3e51dd115a4d8"
},
{
"url": "https://git.kernel.org/stable/c/d923e53472b468a50a6cf41341531d5170c68371"
},
{
"url": "https://git.kernel.org/stable/c/ec52dfed7b14514ed97ee71161e4cf4cfe2fbff2"
},
{
"url": "https://git.kernel.org/stable/c/c9a2db4b9950b59c571258e4bae74c271f62dd66"
},
{
"url": "https://git.kernel.org/stable/c/82e664cf1219c459c33aae931b222cf951af9cb7"
}
],
"title": "erofs: disable LZ4 rolling decompression for now",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98067",
"datePublished": "2026-09-25T10:24:09.610Z",
"dateReserved": "2026-09-25T10:19:56.074Z",
"dateUpdated": "2026-10-21T12:54:21.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99106 (GCVE-0-2026-99106)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of
the BO list and looks up the user pages. Those ranges are only freed when
amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks
them under the notifier lock. If amdgpu_cs_patch_jobs(),
amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of
amdgpu_cs_submit() fails, nothing frees them: neither
amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range.
Each such CS then leaks the range, its hmm_pfns array (8 bytes per page
of the userptr BO) and the BO reference the range holds. An IB on a ring
that patches the CS in place (e.g. VCN) with an unmapped va_start fails
in amdgpu_cs_patch_ibs() and takes this path.
Free the ranges on those error paths. Ranges amdgpu_cs_submit() already
dropped are NULL, so freeing them again is a no-op.
(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e265221019d20fa162b62baec16c44b5b2ea295b",
"status": "affected",
"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0",
"versionType": "git"
},
{
"lessThan": "79179efd1ad4729cf0ff9e15eb9414f883e4aec2",
"status": "affected",
"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0",
"versionType": "git"
},
{
"lessThan": "6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a",
"status": "affected",
"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0",
"versionType": "git"
},
{
"lessThan": "2d9d24385201f476a2f754495b71bbac5ba6ea7b",
"status": "affected",
"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0",
"versionType": "git"
},
{
"lessThan": "1b4da805a0ba354a549ce07459c871c17dd94fe0",
"status": "affected",
"version": "fec8fdb54e8f74d88951c9f998f47bf4f2031fe0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: free the userptr ranges when a CS fails after parser_bos\n\namdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of\nthe BO list and looks up the user pages. Those ranges are only freed when\namdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks\nthem under the notifier lock. If amdgpu_cs_patch_jobs(),\namdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of\namdgpu_cs_submit() fails, nothing frees them: neither\namdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e-\u003erange.\n\nEach such CS then leaks the range, its hmm_pfns array (8 bytes per page\nof the userptr BO) and the BO reference the range holds. An IB on a ring\nthat patches the CS in place (e.g. VCN) with an unmapped va_start fails\nin amdgpu_cs_patch_ibs() and takes this path.\n\nFree the ranges on those error paths. Ranges amdgpu_cs_submit() already\ndropped are NULL, so freeing them again is a no-op.\n\n(cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:47.227Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e265221019d20fa162b62baec16c44b5b2ea295b"
},
{
"url": "https://git.kernel.org/stable/c/79179efd1ad4729cf0ff9e15eb9414f883e4aec2"
},
{
"url": "https://git.kernel.org/stable/c/6ac46ae5ac561d4fc7d4246ad83d71bed0d9af9a"
},
{
"url": "https://git.kernel.org/stable/c/2d9d24385201f476a2f754495b71bbac5ba6ea7b"
},
{
"url": "https://git.kernel.org/stable/c/1b4da805a0ba354a549ce07459c871c17dd94fe0"
}
],
"title": "drm/amdgpu: free the userptr ranges when a CS fails after parser_bos",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99106",
"datePublished": "2026-10-28T10:34:25.279Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-30T12:41:47.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53224 (GCVE-0-2026-53224)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate embedded INIT chunk and address list lengths in cookie
sctp_unpack_cookie() only checked that the embedded INIT chunk length
did not exceed the remaining cookie payload, but did not ensure that the
INIT chunk is large enough to contain a complete INIT header.
A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose
length field is smaller than sizeof(struct sctp_init_chunk). Later,
sctp_process_init() accesses INIT parameters unconditionally, which may
lead to out-of-bounds reads.
In addition, raw_addr_list_len is not fully validated against the
remaining cookie payload. When cookie authentication is disabled, an
attacker can supply an oversized raw_addr_list_len and cause
sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The
address parser also lacks sufficient bounds checks for parameter headers
and lengths, allowing malformed address parameters to trigger
out-of-bounds reads.
Fix this by:
- requiring the embedded INIT chunk length to be at least sizeof(struct
sctp_init_chunk);
- validating that the INIT chunk and raw address list together fit
within the cookie payload;
- verifying sufficient data exists for each address parameter header and
payload before parsing it.
Note that sctp_verify_init() must be called after sctp_unpack_cookie()
and before sctp_process_init() when cookie authentication is disabled.
This will be addressed in a separate patch.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53224",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:11.473307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:29.827Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/bind_addr.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1ca7dcfb335caa2c73d2d1bb5710e6dea2c11e0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd75066882ecc4ec8df3f5384b4b9fa9579be8f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "29ab56e7660b6f849c10c46e87e085649df751eb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7560afb8cddafd829e709d7ea09230e45a825557",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "512a9bb77c04ac9927648ea58af617e472be96e6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6f4c80a2a7e6d06753b89a578b710a2499a5e62b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/bind_addr.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:45.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1ca7dcfb335caa2c73d2d1bb5710e6dea2c11e0"
},
{
"url": "https://git.kernel.org/stable/c/dd75066882ecc4ec8df3f5384b4b9fa9579be8f0"
},
{
"url": "https://git.kernel.org/stable/c/29ab56e7660b6f849c10c46e87e085649df751eb"
},
{
"url": "https://git.kernel.org/stable/c/7560afb8cddafd829e709d7ea09230e45a825557"
},
{
"url": "https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6"
},
{
"url": "https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b"
}
],
"title": "sctp: validate embedded INIT chunk and address list lengths in cookie",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53224",
"datePublished": "2026-06-25T08:39:25.254Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-10-30T12:26:45.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90259 (GCVE-0-2026-90259)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In that function, we round down the start position and round up the
ending position.
But during the calculation of @len, we use "round_up(start + len,
sectorsize)", which is the rounded up end position, not the rounded up
length.
Which results a much larger length, and later we are still using
"start + len", which is completely incorrect.
Fix it by declaring a local @aligned_start and @aligned_len and use them
instead.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 Version: bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 Version: bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 Version: bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 Version: bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 Version: bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/qgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "036e6c216be66a085da3a0519f1be5f3230b6e26",
"status": "affected",
"version": "bc42bda22345efdb5d8b578d1b4df2c6eaa85c58",
"versionType": "git"
},
{
"lessThan": "202ac9e469b78817512921c5db05cc2140e4ca43",
"status": "affected",
"version": "bc42bda22345efdb5d8b578d1b4df2c6eaa85c58",
"versionType": "git"
},
{
"lessThan": "34adc843c28e5cd1f533a1d64f51b0f756fdf945",
"status": "affected",
"version": "bc42bda22345efdb5d8b578d1b4df2c6eaa85c58",
"versionType": "git"
},
{
"lessThan": "e6edde29990af8064b9d12217ec03db231ccd55d",
"status": "affected",
"version": "bc42bda22345efdb5d8b578d1b4df2c6eaa85c58",
"versionType": "git"
},
{
"lessThan": "c4c136555ff90f1e2921cc42da43daac0ef9985e",
"status": "affected",
"version": "bc42bda22345efdb5d8b578d1b4df2c6eaa85c58",
"versionType": "git"
},
{
"lessThan": "9102b179512e11644fb0489ae62010a09afa199c",
"status": "affected",
"version": "bc42bda22345efdb5d8b578d1b4df2c6eaa85c58",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/qgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()\n\nIn that function, we round down the start position and round up the\nending position.\n\nBut during the calculation of @len, we use \"round_up(start + len,\nsectorsize)\", which is the rounded up end position, not the rounded up\nlength.\n\nWhich results a much larger length, and later we are still using\n\"start + len\", which is completely incorrect.\n\nFix it by declaring a local @aligned_start and @aligned_len and use them\ninstead."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:57.189Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/036e6c216be66a085da3a0519f1be5f3230b6e26"
},
{
"url": "https://git.kernel.org/stable/c/202ac9e469b78817512921c5db05cc2140e4ca43"
},
{
"url": "https://git.kernel.org/stable/c/34adc843c28e5cd1f533a1d64f51b0f756fdf945"
},
{
"url": "https://git.kernel.org/stable/c/e6edde29990af8064b9d12217ec03db231ccd55d"
},
{
"url": "https://git.kernel.org/stable/c/c4c136555ff90f1e2921cc42da43daac0ef9985e"
},
{
"url": "https://git.kernel.org/stable/c/9102b179512e11644fb0489ae62010a09afa199c"
}
],
"title": "btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90259",
"datePublished": "2026-09-17T16:07:57.416Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-30T12:34:57.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93100 (GCVE-0-2026-93100)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that
need the structure to remain valid across a sleep (while waiting on acquiring
rdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with
rdtgroup_kn_put().
The release path is intended to serve as the fallback freer: if the count
drops to zero and the group has already been marked RDT_DELETED,
rdtgroup_kn_put() frees the structure.
The bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting
from a resctrl directory remove or resctrl fs unmount act as the primary
freer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is
zero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.
These two freers race. rdtgroup_kn_put() commits waitcount == 0 with
atomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags.
Between those two operations a concurrent caller of free_all_child_rdtgrp()
or rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via
atomic_read(), call rdtgroup_remove(), and kfree() the structure.
The subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then
a use-after-free, and the structure may even be freed twice if the freed
memory happens to satisfy the RDT_DELETED flag check.
Replace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so
that the decrement-to-zero takes rdtgroup_mutex before the count becomes
globally visible. The inspection of rdtgroup::flags then runs under the same
mutex held by the bulk freers, making the two paths mutually exclusive.
The common case where the count does not reach zero remains lock-free. Defer
kernfs_unbreak_active_protection() until after the mutex is dropped since
kernfs active protections functionally wrap rdtgroup_mutex. Remove resource
group, which in turn drops its kernfs reference, after kernfs protection is
restored.
[ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b8511ccc75c033f6d54188ea4df7bf1e85778740 Version: b8511ccc75c033f6d54188ea4df7bf1e85778740 Version: b8511ccc75c033f6d54188ea4df7bf1e85778740 Version: b8511ccc75c033f6d54188ea4df7bf1e85778740 Version: b8511ccc75c033f6d54188ea4df7bf1e85778740 Version: b8511ccc75c033f6d54188ea4df7bf1e85778740 Version: d20edc0bca5577bab38acb5b190619c922ddebf8 Version: 1b006f8cbde9f3dabdfafe2ff7aa9f831ed5b625 Version: 40300f986e47dbc8f1d02e5080385f5cf9f85f70 Version: b5a4949897ebada8132d54c93208989482503103 Version: 4.14.170 ≤ Version: 4.19.102 ≤ Version: 5.4.18 ≤ Version: 5.5.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/resctrl/rdtgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "906b3044dbf7c38cc411f7cf457c811363161e3b",
"status": "affected",
"version": "b8511ccc75c033f6d54188ea4df7bf1e85778740",
"versionType": "git"
},
{
"lessThan": "971b40e3ca1279ca4917889e0195d33b66d071a4",
"status": "affected",
"version": "b8511ccc75c033f6d54188ea4df7bf1e85778740",
"versionType": "git"
},
{
"lessThan": "828ff461c136b95d13b8d712c0a7a06a640e313a",
"status": "affected",
"version": "b8511ccc75c033f6d54188ea4df7bf1e85778740",
"versionType": "git"
},
{
"lessThan": "ae69f936e8ffed553d899ba4c02f8a7461a89e54",
"status": "affected",
"version": "b8511ccc75c033f6d54188ea4df7bf1e85778740",
"versionType": "git"
},
{
"lessThan": "4c593c62c1499665baebbb41b70e2c9b7e947b86",
"status": "affected",
"version": "b8511ccc75c033f6d54188ea4df7bf1e85778740",
"versionType": "git"
},
{
"lessThan": "f5bcf539484d2d604c2f2330e09487ea090b21c7",
"status": "affected",
"version": "b8511ccc75c033f6d54188ea4df7bf1e85778740",
"versionType": "git"
},
{
"status": "affected",
"version": "d20edc0bca5577bab38acb5b190619c922ddebf8",
"versionType": "git"
},
{
"status": "affected",
"version": "1b006f8cbde9f3dabdfafe2ff7aa9f831ed5b625",
"versionType": "git"
},
{
"status": "affected",
"version": "40300f986e47dbc8f1d02e5080385f5cf9f85f70",
"versionType": "git"
},
{
"status": "affected",
"version": "b5a4949897ebada8132d54c93208989482503103",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.170",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.102",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.18",
"versionType": "semver"
},
{
"lessThan": "5.6",
"status": "affected",
"version": "5.5.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/resctrl/rdtgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.102",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/resctrl: Prevent use-after-free in rdtgroup_kn_put()\n\nA struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that\nneed the structure to remain valid across a sleep (while waiting on acquiring\nrdtgroup_mutex) take a reference with rdtgroup_kn_get() and release it with\nrdtgroup_kn_put().\n\nThe release path is intended to serve as the fallback freer: if the count\ndrops to zero and the group has already been marked RDT_DELETED,\nrdtgroup_kn_put() frees the structure.\n\nThe bulk teardown paths free_all_child_rdtgrp() and rmdir_all_sub() resulting\nfrom a resctrl directory remove or resctrl fs unmount act as the primary\nfreer: they hold rdtgroup_mutex and free each rdtgroup whose waitcount is\nzero, otherwise they set RDT_DELETED and leave the freeing to the last waiter.\n\nThese two freers race. rdtgroup_kn_put() commits waitcount == 0 with\natomic_dec_and_test() outside rdtgroup_mutex, then reads rdtgroup::flags.\nBetween those two operations a concurrent caller of free_all_child_rdtgrp()\nor rmdir_all_sub() (which holds the mutex) can observe waitcount == 0 via\natomic_read(), call rdtgroup_remove(), and kfree() the structure.\n\nThe subsequent read of rdtgroup::flags in rdtgroup_kn_put() is then\na use-after-free, and the structure may even be freed twice if the freed\nmemory happens to satisfy the RDT_DELETED flag check.\n\nReplace the bare atomic_dec_and_test() with atomic_dec_and_mutex_lock() so\nthat the decrement-to-zero takes rdtgroup_mutex before the count becomes\nglobally visible. The inspection of rdtgroup::flags then runs under the same\nmutex held by the bulk freers, making the two paths mutually exclusive.\n\nThe common case where the count does not reach zero remains lock-free. Defer\nkernfs_unbreak_active_protection() until after the mutex is dropped since\nkernfs active protections functionally wrap rdtgroup_mutex. Remove resource\ngroup, which in turn drops its kernfs reference, after kernfs protection is\nrestored.\n\n [ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:58.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/906b3044dbf7c38cc411f7cf457c811363161e3b"
},
{
"url": "https://git.kernel.org/stable/c/971b40e3ca1279ca4917889e0195d33b66d071a4"
},
{
"url": "https://git.kernel.org/stable/c/828ff461c136b95d13b8d712c0a7a06a640e313a"
},
{
"url": "https://git.kernel.org/stable/c/ae69f936e8ffed553d899ba4c02f8a7461a89e54"
},
{
"url": "https://git.kernel.org/stable/c/4c593c62c1499665baebbb41b70e2c9b7e947b86"
},
{
"url": "https://git.kernel.org/stable/c/f5bcf539484d2d604c2f2330e09487ea090b21c7"
}
],
"title": "fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93100",
"datePublished": "2026-09-17T16:11:13.077Z",
"dateReserved": "2026-09-17T16:02:15.085Z",
"dateUpdated": "2026-10-30T12:35:58.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74466 (GCVE-0-2026-74466)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Close speculative mem read possibility
The domain value is extracted from a given CCA or EP11 ioctl struct
when a CPRB is about to be sent. Thus this is a user controlled value.
Under some special conditions (custom device node used, administrative
load) this value is used as an array index after bounds checking, but
without speculation barrier.
Add the missing array_index_nospec() call to prevent speculative
execution where this domain value is used.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cfd68b33094e1a92249850ff3c3c92ae9112a541 Version: cfd68b33094e1a92249850ff3c3c92ae9112a541 Version: cfd68b33094e1a92249850ff3c3c92ae9112a541 Version: cfd68b33094e1a92249850ff3c3c92ae9112a541 Version: cfd68b33094e1a92249850ff3c3c92ae9112a541 Version: cfd68b33094e1a92249850ff3c3c92ae9112a541 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "55ac533c568a5dcaa41cd26d6e089f9dff2a7c22",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "dd1a334523ba533cba63caf593a7329d8e0e5e6e",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "d11a260bd7dfc6f6ccd43e1b930050f24e70cd5f",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "59adeedebf02aa1c203de1d2b67ec45bfab7a3c6",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "82b62eda68abfb7a33ac40f24b8c4128c2891148",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
},
{
"lessThan": "e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb",
"status": "affected",
"version": "cfd68b33094e1a92249850ff3c3c92ae9112a541",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Close speculative mem read possibility\n\nThe domain value is extracted from a given CCA or EP11 ioctl struct\nwhen a CPRB is about to be sent. Thus this is a user controlled value.\nUnder some special conditions (custom device node used, administrative\nload) this value is used as an array index after bounds checking, but\nwithout speculation barrier.\n\nAdd the missing array_index_nospec() call to prevent speculative\nexecution where this domain value is used."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:05.677Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/55ac533c568a5dcaa41cd26d6e089f9dff2a7c22"
},
{
"url": "https://git.kernel.org/stable/c/dd1a334523ba533cba63caf593a7329d8e0e5e6e"
},
{
"url": "https://git.kernel.org/stable/c/d11a260bd7dfc6f6ccd43e1b930050f24e70cd5f"
},
{
"url": "https://git.kernel.org/stable/c/59adeedebf02aa1c203de1d2b67ec45bfab7a3c6"
},
{
"url": "https://git.kernel.org/stable/c/82b62eda68abfb7a33ac40f24b8c4128c2891148"
},
{
"url": "https://git.kernel.org/stable/c/e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb"
}
],
"title": "s390/zcrypt: Close speculative mem read possibility",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74466",
"datePublished": "2026-08-15T12:27:05.020Z",
"dateReserved": "2026-08-15T05:44:03.902Z",
"dateUpdated": "2026-10-30T12:30:05.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71313 (GCVE-0-2025-71313)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Add missing NULL check for alloc_workqueue()
alloc_workqueue() can return NULL on memory allocation failure. Without
proper error checking, this may lead to a NULL pointer dereference when
queue_work() is later called with the NULL workqueue pointer in
epf_ntb_epc_init().
Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on
failure to prevent the driver from loading with an invalid workqueue
pointer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/endpoint/functions/pci-epf-ntb.c",
"drivers/pci/endpoint/functions/pci-epf-vntb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62b9e706d226329d1374c0c1b80222e75ae9d8cd",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "11e78304b0113d3a122dc2c37426adc34c809645",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "829ccfb22950c430f2bf5b40465510c210afb4d5",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "2f62f8be57882c26f8bede0cab293d013964208f",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "314eab6740bcda504ef978be599f805de05ce6de",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "03f336a869b3a3f119d3ae52ac9723739c7fb7b6",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/endpoint/functions/pci-epf-ntb.c",
"drivers/pci/endpoint/functions/pci-epf-vntb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Add missing NULL check for alloc_workqueue()\n\nalloc_workqueue() can return NULL on memory allocation failure. Without\nproper error checking, this may lead to a NULL pointer dereference when\nqueue_work() is later called with the NULL workqueue pointer in\nepf_ntb_epc_init().\n\nAdd a NULL check immediately after alloc_workqueue() and return -ENOMEM on\nfailure to prevent the driver from loading with an invalid workqueue\npointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:37.692Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62b9e706d226329d1374c0c1b80222e75ae9d8cd"
},
{
"url": "https://git.kernel.org/stable/c/11e78304b0113d3a122dc2c37426adc34c809645"
},
{
"url": "https://git.kernel.org/stable/c/829ccfb22950c430f2bf5b40465510c210afb4d5"
},
{
"url": "https://git.kernel.org/stable/c/2f62f8be57882c26f8bede0cab293d013964208f"
},
{
"url": "https://git.kernel.org/stable/c/314eab6740bcda504ef978be599f805de05ce6de"
},
{
"url": "https://git.kernel.org/stable/c/03f336a869b3a3f119d3ae52ac9723739c7fb7b6"
}
],
"title": "PCI: endpoint: Add missing NULL check for alloc_workqueue()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71313",
"datePublished": "2026-06-03T15:49:38.450Z",
"dateReserved": "2026-05-27T12:23:27.414Z",
"dateUpdated": "2026-10-30T12:23:37.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90116 (GCVE-0-2026-90116)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: mtpav: shut down output timer before card teardown
snd_mtpav_output_timer() rearms chip->timer while holding
chip->spinlock and accesses the card-private mtpav state.
snd_mtpav_free() currently takes the same lock and calls
timer_delete() when the timer is active. This only removes a
pending timer; it does not wait for a callback that is already
running and does not prevent the callback from rearming the timer.
A callback running on another CPU can therefore continue after
snd_mtpav_free() releases the lock and access the card-private
state while the card is being torn down. It can also rearm the
timer after timer_delete() has returned.
Call timer_shutdown_sync() without holding chip->spinlock. This
waits for any running callback to finish and prevents further
rearming before the card-private mtpav state is released.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/drivers/mtpav.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9435a1f14a6f9520452617343ea59bb35ba9e79",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "793163e134028e7136c9dd9e30f7f656de1eabba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "de75857ce374671712e1d9528844e3c0543dcef6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "392c985c6b03dfdf4904c0d464f18735ca3c4df8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1e16e82581521a2fe20eda29bdc9e75286f7c950",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c73cb5b7c159246dd572277c668851a56e516019",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/drivers/mtpav.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mtpav: shut down output timer before card teardown\n\nsnd_mtpav_output_timer() rearms chip-\u003etimer while holding\nchip-\u003espinlock and accesses the card-private mtpav state.\n\nsnd_mtpav_free() currently takes the same lock and calls\ntimer_delete() when the timer is active. This only removes a\npending timer; it does not wait for a callback that is already\nrunning and does not prevent the callback from rearming the timer.\n\nA callback running on another CPU can therefore continue after\nsnd_mtpav_free() releases the lock and access the card-private\nstate while the card is being torn down. It can also rearm the\ntimer after timer_delete() has returned.\n\nCall timer_shutdown_sync() without holding chip-\u003espinlock. This\nwaits for any running callback to finish and prevents further\nrearming before the card-private mtpav state is released."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:15.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9435a1f14a6f9520452617343ea59bb35ba9e79"
},
{
"url": "https://git.kernel.org/stable/c/793163e134028e7136c9dd9e30f7f656de1eabba"
},
{
"url": "https://git.kernel.org/stable/c/de75857ce374671712e1d9528844e3c0543dcef6"
},
{
"url": "https://git.kernel.org/stable/c/392c985c6b03dfdf4904c0d464f18735ca3c4df8"
},
{
"url": "https://git.kernel.org/stable/c/1e16e82581521a2fe20eda29bdc9e75286f7c950"
},
{
"url": "https://git.kernel.org/stable/c/c73cb5b7c159246dd572277c668851a56e516019"
}
],
"title": "ALSA: mtpav: shut down output timer before card teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90116",
"datePublished": "2026-09-17T16:06:22.065Z",
"dateReserved": "2026-09-11T19:38:34.787Z",
"dateUpdated": "2026-10-30T12:34:15.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43127 (GCVE-0-2026-43127)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix circular locking dependency in run_unpack_ex
Syzbot reported a circular locking dependency between wnd->rw_lock
(sbi->used.bitmap) and ni->file.run_lock.
The deadlock scenario:
1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.
2. run_unpack_ex() takes wnd->rw_lock then tries to acquire
ni->file.run_lock inside ntfs_refresh_zone().
This creates an AB-BA deadlock.
Fix this by using down_read_trylock() instead of down_read() when
acquiring run_lock in run_unpack_ex(). If the lock is contended,
skip ntfs_refresh_zone() - the MFT zone will be refreshed on the
next MFT operation. This breaks the circular dependency since we
never block waiting for run_lock while holding wnd->rw_lock.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57f7979aefdcef66326bda47e07ee0d8be64bf21 Version: db7fc56646cafe39599a4c21f1398e2bdfd5c185 Version: 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36 Version: 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36 Version: 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36 Version: 6.6.66 ≤ Version: 6.12.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/run.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d60f09d2d16c44a797d8cb67015cde2508720506",
"status": "affected",
"version": "57f7979aefdcef66326bda47e07ee0d8be64bf21",
"versionType": "git"
},
{
"lessThan": "76016d15bbd90caa0ce7765fddf9bde8e943e601",
"status": "affected",
"version": "db7fc56646cafe39599a4c21f1398e2bdfd5c185",
"versionType": "git"
},
{
"lessThan": "b014372b62237521444ee51384549bdf48b79015",
"status": "affected",
"version": "5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36",
"versionType": "git"
},
{
"lessThan": "b8d22d9d8260b0f4f4d8e2898c98037c9982ea66",
"status": "affected",
"version": "5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36",
"versionType": "git"
},
{
"lessThan": "08ce2fee1b869ecbfbd94e0eb2630e52203a2e03",
"status": "affected",
"version": "5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.66",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/run.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix circular locking dependency in run_unpack_ex\n\nSyzbot reported a circular locking dependency between wnd-\u003erw_lock\n(sbi-\u003eused.bitmap) and ni-\u003efile.run_lock.\n\nThe deadlock scenario:\n1. ntfs_extend_mft() takes ni-\u003efile.run_lock then wnd-\u003erw_lock.\n2. run_unpack_ex() takes wnd-\u003erw_lock then tries to acquire\n ni-\u003efile.run_lock inside ntfs_refresh_zone().\n\nThis creates an AB-BA deadlock.\n\nFix this by using down_read_trylock() instead of down_read() when\nacquiring run_lock in run_unpack_ex(). If the lock is contended,\nskip ntfs_refresh_zone() - the MFT zone will be refreshed on the\nnext MFT operation. This breaks the circular dependency since we\nnever block waiting for run_lock while holding wnd-\u003erw_lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:09.954Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d60f09d2d16c44a797d8cb67015cde2508720506"
},
{
"url": "https://git.kernel.org/stable/c/76016d15bbd90caa0ce7765fddf9bde8e943e601"
},
{
"url": "https://git.kernel.org/stable/c/b014372b62237521444ee51384549bdf48b79015"
},
{
"url": "https://git.kernel.org/stable/c/b8d22d9d8260b0f4f4d8e2898c98037c9982ea66"
},
{
"url": "https://git.kernel.org/stable/c/08ce2fee1b869ecbfbd94e0eb2630e52203a2e03"
}
],
"title": "ntfs3: fix circular locking dependency in run_unpack_ex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43127",
"datePublished": "2026-05-06T11:27:16.794Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-10-21T12:40:09.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45934 (GCVE-0-2026-45934)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
I have been observing a number of systems aborting at
insert_dev_extents() in btrfs_create_pending_block_groups(). The
following is a sample stack trace of such an abort coming from forced
chunk allocation (typically behind CONFIG_BTRFS_EXPERIMENTAL) but this
can theoretically happen to any DUP chunk allocation.
[81.801] ------------[ cut here ]------------
[81.801] BTRFS: Transaction aborted (error -17)
[81.801] WARNING: fs/btrfs/block-group.c:2876 at btrfs_create_pending_block_groups+0x721/0x770 [btrfs], CPU#1: bash/319
[81.802] Modules linked in: virtio_net btrfs xor zstd_compress raid6_pq null_blk
[81.803] CPU: 1 UID: 0 PID: 319 Comm: bash Kdump: loaded Not tainted 6.19.0-rc6+ #319 NONE
[81.803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
[81.804] RIP: 0010:btrfs_create_pending_block_groups+0x723/0x770 [btrfs]
[81.806] RSP: 0018:ffffa36241a6bce8 EFLAGS: 00010282
[81.806] RAX: 000000000000000d RBX: ffff8e699921e400 RCX: 0000000000000000
[81.807] RDX: 0000000002040001 RSI: 00000000ffffffef RDI: ffffffffc0608bf0
[81.807] RBP: 00000000ffffffef R08: ffff8e69830f6000 R09: 0000000000000007
[81.808] R10: ffff8e699921e5e8 R11: 0000000000000000 R12: ffff8e6999228000
[81.808] R13: ffff8e6984d82000 R14: ffff8e69966a69c0 R15: ffff8e69aa47b000
[81.809] FS: 00007fec6bdd9740(0000) GS:ffff8e6b1b379000(0000) knlGS:0000000000000000
[81.809] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[81.810] CR2: 00005604833670f0 CR3: 0000000116679000 CR4: 00000000000006f0
[81.810] Call Trace:
[81.810] <TASK>
[81.810] __btrfs_end_transaction+0x3e/0x2b0 [btrfs]
[81.811] btrfs_force_chunk_alloc_store+0xcd/0x140 [btrfs]
[81.811] kernfs_fop_write_iter+0x15f/0x240
[81.812] vfs_write+0x264/0x500
[81.812] ksys_write+0x6c/0xe0
[81.812] do_syscall_64+0x66/0x770
[81.812] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[81.813] RIP: 0033:0x7fec6be66197
[81.814] RSP: 002b:00007fffb159dd30 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[81.815] RAX: ffffffffffffffda RBX: 00007fec6bdd9740 RCX: 00007fec6be66197
[81.815] RDX: 0000000000000002 RSI: 0000560483374f80 RDI: 0000000000000001
[81.816] RBP: 0000560483374f80 R08: 0000000000000000 R09: 0000000000000000
[81.816] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
[81.817] R13: 00007fec6bfb85c0 R14: 00007fec6bfb5ee0 R15: 00005604833729c0
[81.817] </TASK>
[81.817] irq event stamp: 20039
[81.818] hardirqs last enabled at (20047): [<ffffffff99a68302>] __up_console_sem+0x52/0x60
[81.818] hardirqs last disabled at (20056): [<ffffffff99a682e7>] __up_console_sem+0x37/0x60
[81.819] softirqs last enabled at (19470): [<ffffffff999d2b46>] __irq_exit_rcu+0x96/0xc0
[81.819] softirqs last disabled at (19463): [<ffffffff999d2b46>] __irq_exit_rcu+0x96/0xc0
[81.820] ---[ end trace 0000000000000000 ]---
[81.820] BTRFS: error (device dm-7 state A) in btrfs_create_pending_block_groups:2876: errno=-17 Object already exists
Inspecting these aborts with drgn, I observed a pattern of overlapping
chunk_maps. Note how stripe 1 of the first chunk overlaps in physical
address with stripe 0 of the second chunk.
Physical Start Physical End Length Logical Type Stripe
----------------------------------------------------------------------------------------------------
0x0000000102500000 0x0000000142500000 1.0G 0x0000000641d00000 META|DUP 0/2
0x0000000142500000 0x0000000182500000 1.0G 0x0000000641d00000 META|DUP 1/2
0x0000000142500000 0x0000000182500000 1.0G 0x0000000601d00000 META|DUP 0/2
0x0000000182500000 0x00000001c2500000 1.0G 0x0000000601d00000 META|DUP 1/2
Now how could this possibly happen? All chunk allocation is
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1b9845081633072c18f30d8cfd09c267adf0b109 Version: 1b9845081633072c18f30d8cfd09c267adf0b109 Version: 1b9845081633072c18f30d8cfd09c267adf0b109 Version: 1b9845081633072c18f30d8cfd09c267adf0b109 Version: 1b9845081633072c18f30d8cfd09c267adf0b109 Version: 1b9845081633072c18f30d8cfd09c267adf0b109 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/volumes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8f01e82c58f40739dfec32fc83dfd66711d473b9",
"status": "affected",
"version": "1b9845081633072c18f30d8cfd09c267adf0b109",
"versionType": "git"
},
{
"lessThan": "12addb8ab5eec94098d4c7c6614830ccbe7ad130",
"status": "affected",
"version": "1b9845081633072c18f30d8cfd09c267adf0b109",
"versionType": "git"
},
{
"lessThan": "09207c3975e1f8f76a52472004dfcab997b4cbd6",
"status": "affected",
"version": "1b9845081633072c18f30d8cfd09c267adf0b109",
"versionType": "git"
},
{
"lessThan": "7d4eadee7042d27fcea659fcdd738f463a7d2e70",
"status": "affected",
"version": "1b9845081633072c18f30d8cfd09c267adf0b109",
"versionType": "git"
},
{
"lessThan": "156cac365e27a82b64ae510c5f463fd81f0265b1",
"status": "affected",
"version": "1b9845081633072c18f30d8cfd09c267adf0b109",
"versionType": "git"
},
{
"lessThan": "b14c5e04bd0f722ed631845599d52d03fcae1bc1",
"status": "affected",
"version": "1b9845081633072c18f30d8cfd09c267adf0b109",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/volumes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation\n\nI have been observing a number of systems aborting at\ninsert_dev_extents() in btrfs_create_pending_block_groups(). The\nfollowing is a sample stack trace of such an abort coming from forced\nchunk allocation (typically behind CONFIG_BTRFS_EXPERIMENTAL) but this\ncan theoretically happen to any DUP chunk allocation.\n\n [81.801] ------------[ cut here ]------------\n [81.801] BTRFS: Transaction aborted (error -17)\n [81.801] WARNING: fs/btrfs/block-group.c:2876 at btrfs_create_pending_block_groups+0x721/0x770 [btrfs], CPU#1: bash/319\n [81.802] Modules linked in: virtio_net btrfs xor zstd_compress raid6_pq null_blk\n [81.803] CPU: 1 UID: 0 PID: 319 Comm: bash Kdump: loaded Not tainted 6.19.0-rc6+ #319 NONE\n [81.803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\n [81.804] RIP: 0010:btrfs_create_pending_block_groups+0x723/0x770 [btrfs]\n [81.806] RSP: 0018:ffffa36241a6bce8 EFLAGS: 00010282\n [81.806] RAX: 000000000000000d RBX: ffff8e699921e400 RCX: 0000000000000000\n [81.807] RDX: 0000000002040001 RSI: 00000000ffffffef RDI: ffffffffc0608bf0\n [81.807] RBP: 00000000ffffffef R08: ffff8e69830f6000 R09: 0000000000000007\n [81.808] R10: ffff8e699921e5e8 R11: 0000000000000000 R12: ffff8e6999228000\n [81.808] R13: ffff8e6984d82000 R14: ffff8e69966a69c0 R15: ffff8e69aa47b000\n [81.809] FS: 00007fec6bdd9740(0000) GS:ffff8e6b1b379000(0000) knlGS:0000000000000000\n [81.809] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [81.810] CR2: 00005604833670f0 CR3: 0000000116679000 CR4: 00000000000006f0\n [81.810] Call Trace:\n [81.810] \u003cTASK\u003e\n [81.810] __btrfs_end_transaction+0x3e/0x2b0 [btrfs]\n [81.811] btrfs_force_chunk_alloc_store+0xcd/0x140 [btrfs]\n [81.811] kernfs_fop_write_iter+0x15f/0x240\n [81.812] vfs_write+0x264/0x500\n [81.812] ksys_write+0x6c/0xe0\n [81.812] do_syscall_64+0x66/0x770\n [81.812] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [81.813] RIP: 0033:0x7fec6be66197\n [81.814] RSP: 002b:00007fffb159dd30 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n [81.815] RAX: ffffffffffffffda RBX: 00007fec6bdd9740 RCX: 00007fec6be66197\n [81.815] RDX: 0000000000000002 RSI: 0000560483374f80 RDI: 0000000000000001\n [81.816] RBP: 0000560483374f80 R08: 0000000000000000 R09: 0000000000000000\n [81.816] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002\n [81.817] R13: 00007fec6bfb85c0 R14: 00007fec6bfb5ee0 R15: 00005604833729c0\n [81.817] \u003c/TASK\u003e\n [81.817] irq event stamp: 20039\n [81.818] hardirqs last enabled at (20047): [\u003cffffffff99a68302\u003e] __up_console_sem+0x52/0x60\n [81.818] hardirqs last disabled at (20056): [\u003cffffffff99a682e7\u003e] __up_console_sem+0x37/0x60\n [81.819] softirqs last enabled at (19470): [\u003cffffffff999d2b46\u003e] __irq_exit_rcu+0x96/0xc0\n [81.819] softirqs last disabled at (19463): [\u003cffffffff999d2b46\u003e] __irq_exit_rcu+0x96/0xc0\n [81.820] ---[ end trace 0000000000000000 ]---\n [81.820] BTRFS: error (device dm-7 state A) in btrfs_create_pending_block_groups:2876: errno=-17 Object already exists\n\nInspecting these aborts with drgn, I observed a pattern of overlapping\nchunk_maps. Note how stripe 1 of the first chunk overlaps in physical\naddress with stripe 0 of the second chunk.\n\nPhysical Start Physical End Length Logical Type Stripe\n----------------------------------------------------------------------------------------------------\n0x0000000102500000 0x0000000142500000 1.0G 0x0000000641d00000 META|DUP 0/2\n0x0000000142500000 0x0000000182500000 1.0G 0x0000000641d00000 META|DUP 1/2\n0x0000000142500000 0x0000000182500000 1.0G 0x0000000601d00000 META|DUP 0/2\n0x0000000182500000 0x00000001c2500000 1.0G 0x0000000601d00000 META|DUP 1/2\n\nNow how could this possibly happen? All chunk allocation is\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:44.551Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8f01e82c58f40739dfec32fc83dfd66711d473b9"
},
{
"url": "https://git.kernel.org/stable/c/12addb8ab5eec94098d4c7c6614830ccbe7ad130"
},
{
"url": "https://git.kernel.org/stable/c/09207c3975e1f8f76a52472004dfcab997b4cbd6"
},
{
"url": "https://git.kernel.org/stable/c/7d4eadee7042d27fcea659fcdd738f463a7d2e70"
},
{
"url": "https://git.kernel.org/stable/c/156cac365e27a82b64ae510c5f463fd81f0265b1"
},
{
"url": "https://git.kernel.org/stable/c/b14c5e04bd0f722ed631845599d52d03fcae1bc1"
}
],
"title": "btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45934",
"datePublished": "2026-05-27T12:17:51.905Z",
"dateReserved": "2026-05-13T15:03:33.086Z",
"dateUpdated": "2026-10-30T12:25:44.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90206 (GCVE-0-2026-90206)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix max_qid race between configfs and controller allocation
The function nvmet_subsys_attr_qid_max_store() can race against
nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.
Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:
ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1);
and at this exact point, a userspace process changes max_qid to 128,
nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It
attempts to delete active controllers to force a reconnect, but the
new controller won't be deleted because it hasn't been added to the
subsys->ctrls list yet.
nvmet_alloc_ctrl() then proceeds and adds the new controller to the
subsys->ctrls list. Later, when nvmet_install_queue() is called, it
will see max_qid set to 128, but the memory allocated for sqs is only
sized for 64 entries. This results in a KASAN out-of-bounds warning
and potential memory corruptions.
Fix this by protecting the queue allocations and list insertion in
nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because
nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem)
to modify the attribute, this safely prevents the configfs writer from
modifying max_qid during controller creation.
Copy the max_qid from the subsystem to the controller's structure
during the allocation; ctrl->max_qid never changes as long as the
controller remains in LIVE state, so this will prevent similar race
conditions.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 Version: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 Version: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 Version: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 Version: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 Version: 3e980f5995e0bb4d86fef873a9c9ad66721580d0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/admin-cmd.c",
"drivers/nvme/target/core.c",
"drivers/nvme/target/fabrics-cmd.c",
"drivers/nvme/target/nvmet.h",
"drivers/nvme/target/pci-epf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cae0f5ed6ce7af3f7e0003c417f1953a350f55bf",
"status": "affected",
"version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
"versionType": "git"
},
{
"lessThan": "af811970da4f0a928f5a1b1a946a04f755ce86f2",
"status": "affected",
"version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
"versionType": "git"
},
{
"lessThan": "a1b88a1782eb6b368071dcda548a41b5c23d8cd2",
"status": "affected",
"version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
"versionType": "git"
},
{
"lessThan": "6e6f8e3bfc66dff1833a48ecfd857268cff3be84",
"status": "affected",
"version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
"versionType": "git"
},
{
"lessThan": "2c23fc91789dfd9db746edb3ae9b90d65fabd410",
"status": "affected",
"version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
"versionType": "git"
},
{
"lessThan": "f1a8846e06388113dfdbb89dee005083fa9afdf9",
"status": "affected",
"version": "3e980f5995e0bb4d86fef873a9c9ad66721580d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/admin-cmd.c",
"drivers/nvme/target/core.c",
"drivers/nvme/target/fabrics-cmd.c",
"drivers/nvme/target/nvmet.h",
"drivers/nvme/target/pci-epf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix max_qid race between configfs and controller allocation\n\nThe function nvmet_subsys_attr_qid_max_store() can race against\nnvmet_alloc_ctrl() when a subsystem\u0027s max_qid limit is modified.\n\nSuppose max_qid is currently 64. If nvmet_alloc_ctrl() executes:\nctrl-\u003esqs = kzalloc_objs(struct nvmet_sq *, subsys-\u003emax_qid + 1);\nand at this exact point, a userspace process changes max_qid to 128,\nnvmet_subsys_attr_qid_max_store() will set the new max_qid value. It\nattempts to delete active controllers to force a reconnect, but the\nnew controller won\u0027t be deleted because it hasn\u0027t been added to the\nsubsys-\u003ectrls list yet.\n\nnvmet_alloc_ctrl() then proceeds and adds the new controller to the\nsubsys-\u003ectrls list. Later, when nvmet_install_queue() is called, it\nwill see max_qid set to 128, but the memory allocated for sqs is only\nsized for 64 entries. This results in a KASAN out-of-bounds warning\nand potential memory corruptions.\n\nFix this by protecting the queue allocations and list insertion in\nnvmet_alloc_ctrl() with down_read(\u0026nvmet_config_sem). Because\nnvmet_subsys_attr_qid_max_store() acquires down_write(\u0026nvmet_config_sem)\nto modify the attribute, this safely prevents the configfs writer from\nmodifying max_qid during controller creation.\n\nCopy the max_qid from the subsystem to the controller\u0027s structure\nduring the allocation; ctrl-\u003emax_qid never changes as long as the\ncontroller remains in LIVE state, so this will prevent similar race\nconditions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:46.536Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cae0f5ed6ce7af3f7e0003c417f1953a350f55bf"
},
{
"url": "https://git.kernel.org/stable/c/af811970da4f0a928f5a1b1a946a04f755ce86f2"
},
{
"url": "https://git.kernel.org/stable/c/a1b88a1782eb6b368071dcda548a41b5c23d8cd2"
},
{
"url": "https://git.kernel.org/stable/c/6e6f8e3bfc66dff1833a48ecfd857268cff3be84"
},
{
"url": "https://git.kernel.org/stable/c/2c23fc91789dfd9db746edb3ae9b90d65fabd410"
},
{
"url": "https://git.kernel.org/stable/c/f1a8846e06388113dfdbb89dee005083fa9afdf9"
}
],
"title": "nvmet: fix max_qid race between configfs and controller allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90206",
"datePublished": "2026-09-17T16:07:22.173Z",
"dateReserved": "2026-09-11T19:38:34.793Z",
"dateUpdated": "2026-10-30T12:34:46.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98003 (GCVE-0-2026-98003)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Do not reallocate GA log buffers on resume
Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC
(AVIC) Enablement") moved the GA log allocation from iommu_init_pci()
to enable_iommus_vapic(), which is called on every resume.
iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail
unconditionally. Each resume therefore replaces the boot-time pointers
and leaks both old allocations. The function also uses GFP_KERNEL from a
syscore resume callback, where interrupts are disabled and the non-boot
CPUs are offline.
Return early if both buffers are already allocated. Clear the pointers
in free_ga_log() so a partial allocation failure cannot leave ga_log
dangling.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434",
"status": "affected",
"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b",
"versionType": "git"
},
{
"lessThan": "ff85cdc2889e1c885eed218ee5bc0b59e0235b3f",
"status": "affected",
"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b",
"versionType": "git"
},
{
"lessThan": "94458b80d3b203c1c9e2c98aa7319b7713e006c0",
"status": "affected",
"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b",
"versionType": "git"
},
{
"lessThan": "b6be275d19cee01f8f1f08a2ff18337103d05d40",
"status": "affected",
"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b",
"versionType": "git"
},
{
"lessThan": "00a7dd64888d6dd72110b40e2824a088cf7b7386",
"status": "affected",
"version": "c5e1a1eb9279fdb28d47ca2a4493a4c53b7d6a0b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Do not reallocate GA log buffers on resume\n\nCommit c5e1a1eb9279 (\"iommu/amd: Simplify and Consolidate Virtual APIC\n(AVIC) Enablement\") moved the GA log allocation from iommu_init_pci()\nto enable_iommus_vapic(), which is called on every resume.\n\niommu_init_ga_log() assigns iommu-\u003ega_log and iommu-\u003ega_log_tail\nunconditionally. Each resume therefore replaces the boot-time pointers\nand leaks both old allocations. The function also uses GFP_KERNEL from a\nsyscore resume callback, where interrupts are disabled and the non-boot\nCPUs are offline.\n\nReturn early if both buffers are already allocated. Clear the pointers\nin free_ga_log() so a partial allocation failure cannot leave ga_log\ndangling."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:02.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b95269d7a43b737c2c0e2fa77bf00cc8a3a4434"
},
{
"url": "https://git.kernel.org/stable/c/ff85cdc2889e1c885eed218ee5bc0b59e0235b3f"
},
{
"url": "https://git.kernel.org/stable/c/94458b80d3b203c1c9e2c98aa7319b7713e006c0"
},
{
"url": "https://git.kernel.org/stable/c/b6be275d19cee01f8f1f08a2ff18337103d05d40"
},
{
"url": "https://git.kernel.org/stable/c/00a7dd64888d6dd72110b40e2824a088cf7b7386"
}
],
"title": "iommu/amd: Do not reallocate GA log buffers on resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98003",
"datePublished": "2026-09-25T10:23:30.522Z",
"dateReserved": "2026-09-25T10:19:56.068Z",
"dateUpdated": "2026-10-21T12:54:02.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93168 (GCVE-0-2026-93168)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
Currently when calling xilinx_dma_poll_timeout with delay_us=0 and a
condition that is never fulfilled, the CPU busy-waits for prolonged time
and the timeout triggers only with a massive delay causing a CPU stall.
This happens due to a huge underestimation of wall clock time in
poll_timeout_us_atomic. Commit 7349a69cf312 ("iopoll: Do not use
timekeeping in read_poll_timeout_atomic()") changed the behavior to no
longer use ktime_get at the expense of underestimation of wall clock
time which appears to be very large for delay_us=0. Instead of timing
out after approximately XILINX_DMA_LOOP_COUNT microseconds, the timeout
takes XILINX_DMA_LOOP_COUNT * 1000 * (time that the overhead of the for
loop in poll_timeout_us_atomic takes) which is in the range of several
minutes for XILINX_DMA_LOOP_COUNT=1000000. Fix this by using a non-zero
value for delay_us. Use delay_us=10 to keep the delay in the hot path of
starting DMA transfers minimal but still avoid CPU stalls in case of
unexpected hardware failures.
One-off measurement with delay_us=0 causes the cpu to busy wait around 7
minutes in the timeout case. After applying this patch with delay_us=10
the measured timeout was 1053428 microseconds which is roughly
equivalent to the expected 1000000 microseconds specified in
XILINX_DMA_LOOP_COUNT.
Add a constant XILINX_DMA_POLL_DELAY_US for delay_us value.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9495f2648287029fb5545c34a0fa318426ebe84c Version: 9495f2648287029fb5545c34a0fa318426ebe84c Version: 9495f2648287029fb5545c34a0fa318426ebe84c Version: 9495f2648287029fb5545c34a0fa318426ebe84c Version: 9495f2648287029fb5545c34a0fa318426ebe84c Version: 9495f2648287029fb5545c34a0fa318426ebe84c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/xilinx/xilinx_dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4237b5cc181a17f5a2a797655c1ce2c64e01c550",
"status": "affected",
"version": "9495f2648287029fb5545c34a0fa318426ebe84c",
"versionType": "git"
},
{
"lessThan": "2ba67aa183a3ce174d534425b67eda84f6e3c896",
"status": "affected",
"version": "9495f2648287029fb5545c34a0fa318426ebe84c",
"versionType": "git"
},
{
"lessThan": "c30a26d4987a01e619449bf170f584c007e07d75",
"status": "affected",
"version": "9495f2648287029fb5545c34a0fa318426ebe84c",
"versionType": "git"
},
{
"lessThan": "f786e7b3adbf3bd14964a1cedf9d55b6ad91dcd7",
"status": "affected",
"version": "9495f2648287029fb5545c34a0fa318426ebe84c",
"versionType": "git"
},
{
"lessThan": "8b5654d317277e6e505c23f8fa7e415237fefc7f",
"status": "affected",
"version": "9495f2648287029fb5545c34a0fa318426ebe84c",
"versionType": "git"
},
{
"lessThan": "aa99c4d1d63bbc26a5fc4c667d89b2595743c19d",
"status": "affected",
"version": "9495f2648287029fb5545c34a0fa318426ebe84c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/xilinx/xilinx_dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout\n\nCurrently when calling xilinx_dma_poll_timeout with delay_us=0 and a\ncondition that is never fulfilled, the CPU busy-waits for prolonged time\nand the timeout triggers only with a massive delay causing a CPU stall.\n\nThis happens due to a huge underestimation of wall clock time in\npoll_timeout_us_atomic. Commit 7349a69cf312 (\"iopoll: Do not use\ntimekeeping in read_poll_timeout_atomic()\") changed the behavior to no\nlonger use ktime_get at the expense of underestimation of wall clock\ntime which appears to be very large for delay_us=0. Instead of timing\nout after approximately XILINX_DMA_LOOP_COUNT microseconds, the timeout\ntakes XILINX_DMA_LOOP_COUNT * 1000 * (time that the overhead of the for\nloop in poll_timeout_us_atomic takes) which is in the range of several\nminutes for XILINX_DMA_LOOP_COUNT=1000000. Fix this by using a non-zero\nvalue for delay_us. Use delay_us=10 to keep the delay in the hot path of\nstarting DMA transfers minimal but still avoid CPU stalls in case of\nunexpected hardware failures.\n\nOne-off measurement with delay_us=0 causes the cpu to busy wait around 7\nminutes in the timeout case. After applying this patch with delay_us=10\nthe measured timeout was 1053428 microseconds which is roughly\nequivalent to the expected 1000000 microseconds specified in\nXILINX_DMA_LOOP_COUNT.\n\nAdd a constant XILINX_DMA_POLL_DELAY_US for delay_us value."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:12.039Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4237b5cc181a17f5a2a797655c1ce2c64e01c550"
},
{
"url": "https://git.kernel.org/stable/c/2ba67aa183a3ce174d534425b67eda84f6e3c896"
},
{
"url": "https://git.kernel.org/stable/c/c30a26d4987a01e619449bf170f584c007e07d75"
},
{
"url": "https://git.kernel.org/stable/c/f786e7b3adbf3bd14964a1cedf9d55b6ad91dcd7"
},
{
"url": "https://git.kernel.org/stable/c/8b5654d317277e6e505c23f8fa7e415237fefc7f"
},
{
"url": "https://git.kernel.org/stable/c/aa99c4d1d63bbc26a5fc4c667d89b2595743c19d"
}
],
"title": "dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93168",
"datePublished": "2026-09-17T16:11:59.904Z",
"dateReserved": "2026-09-17T16:02:15.090Z",
"dateUpdated": "2026-10-30T12:36:12.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99105 (GCVE-0-2026-99105)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to
ops.enqueue() instead of being kept running. Exiting tasks without
SCX_OPS_ENQ_EXITING, migration disabled tasks without
SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue()
and go straight to the local DSQ. This happens in put_prev_task_scx() after
the pick has settled on idle, so nothing reschedules the CPU, which idles
with the task queued until an unrelated wakeup lands on it or the watchdog
fires.
scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit
this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for
over 40 seconds.
A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST
enqueue left the task on this CPU's local DSQ, set need_resched on the task
being switched in, as proxy_resched_idle() does. resched_curr() would flag
the task being put instead, and __schedule() clears that right after the
pick.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea47eec058fc1b6a3c3c54870d24a8bdcb3e204d",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "8d891c218016b6145993e082e7f732cb69dd0e29",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "396ba6f04da3fd1fb5a3d1c9535bef3f967f4e59",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
},
{
"lessThan": "7a9df76679633cf26e0fea882a684012c6ec245a",
"status": "affected",
"version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU\u0027s local DSQ\n\nWith SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to\nops.enqueue() instead of being kept running. Exiting tasks without\nSCX_OPS_ENQ_EXITING, migration disabled tasks without\nSCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue()\nand go straight to the local DSQ. This happens in put_prev_task_scx() after\nthe pick has settled on idle, so nothing reschedules the CPU, which idles\nwith the task queued until an unrelated wakeup lands on it or the watchdog\nfires.\n\nscx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit\nthis during mass cgroup teardown: exiting tasks stuck in exit_mmap() for\nover 40 seconds.\n\nA task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST\nenqueue left the task on this CPU\u0027s local DSQ, set need_resched on the task\nbeing switched in, as proxy_resched_idle() does. resched_curr() would flag\nthe task being put instead, and __schedule() clears that right after the\npick."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:46.163Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea47eec058fc1b6a3c3c54870d24a8bdcb3e204d"
},
{
"url": "https://git.kernel.org/stable/c/8d891c218016b6145993e082e7f732cb69dd0e29"
},
{
"url": "https://git.kernel.org/stable/c/396ba6f04da3fd1fb5a3d1c9535bef3f967f4e59"
},
{
"url": "https://git.kernel.org/stable/c/7a9df76679633cf26e0fea882a684012c6ec245a"
}
],
"title": "sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU\u0027s local DSQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99105",
"datePublished": "2026-10-28T10:34:24.456Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-30T12:41:46.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90256 (GCVE-0-2026-90256)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via
hci_conn_timeout (disc_work) -> hci_proto_disconn_ind ->
l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted
concurrently.
disc_work is disabled sync in hci_conn_del(), so we cannot take
hci_dev_lock in disc_work.
Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock
which is held in other access paths.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: efc30877bd4bc85fefe98d80af60fafc86e5775e Version: f87271d21dd4ee83857ca11b94e7b4952749bbae Version: ab4eedb790cae44313759b50fe47da285e2519d5 Version: ab4eedb790cae44313759b50fe47da285e2519d5 Version: 18ab6b6078fa8191ca30a3065d57bf35d5635761 Version: 6.6.84 ≤ Version: 6.12.20 ≤ Version: 6.13.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0fa448369c87e20b2aeaeaca0187d698dd61f791",
"status": "affected",
"version": "efc30877bd4bc85fefe98d80af60fafc86e5775e",
"versionType": "git"
},
{
"lessThan": "7c032b6d48a46634cbd58aaebad2638c00ad3b51",
"status": "affected",
"version": "f87271d21dd4ee83857ca11b94e7b4952749bbae",
"versionType": "git"
},
{
"lessThan": "b495a3a9b33bc4e4613e685bf5c96c136caa22d8",
"status": "affected",
"version": "ab4eedb790cae44313759b50fe47da285e2519d5",
"versionType": "git"
},
{
"lessThan": "2b66c83ff1751d6bd3201b3017206262ab46dc05",
"status": "affected",
"version": "ab4eedb790cae44313759b50fe47da285e2519d5",
"versionType": "git"
},
{
"status": "affected",
"version": "18ab6b6078fa8191ca30a3065d57bf35d5635761",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.84",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.20",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind\n\nhci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via\nhci_conn_timeout (disc_work) -\u003e hci_proto_disconn_ind -\u003e\nl2cap_disconn_ind. This is UAF if the l2cap_conn is deleted\nconcurrently.\n\ndisc_work is disabled sync in hci_conn_del(), so we cannot take\nhci_dev_lock in disc_work.\n\nFix by using proto_lock to guard l2cap_data, in addition to hdev-\u003elock\nwhich is held in other access paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - l2cap_disconn_ind() is reached from hci_conn_timeout() (hci_conn.disc_work) via hci_proto_disconn_ind() only for ACL_LINK/LE_LINK; hcon-\u003el2cap_data is installed by l2cap_conn_add() from l2cap_connect_cfm()/l2cap_chan_connect() on that HCI connection, so the triggering peer must be in Bluetooth radio range.\nAC:L - The attacker creates the ACL/LE link so l2cap_conn_add() publishes hcon-\u003el2cap_data, then tears it down so l2cap_conn_del() or the last l2cap_conn_put() from l2cap_chan_destroy() (rfcomm_process_rx on rfcomm_run) frees the object while hci_conn_timeout() reads conn-\u003edisc_reason; both sides are attacker-driven and retryable.\nPR:N - HCI Connection Complete delivers l2cap_connect_cfm() \u2192 l2cap_conn_add() and later disc_work with no host uid or capability check; SDP (PSM 0x0001) and RFCOMM session close on remote disconnect likewise need no pairing, so an unauthenticated Bluetooth peer is enough.\nUI:N - hci_conn_timeout() runs from hdev-\u003eworkqueue after the last hci_conn_drop() once the adapter is powered and connectable; incoming ACL/LE setup, RFCOMM/L2CAP teardown, and the disconnect timer need no per-attack user click.\nS:U - The UAF is of the host kmalloc l2cap_conn used by l2cap_disconn_ind() and only corrupts that kernel\u0027s Bluetooth/HCI state, with no VM, IOMMU, or sandbox boundary crossing.\nC:H - l2cap_disconn_ind() locklessly loads hcon-\u003el2cap_data and reads conn-\u003edisc_reason after l2cap_conn_free() has kfree\u0027d the kmalloc-1k object, so a sprayed replacement discloses kernel heap contents through that dangling pointer.\nI:H - The same freed l2cap_conn can be reallocated under attacker control while hci_conn_timeout() still holds the pointer; heap UAF of this object enables spraying and write/control-flow hijack, and the stale disc_reason is consumed as the HCI abort reason.\nA:H - The syzbot report is a slab-use-after-free read of conn-\u003edisc_reason in l2cap_disconn_ind() from the hci_conn_timeout worker, which oopses or panics the kernel when the freed l2cap_conn slab is touched."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:40.034Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0fa448369c87e20b2aeaeaca0187d698dd61f791"
},
{
"url": "https://git.kernel.org/stable/c/7c032b6d48a46634cbd58aaebad2638c00ad3b51"
},
{
"url": "https://git.kernel.org/stable/c/b495a3a9b33bc4e4613e685bf5c96c136caa22d8"
},
{
"url": "https://git.kernel.org/stable/c/2b66c83ff1751d6bd3201b3017206262ab46dc05"
}
],
"title": "Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90256",
"datePublished": "2026-09-17T16:07:55.427Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-21T12:50:40.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99158 (GCVE-0-2026-99158)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix false warning in ring_buffer_map_get_reader()
The mmap reader can warn when it catches up with a writer that is still
committing events. rb_get_reader_page() returns NULL in this case, but
ring_buffer_map_get_reader() treats that result as an error.
The initial rb_per_cpu_empty() check filters out an empty buffer, but it
does not guarantee that the next reader page has committed data. Writers
do not take reader_lock and can advance commit_page before publishing the
committed length on the new page. rb_get_reader_page() can swap to that
page, catch up with the writer and return NULL.
Handle NULL through the existing no-data exit without warning. Remove the
caller's reader_page == commit_page check as well, since the reader-page
helper already handles that case. The existing metadata update and return
path remain in place.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "32751946f9b3e502e3d6e42d98b343473112f887",
"status": "affected",
"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa",
"versionType": "git"
},
{
"lessThan": "029770f5badedc0f0ff85fc45e24785cbbee4a67",
"status": "affected",
"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa",
"versionType": "git"
},
{
"lessThan": "68e6ab180cfb6dfa79652f41ed7899a6d4cf5438",
"status": "affected",
"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa",
"versionType": "git"
},
{
"lessThan": "89bab1dba8a0167ef0d819e0f55b6bafa038e87f",
"status": "affected",
"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix false warning in ring_buffer_map_get_reader()\n\nThe mmap reader can warn when it catches up with a writer that is still\ncommitting events. rb_get_reader_page() returns NULL in this case, but\nring_buffer_map_get_reader() treats that result as an error.\n\nThe initial rb_per_cpu_empty() check filters out an empty buffer, but it\ndoes not guarantee that the next reader page has committed data. Writers\ndo not take reader_lock and can advance commit_page before publishing the\ncommitted length on the new page. rb_get_reader_page() can swap to that\npage, catch up with the writer and return NULL.\n\nHandle NULL through the existing no-data exit without warning. Remove the\ncaller\u0027s reader_page == commit_page check as well, since the reader-page\nhelper already handles that case. The existing metadata update and return\npath remain in place."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:24.782Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/32751946f9b3e502e3d6e42d98b343473112f887"
},
{
"url": "https://git.kernel.org/stable/c/029770f5badedc0f0ff85fc45e24785cbbee4a67"
},
{
"url": "https://git.kernel.org/stable/c/68e6ab180cfb6dfa79652f41ed7899a6d4cf5438"
},
{
"url": "https://git.kernel.org/stable/c/89bab1dba8a0167ef0d819e0f55b6bafa038e87f"
}
],
"title": "ring-buffer: Fix false warning in ring_buffer_map_get_reader()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99158",
"datePublished": "2026-10-28T10:35:11.848Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-30T12:42:24.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90161 (GCVE-0-2026-90161)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix interlaced ztailpacking pclusters
On-disk sizes of interlaced pclusters should be block-aligned, and
ztailpacking interlaced pclusters should be invalid at all.
Currently, mkfs.erofs won't generate any interlaced pcluster with
ztailpacking enabled, so this doesn't affect any existing valid
filesystems.
However, crafted images can contain invalid interlaced ztailpacking
pclusters, resulting in an out-of-bounds read from a kmap'd page and
copying irrelevant kernel memory into userspace-visible page cache.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fdffc091e6f94602558bba712b51bc16f79fd6d5 Version: fdffc091e6f94602558bba712b51bc16f79fd6d5 Version: fdffc091e6f94602558bba712b51bc16f79fd6d5 Version: fdffc091e6f94602558bba712b51bc16f79fd6d5 Version: fdffc091e6f94602558bba712b51bc16f79fd6d5 Version: fdffc091e6f94602558bba712b51bc16f79fd6d5 Version: 7d6ef8277e44c22f894d54d26ddb36c22d60712d Version: 6.0.16 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/decompressor.c",
"fs/erofs/zmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b634286a8628155557a4f473a9dbab18bb439a7b",
"status": "affected",
"version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
"versionType": "git"
},
{
"lessThan": "795dca34a41545d377d19bc492b10bc789772410",
"status": "affected",
"version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
"versionType": "git"
},
{
"lessThan": "cd59f91cbc1e715cb5dc65773ee22123d70cb8f2",
"status": "affected",
"version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
"versionType": "git"
},
{
"lessThan": "ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054",
"status": "affected",
"version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
"versionType": "git"
},
{
"lessThan": "451027c642e752420e1a04237db9ce7b35cee595",
"status": "affected",
"version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
"versionType": "git"
},
{
"lessThan": "862427ebb81d1f6abbf74d799790e1694b37b187",
"status": "affected",
"version": "fdffc091e6f94602558bba712b51bc16f79fd6d5",
"versionType": "git"
},
{
"status": "affected",
"version": "7d6ef8277e44c22f894d54d26ddb36c22d60712d",
"versionType": "git"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/decompressor.c",
"fs/erofs/zmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix interlaced ztailpacking pclusters\n\nOn-disk sizes of interlaced pclusters should be block-aligned, and\nztailpacking interlaced pclusters should be invalid at all.\n\nCurrently, mkfs.erofs won\u0027t generate any interlaced pcluster with\nztailpacking enabled, so this doesn\u0027t affect any existing valid\nfilesystems.\n\nHowever, crafted images can contain invalid interlaced ztailpacking\npclusters, resulting in an out-of-bounds read from a kmap\u0027d page and\ncopying irrelevant kernel memory into userspace-visible page cache."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malformed bytes are on-disk in z_erofs_map_header.h_advise (Z_EROFS_ADVISE_INTERLACED_PCLUSTER|Z_EROFS_ADVISE_INLINE_PCLUSTER) and a PLAIN tail lcluster; z_erofs_read_folio/z_erofs_readahead pass them into z_erofs_map_blocks_fo when that compressed file\u0027s tail is read. No network protocol message carries those fields.\nAC:L - Setting both advise flags plus z_idata_size on a compressed inode with a PLAIN EOF lcluster makes z_erofs_map_blocks_fo assign Z_EROFS_COMPRESSION_INTERLACED despite EROFS_MAP_META; the following read of that tail reaches z_erofs_transform_plain every time, with no race or attacker-uncontrolled condition.\nPR:N - Crafting and supplying the interlaced+ztailpacking image requires no account on the target. erofs_fs_type has FS_REQUIRES_DEV and lacks FS_USERNS_MOUNT, so the attacker cannot self-mount in a userns; the CAP_SYS_ADMIN mount is the victim\u0027s action and is scored as UI:R.\nUI:R - A victim or automounter must mount the attacker-supplied EROFS image and read the compressed file so z_erofs_read_folio maps the ztailpacking pcluster. erofs_read_superblock and erofs_fill_inode do not call z_erofs_map_blocks_fo for that tail.\nS:U - The over-read in z_erofs_transform_plain and the memcpy_to_page into the file folio stay inside the host kernel; this does not cross a KVM/Xen, IOMMU, or sandbox authority.\nC:H - z_erofs_transform_plain kmaps the inline-metadata page and copies cur bytes from kin+pi into the output folio via memcpy_to_page. Unaligned ztailpacking pageofs_in (map-\u003em_pa \u0026 ~PAGE_MASK) makes pi+cur run off that page, so up to a block of adjacent kernel memory becomes readable through the file.\nI:N - The write lands in rq-\u003eout[0] at pageofs_out for length cur=min(bs-(pageofs_out\u0026(bs-1)),outputsize), which stays inside the first output folio. The defect is an input-side over-read, not an OOB write or corruption of kernel control data.\nA:H - The kmap_local_page over-read in the interlaced branch of z_erofs_transform_plain can fault when the next virtual page is unmapped (HIGHMEM kmap slots, debug_pagealloc, KASAN), oopsing the kernel, and reading the crafted tail again retriggers it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:30.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b634286a8628155557a4f473a9dbab18bb439a7b"
},
{
"url": "https://git.kernel.org/stable/c/795dca34a41545d377d19bc492b10bc789772410"
},
{
"url": "https://git.kernel.org/stable/c/cd59f91cbc1e715cb5dc65773ee22123d70cb8f2"
},
{
"url": "https://git.kernel.org/stable/c/ddb7ea4fd99bf6c4314d1dfca18aec6945ce8054"
},
{
"url": "https://git.kernel.org/stable/c/451027c642e752420e1a04237db9ce7b35cee595"
},
{
"url": "https://git.kernel.org/stable/c/862427ebb81d1f6abbf74d799790e1694b37b187"
}
],
"title": "erofs: fix interlaced ztailpacking pclusters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90161",
"datePublished": "2026-09-17T16:06:52.470Z",
"dateReserved": "2026-09-11T19:38:34.790Z",
"dateUpdated": "2026-10-30T12:34:30.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89913 (GCVE-0-2026-89913)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
vgic_v3_save_pending_tables() iterates dist->lpi_xa using xa_for_each()
and dereferences the returned struct vgic_irq in the loop body without
holding a reference on the LPI.
The xarray iterator only provides temporary RCU coverage while looking up
the current entry. That is not sufficient for this loop body, which reads
fields from struct vgic_irq and performs guest memory accesses before the
iteration completes.
A concurrent path can trigger this race: the irqfd cached injection path
(vgic_its_inject_cached_translation) obtains a transient LPI reference
via vgic_its_check_cache() without holding kvm->lock, vcpu->mutex,
config_lock, or its_lock. If guest ITS DISCARD then drops the cache and
ITE references under its_lock, the transient inject reference may become
the final one. When vgic_put_irq() drops it, the LPI is erased from
lpi_xa and freed via kfree_rcu(). Meanwhile, vgic_v3_save_pending_tables()
may still hold a stale pointer obtained from the xarray iterator and
dereference it after the RCU grace period completes.
Fix this by re-fetching each iterated LPI via vgic_get_irq(), which takes
a stable reference, and dropping it with vgic_put_irq() on all paths.
This matches the pattern already used by other lpi_xa iterators in the
vgic ITS code.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-v3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4000462866bc71f16d1bfb3cf8e969f95150cd64",
"status": "affected",
"version": "280771252c1bae0947215c59fb9ea6a8d9f8399d",
"versionType": "git"
},
{
"lessThan": "7631f95297560157d3a9283cb999e3be00103348",
"status": "affected",
"version": "280771252c1bae0947215c59fb9ea6a8d9f8399d",
"versionType": "git"
},
{
"lessThan": "d3a2d20b7248ea67465af1cf79c79f90ff70926c",
"status": "affected",
"version": "280771252c1bae0947215c59fb9ea6a8d9f8399d",
"versionType": "git"
},
{
"lessThan": "f5b8f203bfc07a5a257dff859e66d2c500f9f509",
"status": "affected",
"version": "280771252c1bae0947215c59fb9ea6a8d9f8399d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-v3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables\n\nvgic_v3_save_pending_tables() iterates dist-\u003elpi_xa using xa_for_each()\nand dereferences the returned struct vgic_irq in the loop body without\nholding a reference on the LPI.\n\nThe xarray iterator only provides temporary RCU coverage while looking up\nthe current entry. That is not sufficient for this loop body, which reads\nfields from struct vgic_irq and performs guest memory accesses before the\niteration completes.\n\nA concurrent path can trigger this race: the irqfd cached injection path\n(vgic_its_inject_cached_translation) obtains a transient LPI reference\nvia vgic_its_check_cache() without holding kvm-\u003elock, vcpu-\u003emutex,\nconfig_lock, or its_lock. If guest ITS DISCARD then drops the cache and\nITE references under its_lock, the transient inject reference may become\nthe final one. When vgic_put_irq() drops it, the LPI is erased from\nlpi_xa and freed via kfree_rcu(). Meanwhile, vgic_v3_save_pending_tables()\nmay still hold a stale pointer obtained from the xarray iterator and\ndereference it after the RCU grace period completes.\n\nFix this by re-fetching each iterated LPI via vgic_get_irq(), which takes\na stable reference, and dropping it with vgic_put_irq() on all paths.\nThis matches the pattern already used by other lpi_xa iterators in the\nvgic ITS code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only via local KVM: KVM_SET_DEVICE_ATTR(KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES) on the VGIC device fd, irqfd/KVM_SIGNAL_MSI cached injection, and guest GICv3 ITS MMIO writes to GITS_CWRITER (DISCARD); there is no network, adjacent, or physical path.\nAC:L - A kvm-group attacker who owns the VMM controls every side of the race (irqfd/KVM_SIGNAL_MSI cached inject, guest ITS DISCARD, and SAVE_PENDING_TABLES). The save path sleeps in kvm_read_guest_lock() so the kfree_rcu() window is attacker-driven rather than an uninfluenced host condition.\nPR:L - Creating a VM and issuing VGIC device attributes requires only /dev/kvm access (typically 0660 kvm group) or tenancy in an arm64 KVM guest; kvm_dev_ioctl_create_vm() and kvm_device_ioctl() have no capable() gate, so init-namespace root is not required.\nUI:N - The attacker issues the VGIC save ioctl, irqfd/MSI injection, and guest ITS DISCARD themselves; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:C - Use-after-free of host-kernel struct vgic_irq in KVM\u0027s VGIC ITS LPI xarray crosses the guest-to-host hypervisor boundary; corrupting host LPI objects from a VM/VMM can escape the guest security authority.\nC:H - This is a host-kernel use-after-free of struct vgic_irq after kfree_rcu(); reclaiming the freed object lets the save loop read attacker-controlled irq fields (target_vcpu, intid, pending_latch), yielding an arbitrary host kernel read primitive.\nI:H - Host heap UAF of vgic_irq with attacker-controlled irqfd/DISCARD timing enables heap spray of fake irq objects, providing write and control-flow hijack primitives against the host kernel.\nA:H - Dereferencing the freed vgic_irq after the RCU grace period (the save path sleeps in kvm_read_guest_lock()) causes a host kernel oops or panic even without a full exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:08.468Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4000462866bc71f16d1bfb3cf8e969f95150cd64"
},
{
"url": "https://git.kernel.org/stable/c/7631f95297560157d3a9283cb999e3be00103348"
},
{
"url": "https://git.kernel.org/stable/c/d3a2d20b7248ea67465af1cf79c79f90ff70926c"
},
{
"url": "https://git.kernel.org/stable/c/f5b8f203bfc07a5a257dff859e66d2c500f9f509"
}
],
"title": "KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89913",
"datePublished": "2026-09-16T10:32:09.947Z",
"dateReserved": "2026-09-11T19:38:34.774Z",
"dateUpdated": "2026-10-21T12:49:08.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98085 (GCVE-0-2026-98085)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Nicholas Carlini reported a bug in precision backtracking mechanism
for BPF_LD | BPF_{IND,ABS} instructions. These instructions are
modelled as two branches:
- fallthrough;
- implicit exit from current subprogram.
The implicit exit case was not handled by the backtrack_insn()
function. When backtracking such a path backtrack_insn() did not
call bt_subprog_enter(), which meant that backtracking continued
manipulating precision marks in a caller frame, while looking at
instructions in a callee frame.
This lead to segmentation faults during verification (see the
selftest), or unsound state pruning.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 37ad2bb11e9de92cb7b94548705eeedd87f7d392 Version: 8674e2db06cff6b50f2216eed9a761d15425bb34 Version: ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337 Version: ee861486e377edc55361c08dcbceab3f6b6577bd Version: ee861486e377edc55361c08dcbceab3f6b6577bd Version: 928d354ae3557e8f755a227e67be88034eb3cd7f Version: 8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe Version: de1055e7f9e67af32b1f3376066272b04e5223c0 Version: d846d83bdacbd8f14fc45c63b8c1d22608452e1c Version: 6.6.148 ≤ Version: 6.12.101 ≤ Version: 6.18.42 ≤ Version: 5.10.265 ≤ Version: 5.15.216 ≤ Version: 6.1.183 ≤ Version: 7.0.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/backtrack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "19cca7c36055906b3cff3e297618ee8a50cde25d",
"status": "affected",
"version": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
"versionType": "git"
},
{
"lessThan": "12c064bcfa56e3631be9f5336ee113b7f849959a",
"status": "affected",
"version": "8674e2db06cff6b50f2216eed9a761d15425bb34",
"versionType": "git"
},
{
"lessThan": "a0cd9e22f8faed30a8da8be357c51bd8b3074ee9",
"status": "affected",
"version": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
"versionType": "git"
},
{
"lessThan": "671b7b9a660ef15b25faa3df161205b9dc8d1eb2",
"status": "affected",
"version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
"versionType": "git"
},
{
"lessThan": "387b1baefbb776e3f48dc2261e77a49213f470f7",
"status": "affected",
"version": "ee861486e377edc55361c08dcbceab3f6b6577bd",
"versionType": "git"
},
{
"status": "affected",
"version": "928d354ae3557e8f755a227e67be88034eb3cd7f",
"versionType": "git"
},
{
"status": "affected",
"version": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
"versionType": "git"
},
{
"status": "affected",
"version": "de1055e7f9e67af32b1f3376066272b04e5223c0",
"versionType": "git"
},
{
"status": "affected",
"version": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThan": "6.18.57",
"status": "affected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/backtrack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.18.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.265",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge\n\nNicholas Carlini reported a bug in precision backtracking mechanism\nfor BPF_LD | BPF_{IND,ABS} instructions. These instructions are\nmodelled as two branches:\n- fallthrough;\n- implicit exit from current subprogram.\n\nThe implicit exit case was not handled by the backtrack_insn()\nfunction. When backtracking such a path backtrack_insn() did not\ncall bt_subprog_enter(), which meant that backtracking continued\nmanipulating precision marks in a caller frame, while looking at\ninstructions in a callee frame.\n\nThis lead to segmentation faults during verification (see the\nselftest), or unsound state pruning."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:27.055Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/19cca7c36055906b3cff3e297618ee8a50cde25d"
},
{
"url": "https://git.kernel.org/stable/c/12c064bcfa56e3631be9f5336ee113b7f849959a"
},
{
"url": "https://git.kernel.org/stable/c/a0cd9e22f8faed30a8da8be357c51bd8b3074ee9"
},
{
"url": "https://git.kernel.org/stable/c/671b7b9a660ef15b25faa3df161205b9dc8d1eb2"
},
{
"url": "https://git.kernel.org/stable/c/387b1baefbb776e3f48dc2261e77a49213f470f7"
}
],
"title": "bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98085",
"datePublished": "2026-09-25T10:24:20.485Z",
"dateReserved": "2026-09-25T10:19:56.075Z",
"dateUpdated": "2026-10-21T12:54:27.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90182 (GCVE-0-2026-90182)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-iocost: clear delay state when freeing policy data
iocg_kick_delay() turns sufficiently large debt into an explicit
block-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to
-1 and incrementing blkcg->congestion_count. Clearing it again depends
on iocg_kick_delay() running from the period timer, the waitq timer or
the issue path.
ioc_pd_free() removes the iocg from active_iocgs and cancels its waitq
timer, and no further bios can arrive, so once it has run nothing is
left which can reduce the debt and clear the delay. The blkcg stays
marked congested for the rest of its life.
blk_cgroup_congested() then returns true for every task in that cgroup
and its descendants: page_cache_sync_ra() cuts readahead to a single
page, page_cache_async_ra() skips it altogether, and
__folio_throttle_swaprate() takes swap_avail_lock and schedules a
throttle on anonymous folio allocation.
Clear it explicitly, after the list removal and the synchronous
hrtimer_cancel() so that neither timer processing nor an I/O path can
re-arm it. The free callback can also see policy data which was never
attached to a blkg, hence the pd->blkg check.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7caa47151ab2e644dd221f741ec7578d9532c9a3 Version: 7caa47151ab2e644dd221f741ec7578d9532c9a3 Version: 7caa47151ab2e644dd221f741ec7578d9532c9a3 Version: 7caa47151ab2e644dd221f741ec7578d9532c9a3 Version: 7caa47151ab2e644dd221f741ec7578d9532c9a3 Version: 7caa47151ab2e644dd221f741ec7578d9532c9a3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-iocost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6942cb740fb17b24731728b25994eba361776011",
"status": "affected",
"version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
"versionType": "git"
},
{
"lessThan": "6b59f976db5def818829fc1eb4efc0a5c8c2f0cf",
"status": "affected",
"version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
"versionType": "git"
},
{
"lessThan": "8b4d0b1b3079bbe9a5366e2c8020eb22926733b6",
"status": "affected",
"version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
"versionType": "git"
},
{
"lessThan": "b399a88eb8b16c5a1a3645fd49ff507fb82b363c",
"status": "affected",
"version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
"versionType": "git"
},
{
"lessThan": "b9c16db833e3ff15d923282f94dddf0e10fab8c0",
"status": "affected",
"version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
"versionType": "git"
},
{
"lessThan": "97cb95d2148835ae86ff916b145aef332d40439d",
"status": "affected",
"version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-iocost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iocost: clear delay state when freeing policy data\n\niocg_kick_delay() turns sufficiently large debt into an explicit\nblock-cgroup delay with blkcg_set_delay(), setting blkg-\u003euse_delay to\n-1 and incrementing blkcg-\u003econgestion_count. Clearing it again depends\non iocg_kick_delay() running from the period timer, the waitq timer or\nthe issue path.\n\nioc_pd_free() removes the iocg from active_iocgs and cancels its waitq\ntimer, and no further bios can arrive, so once it has run nothing is\nleft which can reduce the debt and clear the delay. The blkcg stays\nmarked congested for the rest of its life.\n\nblk_cgroup_congested() then returns true for every task in that cgroup\nand its descendants: page_cache_sync_ra() cuts readahead to a single\npage, page_cache_async_ra() skips it altogether, and\n__folio_throttle_swaprate() takes swap_avail_lock and schedules a\nthrottle on anonymous folio allocation.\n\nClear it explicitly, after the list removal and the synchronous\nhrtimer_cancel() so that neither timer processing nor an I/O path can\nre-arm it. The free callback can also see policy data which was never\nattached to a blkg, hence the pd-\u003eblkg check."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:38.845Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6942cb740fb17b24731728b25994eba361776011"
},
{
"url": "https://git.kernel.org/stable/c/6b59f976db5def818829fc1eb4efc0a5c8c2f0cf"
},
{
"url": "https://git.kernel.org/stable/c/8b4d0b1b3079bbe9a5366e2c8020eb22926733b6"
},
{
"url": "https://git.kernel.org/stable/c/b399a88eb8b16c5a1a3645fd49ff507fb82b363c"
},
{
"url": "https://git.kernel.org/stable/c/b9c16db833e3ff15d923282f94dddf0e10fab8c0"
},
{
"url": "https://git.kernel.org/stable/c/97cb95d2148835ae86ff916b145aef332d40439d"
}
],
"title": "blk-iocost: clear delay state when freeing policy data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90182",
"datePublished": "2026-09-17T16:07:06.388Z",
"dateReserved": "2026-09-11T19:38:34.791Z",
"dateUpdated": "2026-10-30T12:34:38.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99179 (GCVE-0-2026-99179)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
watch_queue: Fix note pool publication race in watch_queue_set_size()
There is a race between watch_queue_set_size() and post_one_notification().
watch_queue_set_size() publishes wqueue->notes, notes_bitmap, nr_pages and
nr_notes with plain stores, and post_one_notification() reads them with
plain loads under a different lock, so nothing orders the four stores
against the poster's loads: depending on the build, notes can be stored
last (gcc 14 on x86-64 does this). Since keyctl_watch_key() lets a watch
attach to a queue before it is sized, post_one_notification() can already
be running on another CPU at that moment: it reads nr_notes > 0, passes
its bounds check, and then reads notes while it is still NULL,
dereferencing notes[0].
An unprivileged user triggers this reliably by watching one of its own
keys through a notification pipe and racing ioctl(IOC_WATCH_QUEUE_SET_SIZE)
on that pipe against keyctl(KEYCTL_SETPERM) on the key from another CPU,
triggering:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:post_one_notification.isra.0+0xa2/0x1e0
Call Trace:
__post_watch_notification+0x148/0x180
keyctl_setperm_key+0x119/0x130
do_syscall_64+0x108/0x4c0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: Fatal exception in interrupt
Fix this by publishing nr_notes last with smp_store_release(), and by
reading it once with smp_load_acquire() in post_one_notification() before
the bitmap and the page array are touched. A poster that observes a
non-zero nr_notes then also observes the pool behind it; one that observes
zero drops the notification as before.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd Version: c73be61cede5882f9605a852414db559c0ebedfd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/watch_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2137d487b25eefa862be70de489b64f4c679fe1f",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "6aaa6c1a1b61aae332d6e7e0083140b86ea51e14",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "4b20867d80e7e91fb7db531f34035d91591ba405",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "da52e5fcb2cae6acdc0d5722ff83499f8232b9d1",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "f94c45f83e688e41dfe1b3a589806a0a25567260",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "811fb6d0b07605e8e8d93bde8748be4b3028809a",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "9e73a6754457ffed8399b835552013b9363e51d1",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
},
{
"lessThan": "5e531d62f1f8834faf7a4eed0d41105cf6570a8f",
"status": "affected",
"version": "c73be61cede5882f9605a852414db559c0ebedfd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/watch_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix note pool publication race in watch_queue_set_size()\n\nThere is a race between watch_queue_set_size() and post_one_notification().\nwatch_queue_set_size() publishes wqueue-\u003enotes, notes_bitmap, nr_pages and\nnr_notes with plain stores, and post_one_notification() reads them with\nplain loads under a different lock, so nothing orders the four stores\nagainst the poster\u0027s loads: depending on the build, notes can be stored\nlast (gcc 14 on x86-64 does this). Since keyctl_watch_key() lets a watch\nattach to a queue before it is sized, post_one_notification() can already\nbe running on another CPU at that moment: it reads nr_notes \u003e 0, passes\nits bounds check, and then reads notes while it is still NULL,\ndereferencing notes[0].\n\nAn unprivileged user triggers this reliably by watching one of its own\nkeys through a notification pipe and racing ioctl(IOC_WATCH_QUEUE_SET_SIZE)\non that pipe against keyctl(KEYCTL_SETPERM) on the key from another CPU,\ntriggering:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n RIP: 0010:post_one_notification.isra.0+0xa2/0x1e0\n Call Trace:\n __post_watch_notification+0x148/0x180\n keyctl_setperm_key+0x119/0x130\n do_syscall_64+0x108/0x4c0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n Kernel panic - not syncing: Fatal exception in interrupt\n\nFix this by publishing nr_notes last with smp_store_release(), and by\nreading it once with smp_load_acquire() in post_one_notification() before\nthe bitmap and the page array are touched. A poster that observes a\nnon-zero nr_notes then also observes the pool behind it; one that observes\nzero drops the notification as before."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:42.438Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2137d487b25eefa862be70de489b64f4c679fe1f"
},
{
"url": "https://git.kernel.org/stable/c/6aaa6c1a1b61aae332d6e7e0083140b86ea51e14"
},
{
"url": "https://git.kernel.org/stable/c/4b20867d80e7e91fb7db531f34035d91591ba405"
},
{
"url": "https://git.kernel.org/stable/c/da52e5fcb2cae6acdc0d5722ff83499f8232b9d1"
},
{
"url": "https://git.kernel.org/stable/c/f94c45f83e688e41dfe1b3a589806a0a25567260"
},
{
"url": "https://git.kernel.org/stable/c/811fb6d0b07605e8e8d93bde8748be4b3028809a"
},
{
"url": "https://git.kernel.org/stable/c/9e73a6754457ffed8399b835552013b9363e51d1"
},
{
"url": "https://git.kernel.org/stable/c/5e531d62f1f8834faf7a4eed0d41105cf6570a8f"
}
],
"title": "watch_queue: Fix note pool publication race in watch_queue_set_size()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99179",
"datePublished": "2026-10-28T10:35:32.734Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:42.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99157 (GCVE-0-2026-99157)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per
job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct
ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command
returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after
the 40-byte header and writes 8 bytes past the end of the buffer.
Let each BSG transport pass its reply buffer size to bsg_setup_queue()
and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full
reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bsg-lib.c",
"drivers/scsi/mpi3mr/mpi3mr_app.c",
"drivers/scsi/scsi_transport_fc.c",
"drivers/scsi/scsi_transport_iscsi.c",
"drivers/scsi/scsi_transport_sas.c",
"drivers/ufs/core/ufs_bsg.c",
"include/linux/bsg-lib.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "913a1876fbe9a168030013b9e6cb2746fe41fff4",
"status": "affected",
"version": "6ff265fc5ef660499e0edc4641647e99eed3f519",
"versionType": "git"
},
{
"lessThan": "bfb0582708b3432919a8baaa3a65de5fdb1490ea",
"status": "affected",
"version": "6ff265fc5ef660499e0edc4641647e99eed3f519",
"versionType": "git"
},
{
"lessThan": "2effbe746452c108188f85a6951f2b0b65653840",
"status": "affected",
"version": "6ff265fc5ef660499e0edc4641647e99eed3f519",
"versionType": "git"
},
{
"lessThan": "7a755f6d47b811d3abd93c1642ce5e63894540b8",
"status": "affected",
"version": "6ff265fc5ef660499e0edc4641647e99eed3f519",
"versionType": "git"
},
{
"lessThan": "ec6b083915e8146e147314a5f4f1285d07b57bfc",
"status": "affected",
"version": "6ff265fc5ef660499e0edc4641647e99eed3f519",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bsg-lib.c",
"drivers/scsi/mpi3mr/mpi3mr_app.c",
"drivers/scsi/scsi_transport_fc.c",
"drivers/scsi/scsi_transport_iscsi.c",
"drivers/scsi/scsi_transport_sas.c",
"drivers/ufs/core/ufs_bsg.c",
"include/linux/bsg-lib.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies\n\nbsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per\njob, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct\nufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command\nreturns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after\nthe 40-byte header and writes 8 bytes past the end of the buffer.\n\nLet each BSG transport pass its reply buffer size to bsg_setup_queue()\nand have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full\nreply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:23.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/913a1876fbe9a168030013b9e6cb2746fe41fff4"
},
{
"url": "https://git.kernel.org/stable/c/bfb0582708b3432919a8baaa3a65de5fdb1490ea"
},
{
"url": "https://git.kernel.org/stable/c/2effbe746452c108188f85a6951f2b0b65653840"
},
{
"url": "https://git.kernel.org/stable/c/7a755f6d47b811d3abd93c1642ce5e63894540b8"
},
{
"url": "https://git.kernel.org/stable/c/ec6b083915e8146e147314a5f4f1285d07b57bfc"
}
],
"title": "scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99157",
"datePublished": "2026-10-28T10:35:11.192Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-30T12:42:23.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74728 (GCVE-0-2026-74728)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: handle NULL b_addr in xfs_buf_free
When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
bp->b_addr still NULL. The code falls through to the folio_put path
which calls virt_to_folio(NULL), dereferencing an invalid address and
causing a kernel crash.
Call Trace:
xfs_buf_free+0x25f/0x510
xfs_buf_alloc+0xc98/0x19b0
xfs_buf_find_insert+0x55/0x14d0
xfs_buf_get_map+0x122b/0x17c0
xfbtree_init_leaf_block+0x11c/0x4a0
xfbtree_init+0x1bb/0x460
xrep_rmap_setup_scan+0x100/0x1f0
xrep_rmapbt+0x41/0xc0
Fix this by skipping folio_put() when bp->b_addr is NULL.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "444ff50ece93060131ad84fbd3f378723d8ac243",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
},
{
"lessThan": "ccf6738adcafa5ddbddc4e71b45d8a51b86643c7",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
},
{
"lessThan": "3aa0c1d23ee1b9d9b340fb2f4736536e1408d706",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
},
{
"lessThan": "d852729c5f4f830fbe7413df032e29459b3daf83",
"status": "affected",
"version": "5076a6040ca1613e616d84aecfaac5f932db84e0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: handle NULL b_addr in xfs_buf_free\n\nWhen xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with\nbp-\u003eb_addr still NULL. The code falls through to the folio_put path\nwhich calls virt_to_folio(NULL), dereferencing an invalid address and\ncausing a kernel crash.\n\n Call Trace:\n xfs_buf_free+0x25f/0x510\n xfs_buf_alloc+0xc98/0x19b0\n xfs_buf_find_insert+0x55/0x14d0\n xfs_buf_get_map+0x122b/0x17c0\n xfbtree_init_leaf_block+0x11c/0x4a0\n xfbtree_init+0x1bb/0x460\n xrep_rmap_setup_scan+0x100/0x1f0\n xrep_rmapbt+0x41/0xc0\n\nFix this by skipping folio_put() when bp-\u003eb_addr is NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:17.289Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/444ff50ece93060131ad84fbd3f378723d8ac243"
},
{
"url": "https://git.kernel.org/stable/c/ccf6738adcafa5ddbddc4e71b45d8a51b86643c7"
},
{
"url": "https://git.kernel.org/stable/c/3aa0c1d23ee1b9d9b340fb2f4736536e1408d706"
},
{
"url": "https://git.kernel.org/stable/c/d852729c5f4f830fbe7413df032e29459b3daf83"
}
],
"title": "xfs: handle NULL b_addr in xfs_buf_free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74728",
"datePublished": "2026-08-22T15:33:18.412Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-10-21T12:46:17.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23327 (GCVE-0-2026-23327)
Vulnerability from cvelistv5
Published
2026-03-25 10:27
Modified
2026-11-05 21:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
cxl_payload_from_user_allowed() casts and dereferences the input
payload without first verifying its size. When a raw mailbox command
is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,
which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,
triggering a KASAN splat:
BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683
Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258
CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xce/0x650 mm/kasan/report.c:482
kasan_report+0xce/0x100 mm/kasan/report.c:595
memcmp+0x176/0x1d0 lib/string.c:683
uuid_equal include/linux/uuid.h:73 [inline]
cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]
cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]
cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]
cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643
__cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]
cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdaf331ba79
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79
RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003
RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768
</TASK>
Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate
the payload is large enough.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6179045ccc0c6229dc449afc1701dc7fbd40571f Version: 6179045ccc0c6229dc449afc1701dc7fbd40571f Version: 6179045ccc0c6229dc449afc1701dc7fbd40571f Version: 6179045ccc0c6229dc449afc1701dc7fbd40571f Version: 6179045ccc0c6229dc449afc1701dc7fbd40571f Version: 6179045ccc0c6229dc449afc1701dc7fbd40571f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:26:57.683069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:33:38.949Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/mbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0874ca9282ccf5aeae559c697dd1feb577aad0e",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
},
{
"lessThan": "3555e41737c0f8b5b53a511573661477e3942dee",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
},
{
"lessThan": "483b7eb4b1b2a03235afe1b274732dcf8231d4ec",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
},
{
"lessThan": "dc184ac2f0ba77ae19725ee06ad3ab36bb9d1f61",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
},
{
"lessThan": "7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
},
{
"lessThan": "60b5d1f68338aff2c5af0113f04aefa7169c50c2",
"status": "affected",
"version": "6179045ccc0c6229dc449afc1701dc7fbd40571f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cxl/core/mbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()\n\ncxl_payload_from_user_allowed() casts and dereferences the input\npayload without first verifying its size. When a raw mailbox command\nis sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG,\nwhich expects a 16-byte UUID), uuid_equal() reads past the allocated buffer,\ntriggering a KASAN splat:\n\nBUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683\nRead of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258\n\nCPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x650 mm/kasan/report.c:482\n kasan_report+0xce/0x100 mm/kasan/report.c:595\n memcmp+0x176/0x1d0 lib/string.c:683\n uuid_equal include/linux/uuid.h:73 [inline]\n cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline]\n cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline]\n cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline]\n cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643\n __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline]\n cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdaf331ba79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79\nRDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003\nRBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768\n \u003c/TASK\u003e\n\nAdd \u0027in_size\u0027 parameter to cxl_payload_from_user_allowed() and validate\nthe payload is large enough."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:55.930Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0874ca9282ccf5aeae559c697dd1feb577aad0e"
},
{
"url": "https://git.kernel.org/stable/c/3555e41737c0f8b5b53a511573661477e3942dee"
},
{
"url": "https://git.kernel.org/stable/c/483b7eb4b1b2a03235afe1b274732dcf8231d4ec"
},
{
"url": "https://git.kernel.org/stable/c/dc184ac2f0ba77ae19725ee06ad3ab36bb9d1f61"
},
{
"url": "https://git.kernel.org/stable/c/7c8a7b7f063b7e7ae9bba4cbaa14a5d2fe3a55e1"
},
{
"url": "https://git.kernel.org/stable/c/60b5d1f68338aff2c5af0113f04aefa7169c50c2"
}
],
"title": "cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23327",
"datePublished": "2026-03-25T10:27:19.815Z",
"dateReserved": "2026-01-13T15:37:45.996Z",
"dateUpdated": "2026-11-05T21:33:38.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23472 (GCVE-0-2026-23472)
Vulnerability from cvelistv5
Published
2026-04-03 15:15
Modified
2026-11-05 21:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
uart_write_room() and uart_write() behave inconsistently when
xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were
never properly initialized):
- uart_write_room() returns kfifo_avail() which can be > 0
- uart_write() checks xmit_buf and returns 0 if NULL
This inconsistency causes an infinite loop in drivers that rely on
tty_write_room() to determine if they can write:
while (tty_write_room(tty) > 0) {
written = tty->ops->write(...);
// written is always 0, loop never exits
}
For example, caif_serial's handle_tx() enters an infinite loop when
used with PORT_UNKNOWN serial ports, causing system hangs.
Fix by making uart_write_room() also check xmit_buf and return 0 if
it's NULL, consistent with uart_write().
Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:31:44.190630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:33:48.217Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/serial_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91c2a5d201daf66fa3f42b8a383bb89174bde2c8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c9e845014723d552944cec4e146ec7b841cda34d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d45cfa70bf0159afb31cb03d2d16ec5a5053460c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "efe85a557186b7fe915572ae93a8f3f78bfd9a22",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bc70f2b36cf474d5cc8ecbcaf57f3e326fdec67c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "455ce986fa356ff43a43c0d363ba95fa152f21d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/serial_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN\n\nuart_write_room() and uart_write() behave inconsistently when\nxmit_buf is NULL (which happens for PORT_UNKNOWN ports that were\nnever properly initialized):\n\n- uart_write_room() returns kfifo_avail() which can be \u003e 0\n- uart_write() checks xmit_buf and returns 0 if NULL\n\nThis inconsistency causes an infinite loop in drivers that rely on\ntty_write_room() to determine if they can write:\n\n while (tty_write_room(tty) \u003e 0) {\n written = tty-\u003eops-\u003ewrite(...);\n // written is always 0, loop never exits\n }\n\nFor example, caif_serial\u0027s handle_tx() enters an infinite loop when\nused with PORT_UNKNOWN serial ports, causing system hangs.\n\nFix by making uart_write_room() also check xmit_buf and return 0 if\nit\u0027s NULL, consistent with uart_write().\n\nReproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:09.804Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91c2a5d201daf66fa3f42b8a383bb89174bde2c8"
},
{
"url": "https://git.kernel.org/stable/c/c9e845014723d552944cec4e146ec7b841cda34d"
},
{
"url": "https://git.kernel.org/stable/c/d45cfa70bf0159afb31cb03d2d16ec5a5053460c"
},
{
"url": "https://git.kernel.org/stable/c/efe85a557186b7fe915572ae93a8f3f78bfd9a22"
},
{
"url": "https://git.kernel.org/stable/c/bc70f2b36cf474d5cc8ecbcaf57f3e326fdec67c"
},
{
"url": "https://git.kernel.org/stable/c/455ce986fa356ff43a43c0d363ba95fa152f21d5"
}
],
"title": "serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23472",
"datePublished": "2026-04-03T15:15:51.209Z",
"dateReserved": "2026-01-13T15:37:46.022Z",
"dateUpdated": "2026-11-05T21:33:48.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43263 (GCVE-0-2026-43263)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Fix Null reference while testing fluster
When multi instances are created/destroyed, many interrupts happens
and structures for decoder are removed.
"struct vpu_instance" this structure is shared for all flow in the decoder,
so if the structure is not protected by lock, Null dereference
could happens sometimes.
IRQ Handler was spilt to two phases and Lock was added as well.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-helper.c",
"drivers/media/platform/chips-media/wave5/wave5-helper.h",
"drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
"drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c",
"drivers/media/platform/chips-media/wave5/wave5-vpu.c",
"drivers/media/platform/chips-media/wave5/wave5-vpuapi.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "925b8f99f92fc968990ebb4ec49c96ac2d4e600b",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "ea316b784fe6a61b29131c98cddb24e651b1dcbc",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "d12bcf183ec7da4305d848068d15f18044eaf62a",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "e66ff2b08e4ee1c4d3b84f24818e5bcc178cc3a4",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-helper.c",
"drivers/media/platform/chips-media/wave5/wave5-helper.h",
"drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
"drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c",
"drivers/media/platform/chips-media/wave5/wave5-vpu.c",
"drivers/media/platform/chips-media/wave5/wave5-vpuapi.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix Null reference while testing fluster\n\nWhen multi instances are created/destroyed, many interrupts happens\nand structures for decoder are removed.\n\"struct vpu_instance\" this structure is shared for all flow in the decoder,\nso if the structure is not protected by lock, Null dereference\ncould happens sometimes.\nIRQ Handler was spilt to two phases and Lock was added as well."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local V4L2 mem2mem device operations on the Wave5 decoder/encoder video node, using open/close and streaming ioctls. It is not directly reachable from network, adjacent wireless, or physical hotplug input.\nAC:L - The race is created by the attacker by running multiple codec instances, queuing decode/encode work, and closing instances while hardware completion interrupts are generated. The attacker controls the relevant workload and can retry, so no external uncontrollable condition is required.\nPR:L - The driver performs no capability or authentication checks in its open/ioctl path, but the attacker must have local access to the video device node as an unprivileged user or media client. There is no requirement for real root or init-namespace administrative privileges.\nUI:N - Once the attacker has local access to the device node or media client path, exploitation only requires attacker-issued ioctls and close operations. No separate victim action is needed.\nS:U - The bug is in a kernel media driver and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - Although reported as a NULL reference, the unlocked instance list allows interrupt completion handling to dereference `struct vpu_instance` and associated V4L2 mem2mem state while teardown is removing or freeing those objects. As a kernel use-after-free race, the highest defensible impact includes kernel memory disclosure.\nI:H - The same use-after-free race reaches function-pointer and object-state dereferences such as `inst-\u003eops-\u003efinish_process(inst)` after concurrent teardown. With heap reuse/spraying, the highest defensible impact includes arbitrary kernel control flow or memory modification.\nA:H - The observed and most direct impact is a NULL dereference/use-after-free during interrupt handling, producing an oops or kernel panic. The trigger can be repeated by a local attacker running codec instances."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:27.588Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/925b8f99f92fc968990ebb4ec49c96ac2d4e600b"
},
{
"url": "https://git.kernel.org/stable/c/ea316b784fe6a61b29131c98cddb24e651b1dcbc"
},
{
"url": "https://git.kernel.org/stable/c/d12bcf183ec7da4305d848068d15f18044eaf62a"
},
{
"url": "https://git.kernel.org/stable/c/e66ff2b08e4ee1c4d3b84f24818e5bcc178cc3a4"
}
],
"title": "media: chips-media: wave5: Fix Null reference while testing fluster",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43263",
"datePublished": "2026-05-06T11:28:50.188Z",
"dateReserved": "2026-05-01T14:12:55.997Z",
"dateUpdated": "2026-10-21T12:40:27.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64077 (GCVE-0-2026-64077)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: move to two-stage removal scheme
Like previous patches for x_tables, follow same pattern in ebtables.
We can't reuse xt helpers: ebt_table struct layout is incompatible.
table->ops assignment is now done while still holding the ebt mutex
to make sure we never expose partially-filled table struct.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 87663c39f898b18905499126548da61450628682 Version: 87663c39f898b18905499126548da61450628682 Version: 87663c39f898b18905499126548da61450628682 Version: 87663c39f898b18905499126548da61450628682 Version: 87663c39f898b18905499126548da61450628682 Version: 87663c39f898b18905499126548da61450628682 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64077",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:11.050471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:11.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtable_broute.c",
"net/bridge/netfilter/ebtable_filter.c",
"net/bridge/netfilter/ebtable_nat.c",
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b37e27f5d5cbb7723644fdf089e28a216d6093ed",
"status": "affected",
"version": "87663c39f898b18905499126548da61450628682",
"versionType": "git"
},
{
"lessThan": "6fe4c808b6cdb405ed64ea6e740d557bba3d7745",
"status": "affected",
"version": "87663c39f898b18905499126548da61450628682",
"versionType": "git"
},
{
"lessThan": "f34e5a674afe743d1af80684d64b511f40a5c35d",
"status": "affected",
"version": "87663c39f898b18905499126548da61450628682",
"versionType": "git"
},
{
"lessThan": "739d5dac7b2da44a756aa4d758ee3f1ccf5a27f1",
"status": "affected",
"version": "87663c39f898b18905499126548da61450628682",
"versionType": "git"
},
{
"lessThan": "ef395579a7631a06d61969fc712eb80402231b89",
"status": "affected",
"version": "87663c39f898b18905499126548da61450628682",
"versionType": "git"
},
{
"lessThan": "b7f0544d86d439cb946515d2ef6a0a75e8626710",
"status": "affected",
"version": "87663c39f898b18905499126548da61450628682",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtable_broute.c",
"net/bridge/netfilter/ebtable_filter.c",
"net/bridge/netfilter/ebtable_nat.c",
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: move to two-stage removal scheme\n\nLike previous patches for x_tables, follow same pattern in ebtables.\nWe can\u0027t reuse xt helpers: ebt_table struct layout is incompatible.\n\ntable-\u003eops assignment is now done while still holding the ebt mutex\nto make sure we never expose partially-filled table struct."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through ebtables setsockopt/getsockopt administration syscalls (do_ebt_set_ctl/do_ebt_get_ctl), not through processing of remotely received network or bridge frames.\nAC:L - An attacker can reliably win the race by running concurrent threads\u2014one issuing ebtables setsockopt to register or modify a table while another destroys the network namespace or triggers module teardown.\nPR:L - All entry paths require CAP_NET_ADMIN in the target network namespace, which an unprivileged local attacker can obtain via user+network namespaces (unshare -Urn).\nUI:N - Exploitation requires no action from any other user or administrator beyond the attacker\u2019s own local namespace and sockopt operations.\nS:U - Impact is confined to kernel memory and privileges on the host; this is a standard kernel race/UAF issue, not a VM, container, or IOMMU boundary escape.\nC:H - The missing two-stage removal allows concurrent setsockopt to use an ebt_table while __ebt_unregister_table() frees its backing structures, creating a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The teardown race and partially-initialized table exposure enable heap use-after-free conditions that can be developed into arbitrary kernel memory writes or code execution via heap grooming.\nA:H - The NULL ops race causes a general protection fault in nf_unregister_net_hooks(), and the concurrent teardown UAF can trigger kernel oops, panic, or denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:34.127Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b37e27f5d5cbb7723644fdf089e28a216d6093ed"
},
{
"url": "https://git.kernel.org/stable/c/6fe4c808b6cdb405ed64ea6e740d557bba3d7745"
},
{
"url": "https://git.kernel.org/stable/c/f34e5a674afe743d1af80684d64b511f40a5c35d"
},
{
"url": "https://git.kernel.org/stable/c/739d5dac7b2da44a756aa4d758ee3f1ccf5a27f1"
},
{
"url": "https://git.kernel.org/stable/c/ef395579a7631a06d61969fc712eb80402231b89"
},
{
"url": "https://git.kernel.org/stable/c/b7f0544d86d439cb946515d2ef6a0a75e8626710"
}
],
"title": "netfilter: ebtables: move to two-stage removal scheme",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64077",
"datePublished": "2026-07-19T15:39:50.966Z",
"dateReserved": "2026-07-19T07:54:57.031Z",
"dateUpdated": "2026-10-30T12:27:34.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80920 (GCVE-0-2026-80920)
Vulnerability from cvelistv5
Published
2026-09-09 16:13
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring: defer eventfd signaling when queued from a wakeup handler
io_req_local_work_add() signals the CQ ring eventfd inline when it is the
one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that
add is frequently done from a waitqueue wakeup handler, where an
arbitrary waitqueue lock is held.
eventfd_signal_mask() only refuses to recurse when current->in_eventfd
is set, but that bit is set by eventfd_signal_mask() itself. If the wake
chain starts somewhere else, signal goes out inline and can feed back
into epoll.
Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three
waitqueue callbacks, and use it to force io_eventfd_signal() down the
existing call_rcu_hurry() deferral instead of signaling inline.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 21a091b970cdbcf3e8ff829234b51be6f9192766 Version: 21a091b970cdbcf3e8ff829234b51be6f9192766 Version: 21a091b970cdbcf3e8ff829234b51be6f9192766 Version: 21a091b970cdbcf3e8ff829234b51be6f9192766 Version: 21a091b970cdbcf3e8ff829234b51be6f9192766 Version: 21a091b970cdbcf3e8ff829234b51be6f9192766 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/eventfd.c",
"io_uring/eventfd.h",
"io_uring/futex.c",
"io_uring/io_uring.c",
"io_uring/poll.c",
"io_uring/tw.c",
"io_uring/waitid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0c240f25e654442a72af5ca021a02165ccce638",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "9d984451baf768ecd9e1fdad4637b729fcb2c9d5",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "e22f4494cc9487d326e5e3067f33dea7c1e442b2",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
},
{
"lessThan": "cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e",
"status": "affected",
"version": "21a091b970cdbcf3e8ff829234b51be6f9192766",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/io_uring_types.h",
"io_uring/eventfd.c",
"io_uring/eventfd.h",
"io_uring/futex.c",
"io_uring/io_uring.c",
"io_uring/poll.c",
"io_uring/tw.c",
"io_uring/waitid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: defer eventfd signaling when queued from a wakeup handler\n\nio_req_local_work_add() signals the CQ ring eventfd inline when it is the\none to push the first entry onto -\u003ework_list. For DEFER_TASKRUN rings that\nadd is frequently done from a waitqueue wakeup handler, where an\narbitrary waitqueue lock is held.\n\neventfd_signal_mask() only refuses to recurse when current-\u003ein_eventfd\nis set, but that bit is set by eventfd_signal_mask() itself. If the wake\nchain starts somewhere else, signal goes out inline and can feed back\ninto epoll.\n\nAdd IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three\nwaitqueue callbacks, and use it to force io_eventfd_signal() down the\nexisting call_rcu_hurry() deferral instead of signaling inline."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:14.401Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0c240f25e654442a72af5ca021a02165ccce638"
},
{
"url": "https://git.kernel.org/stable/c/9d984451baf768ecd9e1fdad4637b729fcb2c9d5"
},
{
"url": "https://git.kernel.org/stable/c/e22f4494cc9487d326e5e3067f33dea7c1e442b2"
},
{
"url": "https://git.kernel.org/stable/c/b6bb334b0e9348887e3e55e1f494b0c3b8fbf59f"
},
{
"url": "https://git.kernel.org/stable/c/40b6ccf68731809ceb85c6e9f0f8f2ed61c7aa5a"
},
{
"url": "https://git.kernel.org/stable/c/cd305ee3633a45fcf5f3a5d83f99f3cb77d87b6e"
}
],
"title": "io_uring: defer eventfd signaling when queued from a wakeup handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80920",
"datePublished": "2026-09-09T16:13:17.023Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-10-21T12:47:14.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74715 (GCVE-0-2026-74715)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix netns reference imbalance in conntrack kfuncs
The opts argument of the BPF conntrack kfuncs can point to a shared
map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
opts->netns_id separately when acquiring and releasing the network
namespace reference.
The reference imbalance can occur as follows:
CPU 0 CPU 1
read opts->netns_id (-1)
skip get_net_ns_by_id()
write opts->netns_id (id)
read opts->netns_id (id)
put_net(net) /* no matching get */
The reverse transition leaks the reference. Repeating the unmatched put
can destroy a live namespace and crash later users.
The kernel reported:
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
Call Trace:
__sys_bpf+0x1662/0x50c0
__x64_sys_bpf+0x73/0xb0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Kernel panic - not syncing: Fatal exception
Snapshot every input field of opts with READ_ONCE() before validating or
using it. The netns_id snapshot keeps the namespace get/put pair
balanced, while the other snapshots keep the remaining options from
changing partway through an invocation. The individual reads can still
observe an inconsistent combination during a concurrent update, but each
selected field value remains stable for that invocation.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aed8ee7feb44b6537af1e0b4f03365d42928be38 Version: aed8ee7feb44b6537af1e0b4f03365d42928be38 Version: aed8ee7feb44b6537af1e0b4f03365d42928be38 Version: aed8ee7feb44b6537af1e0b4f03365d42928be38 Version: aed8ee7feb44b6537af1e0b4f03365d42928be38 Version: aed8ee7feb44b6537af1e0b4f03365d42928be38 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:29.946901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:11.506Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfde990193135a35637e55f69e83e4ab441e60ab",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
},
{
"lessThan": "fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
},
{
"lessThan": "41731d4290400cb898f15f049ae4018d45415e69",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
},
{
"lessThan": "4af94462c0ca2187a02a1a6641020ae888c74d5c",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
},
{
"lessThan": "e5e060eb63d10b41ab60fd955649479d99b38210",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
},
{
"lessThan": "fdeba03fea78407a8c52faa99177c9f7f29f90eb",
"status": "affected",
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix netns reference imbalance in conntrack kfuncs\n\nThe opts argument of the BPF conntrack kfuncs can point to a shared\nmap value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read\nopts-\u003enetns_id separately when acquiring and releasing the network\nnamespace reference.\n\nThe reference imbalance can occur as follows:\n\n CPU 0 CPU 1\n read opts-\u003enetns_id (-1)\n skip get_net_ns_by_id()\n write opts-\u003enetns_id (id)\n read opts-\u003enetns_id (id)\n put_net(net) /* no matching get */\n\nThe reverse transition leaks the reference. Repeating the unmatched put\ncan destroy a live namespace and crash later users.\n\nThe kernel reported:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n Call Trace:\n __sys_bpf+0x1662/0x50c0\n __x64_sys_bpf+0x73/0xb0\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n Kernel panic - not syncing: Fatal exception\n\nSnapshot every input field of opts with READ_ONCE() before validating or\nusing it. The netns_id snapshot keeps the namespace get/put pair\nbalanced, while the other snapshots keep the remaining options from\nchanging partway through an invocation. The individual reads can still\nobserve an inconsistent combination during a concurrent update, but each\nselected field value remains stable for that invocation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in BPF conntrack kfuncs reached only via the bpf() syscall (load, BPF_PROG_TEST_RUN, or attached XDP/TC programs), not from remote packet handling alone; kernel guidance classifies BPF as Local.\nAC:L - Exploitation needs a race on opts-\u003enetns_id in a shared BPF map value, but the attacker authors the program, drives concurrent bpf_map_update_elem and kfunc calls, and can pin threads to different CPUs to win the race reliably.\nPR:L - Triggering bpf_xdp_ct_lookup/bpf_skb_ct_lookup requires loading XDP or TC-BPF programs, which needs CAP_BPF and CAP_NET_ADMIN; both are obtainable by an unprivileged user inside a user/network namespace via unshare.\nUI:N - No victim interaction is required; the attacker loads their own BPF program, supplies map-backed opts, and runs concurrent test-run or traffic to trigger the refcount imbalance themselves.\nS:U - Impact is premature destruction of a live network namespace and kernel crashes within the same kernel security domain; it does not cross a VM, container-to-host, or IOMMU boundary.\nC:H - Repeated unmatched put_net() can drop a live namespace refcount to zero and free it while still in use, creating a net-namespace use-after-free that can expose freed kernel memory and enable information disclosure.\nI:H - The refcount corruption can destroy active network namespaces and corrupt kernel networking state; such lifetime bugs are memory corruption primitives that can be leveraged for arbitrary kernel modification or control-flow hijacking.\nA:H - The fix commit documents a reproduced general protection fault and kernel panic in bpf_prog_test_run_xdp from a null-ptr-deref after the namespace is destroyed, confirming complete system availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:22.773Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfde990193135a35637e55f69e83e4ab441e60ab"
},
{
"url": "https://git.kernel.org/stable/c/fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8"
},
{
"url": "https://git.kernel.org/stable/c/41731d4290400cb898f15f049ae4018d45415e69"
},
{
"url": "https://git.kernel.org/stable/c/4af94462c0ca2187a02a1a6641020ae888c74d5c"
},
{
"url": "https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210"
},
{
"url": "https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb"
}
],
"title": "bpf: Fix netns reference imbalance in conntrack kfuncs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74715",
"datePublished": "2026-08-22T15:33:10.262Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-10-30T12:30:22.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99112 (GCVE-0-2026-99112)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_flower: validate mask pointer after nla_next()
fl_set_enc_opt() iterates the key's nested tunnel-option attributes
with nla_for_each_attr() while advancing a single mask pointer via
nla_next() at the bottom of each loop, so the mask cursor is driven
by the number of key attributes rather than by the mask's own
attributes. The nla_ok() added by commit c96adff956191 ("cls_flower:
call nla_ok() before nla_next()") only validates the mask pointer
that was just consumed; the pointer produced by nla_next() is used by
the next iteration (fl_set_geneve_opt() and siblings) without any
validation.
The mask's nested attributes are validated with NL_VALIDATE_LIBERAL,
which merely warns on trailing bytes that do not form a complete
attribute. A mask carrying one valid attribute plus 1-3 residue
bytes (or a non-aligned attribute length making msk_depth negative)
therefore reaches the next iteration with msk_depth != 0, so neither
the !msk_depth check in fl_set_enc_opt() nor the !depth check in the
per-type helpers fires. nla_type() then reads past the mask payload
and nla_parse_nested_deprecated() iterates with an nla_len taken
from those bytes, reading well beyond the mask attribute (KASAN:
slab-out-of-bounds read in __nla_validate_parse from fl_change()).
Validate the advanced mask pointer as well: when the mask is not
legitimately exhausted (msk_depth != 0) and the new pointer fails
nla_ok(), reject the filter with -EINVAL. An exactly exhausted mask
still skips the check, preserving exact-match behaviour for the
remaining key attributes.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 238b5ebdb6a6e4bc90810b9f8ec0063b3dfda41a Version: c96adff95619178e2118925578343ad54857c80c Version: c96adff95619178e2118925578343ad54857c80c Version: c96adff95619178e2118925578343ad54857c80c Version: c96adff95619178e2118925578343ad54857c80c Version: c96adff95619178e2118925578343ad54857c80c Version: c96adff95619178e2118925578343ad54857c80c Version: c96adff95619178e2118925578343ad54857c80c Version: 5.10.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_flower.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9283d006eef7e3b56f0f279a49bb63f6e5e61df",
"status": "affected",
"version": "238b5ebdb6a6e4bc90810b9f8ec0063b3dfda41a",
"versionType": "git"
},
{
"lessThan": "497944d534ffb1be300365523030c7c6517cbbb6",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "a55d84907337580d91c0d54779d9d4b934633158",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "cff9bf34afde46c238189cc6f7690b7e35225df1",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "35354bf67aa0f7bace66ffb614906124ed50d59d",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "45e60747a9db2307929260d9aa9c1c6cbb70ee77",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "bb187146c7e5c666874784e4f3fc1bc5126e6e92",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "fee10655709c5c597e8e9f722f3035d9ea31ff3a",
"status": "affected",
"version": "c96adff95619178e2118925578343ad54857c80c",
"versionType": "git"
},
{
"lessThan": "5.10.273",
"status": "affected",
"version": "5.10.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_flower.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.10.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flower: validate mask pointer after nla_next()\n\nfl_set_enc_opt() iterates the key\u0027s nested tunnel-option attributes\nwith nla_for_each_attr() while advancing a single mask pointer via\nnla_next() at the bottom of each loop, so the mask cursor is driven\nby the number of key attributes rather than by the mask\u0027s own\nattributes. The nla_ok() added by commit c96adff956191 (\"cls_flower:\ncall nla_ok() before nla_next()\") only validates the mask pointer\nthat was just consumed; the pointer produced by nla_next() is used by\nthe next iteration (fl_set_geneve_opt() and siblings) without any\nvalidation.\n\nThe mask\u0027s nested attributes are validated with NL_VALIDATE_LIBERAL,\nwhich merely warns on trailing bytes that do not form a complete\nattribute. A mask carrying one valid attribute plus 1-3 residue\nbytes (or a non-aligned attribute length making msk_depth negative)\ntherefore reaches the next iteration with msk_depth != 0, so neither\nthe !msk_depth check in fl_set_enc_opt() nor the !depth check in the\nper-type helpers fires. nla_type() then reads past the mask payload\nand nla_parse_nested_deprecated() iterates with an nla_len taken\nfrom those bytes, reading well beyond the mask attribute (KASAN:\nslab-out-of-bounds read in __nla_validate_parse from fl_change()).\n\nValidate the advanced mask pointer as well: when the mask is not\nlegitimately exhausted (msk_depth != 0) and the new pointer fails\nnla_ok(), reject the filter with -EINVAL. An exactly exhausted mask\nstill skips the check, preserving exact-match behaviour for the\nremaining key attributes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local process supplies the malformed TCA_FLOWER_KEY_ENC_OPTS_MASK through sendmsg() on NETLINK_ROUTE; RTM_NEWTFILTER follows rtnetlink_rcv_msg() -\u003e tc_new_tfilter() -\u003e fl_change() -\u003e fl_set_key() -\u003e fl_set_enc_opt().\nAC:L - The sender controls two Geneve key attributes and a mask containing one valid attribute plus residue bytes, causing nla_next() to produce the invalid cursor deterministically without a race or external state.\nPR:L - rtnetlink_rcv_msg() requires netlink_net_capable(skb, CAP_NET_ADMIN), but checks that capability in the socket\u0027s network namespace; an unprivileged user can obtain it through a new user and network namespace.\nUI:N - The attacker can create the namespace and qdisc and submit the malformed RTM_NEWTFILTER request directly; no action by another user is required.\nS:U - The out-of-bounds access occurs in fl_set_enc_opt() within the same host kernel processing the attacker\u0027s traffic-control configuration and crosses no VM, IOMMU, or separate security authority boundary.\nC:H - A forged second Geneve mask can make fl_set_geneve_opt() copy up to 124 bytes from beyond the netlink buffer into mask-\u003eenc_opts.data, which fl_dump_key_enc_opt() can return in a filter dump.\nI:N - The faulty cursor causes out-of-bounds reads only; __nla_validate_parse() stores in-range table pointers, and the per-option helpers keep their writes within the allocated key and mask enc_opts arrays.\nA:H - The attacker-controlled fake nla_len makes __nla_validate_parse() traverse well beyond the mask allocation, as demonstrated by the KASAN slab-out-of-bounds report, and crossing inaccessible memory can cause a kernel oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:08.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9283d006eef7e3b56f0f279a49bb63f6e5e61df"
},
{
"url": "https://git.kernel.org/stable/c/497944d534ffb1be300365523030c7c6517cbbb6"
},
{
"url": "https://git.kernel.org/stable/c/a55d84907337580d91c0d54779d9d4b934633158"
},
{
"url": "https://git.kernel.org/stable/c/cff9bf34afde46c238189cc6f7690b7e35225df1"
},
{
"url": "https://git.kernel.org/stable/c/35354bf67aa0f7bace66ffb614906124ed50d59d"
},
{
"url": "https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77"
},
{
"url": "https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92"
},
{
"url": "https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a"
}
],
"title": "net/sched: cls_flower: validate mask pointer after nla_next()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99112",
"datePublished": "2026-10-28T10:34:29.881Z",
"dateReserved": "2026-09-25T10:25:14.392Z",
"dateUpdated": "2026-10-31T12:43:08.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90111 (GCVE-0-2026-90111)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6mr: do not clone dst in ip6mr_cache_report()
IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
When an ingress multicast packet misses MFC lookup,
ip6mr_cache_unresolved() places the skb onto the unresolved queue,
escaping the receive-side RCU grace period.
If the underlying route is deleted and freed, and the MFC queue is later
resolved with a wrong parent interface, ip6_mr_forward() invokes
ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes
dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
use-after-free.
Report packets queued to mroute6_sk (a raw socket) and netlink
notifications do not require an attached dst entry.
Fix this by:
1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs
do not hold a dst.
2. Dropping skb_dst before queuing unresolved skbs in
ip6mr_cache_unresolved(), matching the fact that multicast
forwarding resolves outgoing routes anew via ip6_route_output().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 67f415dd29063a5906c560051c00e42dcf01a4dd Version: 67f415dd29063a5906c560051c00e42dcf01a4dd Version: 67f415dd29063a5906c560051c00e42dcf01a4dd Version: 67f415dd29063a5906c560051c00e42dcf01a4dd Version: 67f415dd29063a5906c560051c00e42dcf01a4dd Version: 67f415dd29063a5906c560051c00e42dcf01a4dd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b50d3cfb8513e895cee453dd0f834deee6ccc231",
"status": "affected",
"version": "67f415dd29063a5906c560051c00e42dcf01a4dd",
"versionType": "git"
},
{
"lessThan": "7f8287f606c8c028d4224e85d95dc448c6d6d623",
"status": "affected",
"version": "67f415dd29063a5906c560051c00e42dcf01a4dd",
"versionType": "git"
},
{
"lessThan": "42ef371466d5648f5c9e8bc219f0af0a2c2bbf8c",
"status": "affected",
"version": "67f415dd29063a5906c560051c00e42dcf01a4dd",
"versionType": "git"
},
{
"lessThan": "f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89",
"status": "affected",
"version": "67f415dd29063a5906c560051c00e42dcf01a4dd",
"versionType": "git"
},
{
"lessThan": "4a674afaae4136c71943aa3e35d433676fd40e8f",
"status": "affected",
"version": "67f415dd29063a5906c560051c00e42dcf01a4dd",
"versionType": "git"
},
{
"lessThan": "235b42b5860189eb8c27c36435ad932cae65a734",
"status": "affected",
"version": "67f415dd29063a5906c560051c00e42dcf01a4dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: do not clone dst in ip6mr_cache_report()\n\nIPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.\nWhen an ingress multicast packet misses MFC lookup,\nip6mr_cache_unresolved() places the skb onto the unresolved queue,\nescaping the receive-side RCU grace period.\n\nIf the underlying route is deleted and freed, and the MFC queue is later\nresolved with a wrong parent interface, ip6_mr_forward() invokes\nip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes\ndst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab\nuse-after-free.\n\nReport packets queued to mroute6_sk (a raw socket) and netlink\nnotifications do not require an attached dst entry.\n\nFix this by:\n1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs\n do not hold a dst.\n2. Dropping skb_dst before queuing unresolved skbs in\n ip6mr_cache_unresolved(), matching the fact that multicast\n forwarding resolves outgoing routes anew via ip6_route_output()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is dst_clone(skb_dst(pkt)) in ip6mr_cache_report(MRT6MSG_WRONGMIF) on a NOREF dst that ip6_route_input() attached and ip6mr_cache_unresolved() queued past RCU. Completing it requires deleting that fib6 route and MRT6_ADD_MFC with mf6cc_parent != the arrival vif; those are local setsockopt/netlink from the same attacker, not a field in the IPv6 multicast datagram.\nAC:L - The attacker owns every step: MRT6_INIT/ADD_MIF/ASSERT, inject a non-link-local IPv6 multicast skb so ip6_mr_input() misses the MFC and ip6mr_cache_unresolved() queues it, delete the fib6 route and wait an RCU grace period, then MRT6_ADD_MFC with the wrong parent so ip6_mr_forward() takes the WRONGMIF path.\nPR:L - inet6_create() allows SOCK_RAW/IPPROTO_ICMPV6 only with ns_capable(CAP_NET_RAW); ip6_mroute_setsockopt() then lets that mroute socket (or ns_capable(CAP_NET_ADMIN)) run MRT6_ADD_MIF, MRT6_ASSERT, and MRT6_ADD_MFC. An unprivileged user obtains both capabilities in a user+net namespace via unshare -Urn.\nUI:N - The attacker opens the raw ICMPv6 mroute socket, adds MIFs, injects the multicast skb onto a veth, deletes the fib6 route, and installs the mismatched-parent MFC entirely with their own syscalls; no other user must mount a volume or otherwise interact.\nS:U - dst_clone()/dst_hold() touch the host kernel\u0027s struct dst_entry from the IPv6 fib looked up for the queued skb; the use-after-free stays in that networking authority and does not cross a VM, IOMMU, or other boundary.\nC:H - After the fib6 route is freed, ip6mr_cache_report() still does dst_clone(skb_dst(pkt)) and dst_hold() reads __rcuref on the dangling dst_entry; that slab UAF can be reclaimed with attacker-controlled objects and used as an arbitrary kernel read.\nI:H - dst_hold() calls rcuref_get(\u0026dst-\u003e__rcuref) on the freed dst_entry, writing a reclaimable slab object that can be sprayed to forge a refcount/control-flow hijack when the WRONGMIF report clones the stale dst.\nA:H - ip6_mr_forward() invoking ip6mr_cache_report(MRT6MSG_WRONGMIF) oopses in dst_hold()/rcuref_get() on the already-freed dst_entry even without a full exploit, so the bug is a reliable kernel crash as well as a UAF."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:13.088Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b50d3cfb8513e895cee453dd0f834deee6ccc231"
},
{
"url": "https://git.kernel.org/stable/c/7f8287f606c8c028d4224e85d95dc448c6d6d623"
},
{
"url": "https://git.kernel.org/stable/c/42ef371466d5648f5c9e8bc219f0af0a2c2bbf8c"
},
{
"url": "https://git.kernel.org/stable/c/f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89"
},
{
"url": "https://git.kernel.org/stable/c/4a674afaae4136c71943aa3e35d433676fd40e8f"
},
{
"url": "https://git.kernel.org/stable/c/235b42b5860189eb8c27c36435ad932cae65a734"
}
],
"title": "ip6mr: do not clone dst in ip6mr_cache_report()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90111",
"datePublished": "2026-09-17T16:06:18.779Z",
"dateReserved": "2026-09-11T19:38:34.787Z",
"dateUpdated": "2026-10-30T12:34:13.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68453 (GCVE-0-2026-68453)
Vulnerability from cvelistv5
Published
2026-08-13 13:59
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
Add validation of both the actual key buffer size and token length
fields in all the cca_check_sec*token() functions. Additionally check
in cca_gencipherkey() for possible underflow with returned key size.
The CCA token structures contain user-controlled len fields that
were used in operations without proper validation against both the
actual buffer size and minimum token structure size. An attacker
could set this field larger than the actual buffer size, leading to
reading beyond buffer boundaries. This may result in a kernel crash or
exposure of memory via sending this as part of a request down to the
crypto card. Also an attacker could have used a very small len value
and thus enforce a buffer under-run which may produce similar effects
as a over-read.
So now a key must
- key buf length must be at least sizeof the token struct
- the key len field inside the token must fit into the range of
sizeof key token struct ... key buf length
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:20.171287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:11.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_cca.c",
"drivers/s390/crypto/zcrypt_ccamisc.c",
"drivers/s390/crypto/zcrypt_ccamisc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1adfec7be6f34c1073c9cf15040bc4e3fdc6dc51",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "d0951ed366710a1a303b7cb2f8eb3d866cd68fc6",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "353e442d18084b24fb3ede4e5adfca26b25f0e89",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "a57fd7fcdb63e2d5ceac78bbe825ec986062a9da",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "3b2abee2a678607ae27975bc6833785c2002df43",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "36b230835b8a008266aad22168ca52afacc8a58d",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_cca.c",
"drivers/s390/crypto/zcrypt_ccamisc.c",
"drivers/s390/crypto/zcrypt_ccamisc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix buffer over-read in cca_cipher2protkey\n\nAdd validation of both the actual key buffer size and token length\nfields in all the cca_check_sec*token() functions. Additionally check\nin cca_gencipherkey() for possible underflow with returned key size.\n\nThe CCA token structures contain user-controlled len fields that\nwere used in operations without proper validation against both the\nactual buffer size and minimum token structure size. An attacker\ncould set this field larger than the actual buffer size, leading to\nreading beyond buffer boundaries. This may result in a kernel crash or\nexposure of memory via sending this as part of a request down to the\ncrypto card. Also an attacker could have used a very small len value\nand thus enforce a buffer under-run which may produce similar effects\nas a over-read.\n\nSo now a key must\n- key buf length must be at least sizeof the token struct\n- the key len field inside the token must fit into the range of\n sizeof key token struct ... key buf length"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through ioctls on the /dev/pkey misc device (PKEY_VERIFYKEY2, PKEY_KBLOB2PROTK2/3) or via in-kernel paes/dm-crypt setkey calls, all of which require local access to the s390 system. There is no network-facing consumer of CCA key tokens.\nAC:L - The attacker fully controls both the allocation size (memdup_user of an attacker-chosen keylen, minimum 8 bytes) and the token header bytes, so the out-of-bounds read is triggered deterministically on every ioctl with no race, timing, or uncontrolled memory-layout dependency; the adjacent slab contents can be groomed with further 8-byte key blobs.\nPR:L - pkey_api.c registers the misc device with .mode = 0666 and pkey_unlocked_ioctl() performs no capable()/CAP_* check whatsoever, so any unprivileged local user can open /dev/pkey and issue the affected ioctls; pkey_handler_request_modules() even auto-loads the pkey-cca handler on demand.\nUI:N - Exploitation is a self-contained sequence of ioctl() calls made by the attacker\u0027s own process; no action by any other user or administrator is required.\nS:U - The out-of-bounds read stays within the kernel\u0027s own address space and the impact is confined to the kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An 8-byte key buffer causes reads up to ~48 bytes past the allocation into neighbouring slab objects; cca_verifykey() returns OOB bytes to userspace via *keybitsize and the checks form a byte oracle, while cca_gencipherkey() used an unvalidated len to copy far beyond the 512-byte CPRB param block into a user-visible buffer, and token data is also transmitted to the crypto adapter.\nI:N - The defect is purely an over-read/under-run of length fields; no out-of-bounds write, freed-object reuse, or type confusion occurs, so no kernel data can be modified through this path.\nA:H - The commit message states the over-read \"may result in a kernel crash\"; reading tens of bytes past a minimally sized kmalloc object can fault or trip KASAN/KFENCE, and the unbounded copy in cca_gencipherkey can walk far outside the parameter block, oopsing the kernel from an unprivileged, endlessly repeatable ioctl."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:41.617Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1adfec7be6f34c1073c9cf15040bc4e3fdc6dc51"
},
{
"url": "https://git.kernel.org/stable/c/d0951ed366710a1a303b7cb2f8eb3d866cd68fc6"
},
{
"url": "https://git.kernel.org/stable/c/353e442d18084b24fb3ede4e5adfca26b25f0e89"
},
{
"url": "https://git.kernel.org/stable/c/a57fd7fcdb63e2d5ceac78bbe825ec986062a9da"
},
{
"url": "https://git.kernel.org/stable/c/3b2abee2a678607ae27975bc6833785c2002df43"
},
{
"url": "https://git.kernel.org/stable/c/36b230835b8a008266aad22168ca52afacc8a58d"
}
],
"title": "s390/zcrypt: Fix buffer over-read in cca_cipher2protkey",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68453",
"datePublished": "2026-08-13T13:59:56.036Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-10-30T12:28:41.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74729 (GCVE-0-2026-74729)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
put_fifo_with_discard() acts as both producer and consumer on the kfifo:
it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from
the IRQ handler without synchronizing with snoop_file_read(), which also
consumes via kfifo_to_user(). On SMP systems this concurrent access can
leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp
to (in - out) is ineffective and kfifo_copy_to_user() can attempt a
copy_to_user() past the kmalloc-2k backing store:
usercopy: Kernel memory exposure attempt detected from SLUB object
'kmalloc-2k' (offset 0, size 2049)!
kernel BUG at mm/usercopy.c!
Call trace:
usercopy_abort
__check_heap_object
__check_object_size
kfifo_copy_to_user
__kfifo_to_user
snoop_file_read
vfs_read
Serialize kfifo access with a per-channel spinlock shared between the
IRQ handler (producer) and the file reader (consumer). Annotate @fifo
with __guarded_by(&lock) and opt the driver into context analysis so the
compiler enforces that all fifo access holds the lock.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3772e5da445420543b25825ac2b5971f3743f6e8 Version: 3772e5da445420543b25825ac2b5971f3743f6e8 Version: 3772e5da445420543b25825ac2b5971f3743f6e8 Version: 3772e5da445420543b25825ac2b5971f3743f6e8 Version: 3772e5da445420543b25825ac2b5971f3743f6e8 Version: 3772e5da445420543b25825ac2b5971f3743f6e8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/aspeed/Makefile",
"drivers/soc/aspeed/aspeed-lpc-snoop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f62afe827c52c300c64715631e6ac9e576c5112d",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
},
{
"lessThan": "b87c0d24386ed5106feac12034fe09d893ccb469",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
},
{
"lessThan": "afe2527eae0b51d5e8ddd77293afab3a5a1311a4",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
},
{
"lessThan": "868c478abce858135db3eb65548a577e4b6747ac",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
},
{
"lessThan": "131ab677b03349a5ae48da8722ec7075b37ec66e",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
},
{
"lessThan": "1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f",
"status": "affected",
"version": "3772e5da445420543b25825ac2b5971f3743f6e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/aspeed/Makefile",
"drivers/soc/aspeed/aspeed-lpc-snoop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read\n\nput_fifo_with_discard() acts as both producer and consumer on the kfifo:\nit calls kfifo_skip() (advances out) and kfifo_put() (advances in) from\nthe IRQ handler without synchronizing with snoop_file_read(), which also\nconsumes via kfifo_to_user(). On SMP systems this concurrent access can\nleave (in - out) larger than the ring buffer, so __kfifo_to_user()\u0027s clamp\nto (in - out) is ineffective and kfifo_copy_to_user() can attempt a\ncopy_to_user() past the kmalloc-2k backing store:\n\n usercopy: Kernel memory exposure attempt detected from SLUB object\n \u0027kmalloc-2k\u0027 (offset 0, size 2049)!\n kernel BUG at mm/usercopy.c!\n Call trace:\n usercopy_abort\n __check_heap_object\n __check_object_size\n kfifo_copy_to_user\n __kfifo_to_user\n snoop_file_read\n vfs_read\n\nSerialize kfifo access with a per-channel spinlock shared between the\nIRQ handler (producer) and the file reader (consumer). Annotate @fifo\nwith __guarded_by(\u0026lock) and opt the driver into context analysis so the\ncompiler enforces that all fifo access holds the lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:24.911Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f62afe827c52c300c64715631e6ac9e576c5112d"
},
{
"url": "https://git.kernel.org/stable/c/b87c0d24386ed5106feac12034fe09d893ccb469"
},
{
"url": "https://git.kernel.org/stable/c/afe2527eae0b51d5e8ddd77293afab3a5a1311a4"
},
{
"url": "https://git.kernel.org/stable/c/868c478abce858135db3eb65548a577e4b6747ac"
},
{
"url": "https://git.kernel.org/stable/c/131ab677b03349a5ae48da8722ec7075b37ec66e"
},
{
"url": "https://git.kernel.org/stable/c/1acef6d85bfd98bd9dfe1f08bffa397a4dda8a6f"
}
],
"title": "soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74729",
"datePublished": "2026-08-22T15:33:19.037Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-10-30T12:30:24.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97975 (GCVE-0-2026-97975)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
A NULL pointer dereference in klist_put() occurs when a child device (such
as a BNEP network device in bnep_session) is concurrently being
unregistered while hci_conn_del_sysfs() reparents child devices.
This is caused by a race condition between hci_conn_del_sysfs() and
concurrent child device unregistration (e.g. bnep_session calling
unregister_netdev()). During device unregistration, device_del() snapshots
a non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the
child device using device_find_any_child() and calls device_move() to
reparent it to NULL, which removes the node from its parent's klist and
clears knode_parent. Subsequently, device_del() calls
klist_del(&dev->p->knode_parent) using the stale parent snapshot, causing
klist_put() to dereference knode_klist(n)->put on an already removed node,
resulting in a NULL pointer dereference.
This race was introduced by commit 27aabf27fd01 ("Bluetooth: fix
use-after-free in device_for_each_child()"), which replaced
device_find_child(..., __match_tty) with device_find_any_child() in
hci_conn_del_sysfs(). That change was intended to avoid a use-after-free
where conn->dev outlived its parent hdev->dev when child devices held
references to conn->dev, because conn->dev only held a reference to
hdev->dev while registered in sysfs.
Fix the issue properly by taking an explicit reference to the parent device
with get_device(&hdev->dev) in hci_conn_init_sysfs() and dropping it with
put_device(parent) in bt_link_release() when the conn device is freed. This
ensures that hdev->dev remains valid for the entire lifecycle of conn->dev,
resolving the underlying use-after-free. With the parent reference held
properly, restore the __match_tty filter in hci_conn_del_sysfs() so that
device_move() is only invoked on persistent RFCOMM TTY devices as
originally intended, eliminating the race condition with unregistering
network devices.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: de5a44f351ca7efd9add9851b218f5353e2224b7 Version: 7b277bd569bb6a2777f0014f84b4344f444fd49d Version: 27aabf27fd014ae037cc179c61b0bee7cff55b3d Version: 27aabf27fd014ae037cc179c61b0bee7cff55b3d Version: 27aabf27fd014ae037cc179c61b0bee7cff55b3d Version: 6894717a1ea363c5a27010ba604f957c309d282d Version: fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5 Version: a9584c897d1cba6265c78010bbb45ca5722c88bc Version: 0f67ca2a80acf8b207240405b7f72d660665d3df Version: 91e2a2e4d1336333804cd31162984f01ad8cc70f Version: 6.6.64 ≤ Version: 6.12.2 ≤ Version: 5.4.297 ≤ Version: 5.10.231 ≤ Version: 5.15.174 ≤ Version: 6.1.120 ≤ Version: 6.11.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "55b76500546e5f2e7fdd7ae7283530b620de6e61",
"status": "affected",
"version": "de5a44f351ca7efd9add9851b218f5353e2224b7",
"versionType": "git"
},
{
"lessThan": "66cc55b69928b742d24b4c5b66d195ae96900e48",
"status": "affected",
"version": "7b277bd569bb6a2777f0014f84b4344f444fd49d",
"versionType": "git"
},
{
"lessThan": "eeabdb25c3209569367e99a85ca9a503b64a646d",
"status": "affected",
"version": "27aabf27fd014ae037cc179c61b0bee7cff55b3d",
"versionType": "git"
},
{
"lessThan": "9e9ece97b8e716890793de261574b8efef7d8702",
"status": "affected",
"version": "27aabf27fd014ae037cc179c61b0bee7cff55b3d",
"versionType": "git"
},
{
"lessThan": "9b851b09b392da68bd715601f10a5adb2d8d19b8",
"status": "affected",
"version": "27aabf27fd014ae037cc179c61b0bee7cff55b3d",
"versionType": "git"
},
{
"status": "affected",
"version": "6894717a1ea363c5a27010ba604f957c309d282d",
"versionType": "git"
},
{
"status": "affected",
"version": "fb91ce37dc9a37ea23cf32b6d7b667004e93d4c5",
"versionType": "git"
},
{
"status": "affected",
"version": "a9584c897d1cba6265c78010bbb45ca5722c88bc",
"versionType": "git"
},
{
"status": "affected",
"version": "0f67ca2a80acf8b207240405b7f72d660665d3df",
"versionType": "git"
},
{
"status": "affected",
"version": "91e2a2e4d1336333804cd31162984f01ad8cc70f",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.297",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.231",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()\n\nA NULL pointer dereference in klist_put() occurs when a child device (such\nas a BNEP network device in bnep_session) is concurrently being\nunregistered while hci_conn_del_sysfs() reparents child devices.\n\nThis is caused by a race condition between hci_conn_del_sysfs() and\nconcurrent child device unregistration (e.g. bnep_session calling\nunregister_netdev()). During device unregistration, device_del() snapshots\na non-NULL parent pointer. Concurrently, hci_conn_del_sysfs() finds the\nchild device using device_find_any_child() and calls device_move() to\nreparent it to NULL, which removes the node from its parent\u0027s klist and\nclears knode_parent. Subsequently, device_del() calls\nklist_del(\u0026dev-\u003ep-\u003eknode_parent) using the stale parent snapshot, causing\nklist_put() to dereference knode_klist(n)-\u003eput on an already removed node,\nresulting in a NULL pointer dereference.\n\nThis race was introduced by commit 27aabf27fd01 (\"Bluetooth: fix\nuse-after-free in device_for_each_child()\"), which replaced\ndevice_find_child(..., __match_tty) with device_find_any_child() in\nhci_conn_del_sysfs(). That change was intended to avoid a use-after-free\nwhere conn-\u003edev outlived its parent hdev-\u003edev when child devices held\nreferences to conn-\u003edev, because conn-\u003edev only held a reference to\nhdev-\u003edev while registered in sysfs.\n\nFix the issue properly by taking an explicit reference to the parent device\nwith get_device(\u0026hdev-\u003edev) in hci_conn_init_sysfs() and dropping it with\nput_device(parent) in bt_link_release() when the conn device is freed. This\nensures that hdev-\u003edev remains valid for the entire lifecycle of conn-\u003edev,\nresolving the underlying use-after-free. With the parent reference held\nproperly, restore the __match_tty filter in hci_conn_del_sysfs() so that\ndevice_move() is only invoked on persistent RFCOMM TTY devices as\noriginally intended, eliminating the race condition with unregistering\nnetwork devices."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:55.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/55b76500546e5f2e7fdd7ae7283530b620de6e61"
},
{
"url": "https://git.kernel.org/stable/c/66cc55b69928b742d24b4c5b66d195ae96900e48"
},
{
"url": "https://git.kernel.org/stable/c/eeabdb25c3209569367e99a85ca9a503b64a646d"
},
{
"url": "https://git.kernel.org/stable/c/9e9ece97b8e716890793de261574b8efef7d8702"
},
{
"url": "https://git.kernel.org/stable/c/9b851b09b392da68bd715601f10a5adb2d8d19b8"
}
],
"title": "Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97975",
"datePublished": "2026-09-25T10:23:13.971Z",
"dateReserved": "2026-09-25T10:18:58.207Z",
"dateUpdated": "2026-10-21T12:53:55.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99115 (GCVE-0-2026-99115)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION,
that is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns
FileSysIdentifier. Those eight bytes go to the client as they are found
in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks
nothing. A compound request can leak: the offset of the next response
is advanced by the length pinned for the previous one, so a reply that
was written into the buffer and then dropped in favour of the short
error response of smb2_set_err_rsp() stays there, and the next reply is
laid over it with only the header cleared.
Report the file system id statfs() returned, which is what the field is
for. FileSysIdentifier is __le64 and f_fsid is a pair of ints, so
assemble the value first, val[0] as the low half, and convert it on the
way out.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb9fbcaf1f3351bea771eec557fc6c4d2f35762b",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "1d644ab9eac767d52c9b8dc0eb68c0085994d9b6",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "da2ec27fdd7effbe4c94ec15b6c6a281800c5123",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "f5c50f69a70fe22c44a50c869c8cd65fc35a0686",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "beba2ef6f66a71f20531ac70a1acb0b221e362e9",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "ab057f271ef60ff8163818badc3de75c480eca07",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "db2267b27c054a6c2151ff7fbb67927e784f31d6",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION\n\nsmb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION,\nthat is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns\nFileSysIdentifier. Those eight bytes go to the client as they are found\nin the response buffer.\n\nThe buffer is zeroed on allocation, so a standalone request leaks\nnothing. A compound request can leak: the offset of the next response\nis advanced by the length pinned for the previous one, so a reply that\nwas written into the buffer and then dropped in favour of the short\nerror response of smb2_set_err_rsp() stays there, and the next reply is\nlaid over it with only the header cleared.\n\nReport the file system id statfs() returned, which is what the field is\nfor. FileSysIdentifier is __le64 and f_fsid is a pair of ints, so\nassemble the value first, val[0] as the low half, and convert it on the\nway out."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:53.529Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb9fbcaf1f3351bea771eec557fc6c4d2f35762b"
},
{
"url": "https://git.kernel.org/stable/c/1d644ab9eac767d52c9b8dc0eb68c0085994d9b6"
},
{
"url": "https://git.kernel.org/stable/c/da2ec27fdd7effbe4c94ec15b6c6a281800c5123"
},
{
"url": "https://git.kernel.org/stable/c/f5c50f69a70fe22c44a50c869c8cd65fc35a0686"
},
{
"url": "https://git.kernel.org/stable/c/beba2ef6f66a71f20531ac70a1acb0b221e362e9"
},
{
"url": "https://git.kernel.org/stable/c/ab057f271ef60ff8163818badc3de75c480eca07"
},
{
"url": "https://git.kernel.org/stable/c/db2267b27c054a6c2151ff7fbb67927e784f31d6"
}
],
"title": "ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99115",
"datePublished": "2026-10-28T10:34:32.347Z",
"dateReserved": "2026-09-25T10:25:14.392Z",
"dateUpdated": "2026-10-30T12:41:53.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99178 (GCVE-0-2026-99178)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-11-01 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
An async #PF "page not present" event arrives through the #PF vector,
and its reason sits in the per-CPU apf_reason.flags until
__kvm_handle_async_pf() reads and clears it. If an NMI arrives after
the event is injected and before the #PF handler reads the flags, and
the NMI handler itself takes a #PF, that fault reads and clears the
flags belonging to the #PF it interrupted. It then finds interrupts
disabled in the NMI context it interrupted, and panics:
Kernel panic - not syncing: Host injected async #PF in interrupt
disabled region
Call Trace:
<NMI>
panic+0x52/0x60
__kvm_handle_async_pf+0xb0/0xb0
exc_page_fault+0x71/0xb0
asm_exc_page_fault+0x27/0x30
RIP: 0010:__get_user_nocheck_8+0x6/0x20
perf_callchain_user+0x147/0x1a0
get_perf_callchain+0x12d/0x1c0
...
perf_event_nmi_handler+0x26/0x50
exc_nmi+0xe8/0x110
RIP: 0010:asm_exc_page_fault+0x0/0x30
</NMI>
The last RIP line shows the NMI landing on the first instruction of
the #PF entry. perf with user call chains takes such a fault: the
sampling NMI walks the user stack with __get_user(), which faults when
a saved frame pointer is not a valid user address or the walk runs off
the top of the stack. The same window exists when KVM, running as an
L1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after
a #PF VM-exit.
The NMI entry code saves and restores CR2 for this nesting, but not the
async #PF reason. Andy Lutomirski described the race, with perf as the
example, when async #PF delivery was reworked in 2020 [1]. Saving and
clearing the flags across the NMI, next to CR2, was discussed there but
not merged.
Since that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS,
so the host delivers "page not present" only for user mode faults and
a kernel-mode fault in NMI context (including kernel-mode #MC and #DB)
cannot be an async page fault. In that case, return without touching
the flags so that the interrupted handler finds them intact.
Tested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshot
whose memory is served on demand through userfaultfd, so that reading
it back takes async #PFs, while every thread samples hardware cycles
with user call chains and points its frame pointer at an unmapped page.
Without this patch the guest panicked as above in 3 of 3 runs. With it,
the guest survived 3 of 3 runs of 60 seconds, and the host counted
148,441 to 153,334 kvm_async_pf_not_present events in the first 20
seconds of each. On 6.18.50 the results were the same: the guest
panicked without the patch and survived with it.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/kvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd60b32a99627fda479c9fa1d4a82fa9f7994670",
"status": "affected",
"version": "631bc4878220932fe67fc46fc7cf7cccdb1ec597",
"versionType": "git"
},
{
"lessThan": "b77e9622bbade9812e2090c66d25c372f515e921",
"status": "affected",
"version": "631bc4878220932fe67fc46fc7cf7cccdb1ec597",
"versionType": "git"
},
{
"lessThan": "f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9",
"status": "affected",
"version": "631bc4878220932fe67fc46fc7cf7cccdb1ec597",
"versionType": "git"
},
{
"lessThan": "81d99abe2bd81379abfb595e403bbbee6fbfc624",
"status": "affected",
"version": "631bc4878220932fe67fc46fc7cf7cccdb1ec597",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/kvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Don\u0027t consume async #PF flags on a kernel #PF in NMI context\n\nAn async #PF \"page not present\" event arrives through the #PF vector,\nand its reason sits in the per-CPU apf_reason.flags until\n__kvm_handle_async_pf() reads and clears it. If an NMI arrives after\nthe event is injected and before the #PF handler reads the flags, and\nthe NMI handler itself takes a #PF, that fault reads and clears the\nflags belonging to the #PF it interrupted. It then finds interrupts\ndisabled in the NMI context it interrupted, and panics:\n\n Kernel panic - not syncing: Host injected async #PF in interrupt\ndisabled region\n Call Trace:\n \u003cNMI\u003e\n panic+0x52/0x60\n __kvm_handle_async_pf+0xb0/0xb0\n exc_page_fault+0x71/0xb0\n asm_exc_page_fault+0x27/0x30\n RIP: 0010:__get_user_nocheck_8+0x6/0x20\n perf_callchain_user+0x147/0x1a0\n get_perf_callchain+0x12d/0x1c0\n ...\n perf_event_nmi_handler+0x26/0x50\n exc_nmi+0xe8/0x110\n RIP: 0010:asm_exc_page_fault+0x0/0x30\n \u003c/NMI\u003e\n\nThe last RIP line shows the NMI landing on the first instruction of\nthe #PF entry. perf with user call chains takes such a fault: the\nsampling NMI walks the user stack with __get_user(), which faults when\na saved frame pointer is not a valid user address or the walk runs off\nthe top of the stack. The same window exists when KVM, running as an\nL1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after\na #PF VM-exit.\n\nThe NMI entry code saves and restores CR2 for this nesting, but not the\nasync #PF reason. Andy Lutomirski described the race, with perf as the\nexample, when async #PF delivery was reworked in 2020 [1]. Saving and\nclearing the flags across the NMI, next to CR2, was discussed there but\nnot merged.\n\nSince that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS,\nso the host delivers \"page not present\" only for user mode faults and\na kernel-mode fault in NMI context (including kernel-mode #MC and #DB)\ncannot be an async page fault. In that case, return without touching\nthe flags so that the interrupted handler finds them intact.\n\nTested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshot\nwhose memory is served on demand through userfaultfd, so that reading\nit back takes async #PFs, while every thread samples hardware cycles\nwith user call chains and points its frame pointer at an unmapped page.\nWithout this patch the guest panicked as above in 3 of 3 runs. With it,\nthe guest survived 3 of 3 runs of 60 seconds, and the host counted\n148,441 to 153,334 kvm_async_pf_not_present events in the first 20\nseconds of each. On 6.18.50 the results were the same: the guest\npanicked without the patch and survived with it."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T12:42:11.076Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd60b32a99627fda479c9fa1d4a82fa9f7994670"
},
{
"url": "https://git.kernel.org/stable/c/b77e9622bbade9812e2090c66d25c372f515e921"
},
{
"url": "https://git.kernel.org/stable/c/f45ee1ff6358a22d7e22a4c53cb3148ea97b10d9"
},
{
"url": "https://git.kernel.org/stable/c/81d99abe2bd81379abfb595e403bbbee6fbfc624"
}
],
"title": "x86/kvm: Don\u0027t consume async #PF flags on a kernel #PF in NMI context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99178",
"datePublished": "2026-10-28T10:35:31.961Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-11-01T12:42:11.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93175 (GCVE-0-2026-93175)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix dangling pointer in CRTC reset function
amdgpu_dm_crtc_reset_state() frees the old state before allocating
a new one. If kzalloc() fails, the function returns without updating
the state pointer, leaving a dangling pointer to already freed memory.
Fix this by allocating the new state first. On allocation failure, the
old state remains untouched and the function safely returns.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[adjust for movement around current amd-staging-drm-next]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e7b07ceef2a650e5ed8ca37997689e086c680daf Version: e7b07ceef2a650e5ed8ca37997689e086c680daf Version: e7b07ceef2a650e5ed8ca37997689e086c680daf Version: e7b07ceef2a650e5ed8ca37997689e086c680daf Version: e7b07ceef2a650e5ed8ca37997689e086c680daf Version: e7b07ceef2a650e5ed8ca37997689e086c680daf |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c311d5fcfcd4e83c1aeeb4fccb04861be3357a9",
"status": "affected",
"version": "e7b07ceef2a650e5ed8ca37997689e086c680daf",
"versionType": "git"
},
{
"lessThan": "ef3293c87a79f734d506769ff86f99bf1bad522e",
"status": "affected",
"version": "e7b07ceef2a650e5ed8ca37997689e086c680daf",
"versionType": "git"
},
{
"lessThan": "9de069b724f3614ed7dd55bfbb37c434db54e128",
"status": "affected",
"version": "e7b07ceef2a650e5ed8ca37997689e086c680daf",
"versionType": "git"
},
{
"lessThan": "3a03827bb3cda1527aa923f18160c449f2b4cf2c",
"status": "affected",
"version": "e7b07ceef2a650e5ed8ca37997689e086c680daf",
"versionType": "git"
},
{
"lessThan": "32bd68edbc6cbcfac0e4033b64f0bcadbf0efef5",
"status": "affected",
"version": "e7b07ceef2a650e5ed8ca37997689e086c680daf",
"versionType": "git"
},
{
"lessThan": "0aeed866cb938943908c3ba46422128e49d2d080",
"status": "affected",
"version": "e7b07ceef2a650e5ed8ca37997689e086c680daf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dangling pointer in CRTC reset function\n\namdgpu_dm_crtc_reset_state() frees the old state before allocating\na new one. If kzalloc() fails, the function returns without updating\nthe state pointer, leaving a dangling pointer to already freed memory.\n\nFix this by allocating the new state first. On allocation failure, the\nold state remains untouched and the function safely returns.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[adjust for movement around current amd-staging-drm-next]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The dangling crtc-\u003estate is created in amdgpu_dm_crtc_reset_state(), which drm_mode_config_reset() invokes from drm_atomic_helper_resume() in dm_destroy_cached_state(). That runs from dm_resume() on S3 (amdgpu_pmops_resume -\u003e amdgpu_device_resume) and on runtime resume when drm_open/amdgpu_driver_open_kms or amdgpu_drm_ioctl call pm_runtime_get_sync(). No protocol message carries the trigger.\nAC:L - After a successful amdgpu_dm_crtc_init() reset, crtc-\u003estate is live. The buggy amdgpu_dm_crtc_reset_state() then always kfree\u0027s it via amdgpu_dm_crtc_destroy_state() before kzalloc_obj(*state); on GFP_KERNEL ENOMEM it returns without clearing crtc-\u003estate. A local attacker can force that allocation failure with memory pressure; there is no race.\nPR:L - amdgpu_driver_open_kms() has no capable() check and always calls pm_runtime_get_sync(); amdgpu_drm_ioctl() does the same before drm_ioctl(). Access is the usual /dev/dri/cardN and renderD* nodes granted to the seat user by logind ACLs or the video/render group, not init-namespace root.\nUI:N - The attacker opens /dev/dri/renderD* or issues an amdgpu ioctl after amdgpu autosuspend (pm_runtime_put_autosuspend, 5s delay on the default BACO/PX/BOCO path when no CRTC is active); dm_resume() then runs drm_mode_config_reset() without another user mounting media or plugging hardware.\nS:U - The use-after-free is of host-kernel dm_crtc_state on the amdgpu display CRTC. It does not escape a KVM/Xen guest, bypass the IOMMU, or leave a sandbox.\nC:H - amdgpu_dm_crtc_destroy_state() kfree\u0027s the live dm_crtc_state while crtc-\u003estate still points at it. drm_atomic_helper_commit_duplicated_state() then loads that freed object as old_state, including dc_stream_state *stream and drm_crtc_state mode_blob/commit/event pointers, a slab UAF read.\nI:H - The same dangling crtc-\u003estate is installed as old_state and later passed to atomic_destroy_state again (double-free). Heap reuse of dm_crtc_state lets an attacker control stream, commit, and event pointers consumed by the resume atomic commit, a write and control-flow primitive.\nA:H - drm_atomic_helper_commit_duplicated_state() immediately dereferences the freed dm_crtc_state after drm_mode_config_reset(), causing a kernel oops; the later second destroy is a double-free. Either path oopses or panics the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:15.241Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c311d5fcfcd4e83c1aeeb4fccb04861be3357a9"
},
{
"url": "https://git.kernel.org/stable/c/ef3293c87a79f734d506769ff86f99bf1bad522e"
},
{
"url": "https://git.kernel.org/stable/c/9de069b724f3614ed7dd55bfbb37c434db54e128"
},
{
"url": "https://git.kernel.org/stable/c/3a03827bb3cda1527aa923f18160c449f2b4cf2c"
},
{
"url": "https://git.kernel.org/stable/c/32bd68edbc6cbcfac0e4033b64f0bcadbf0efef5"
},
{
"url": "https://git.kernel.org/stable/c/0aeed866cb938943908c3ba46422128e49d2d080"
}
],
"title": "drm/amd/display: Fix dangling pointer in CRTC reset function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93175",
"datePublished": "2026-09-17T16:12:04.609Z",
"dateReserved": "2026-09-17T16:02:15.090Z",
"dateUpdated": "2026-10-30T12:36:15.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68193 (GCVE-0-2025-68193)
Vulnerability from cvelistv5
Published
2025-12-16 13:43
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/guc: Add devm release action to safely tear down CT
When a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE
flag, the driver initiates TLB invalidation requests via the CTB mechanism
while releasing the BO. However a premature release of the CTB BO can lead
to system crashes, as observed in:
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:h2g_write+0x2f3/0x7c0 [xe]
Call Trace:
guc_ct_send_locked+0x8b/0x670 [xe]
xe_guc_ct_send_locked+0x19/0x60 [xe]
send_tlb_invalidation+0xb4/0x460 [xe]
xe_gt_tlb_invalidation_ggtt+0x15e/0x2e0 [xe]
ggtt_invalidate_gt_tlb.part.0+0x16/0x90 [xe]
ggtt_node_remove+0x110/0x140 [xe]
xe_ggtt_node_remove+0x40/0xa0 [xe]
xe_ggtt_remove_bo+0x87/0x250 [xe]
Introduce a devm-managed release action during xe_guc_ct_init() and
xe_guc_ct_init_post_hwconfig() to ensure proper CTB disablement before
resource deallocation, preventing the use-after-free scenario.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_guc.c",
"drivers/gpu/drm/xe/xe_guc_ct.c",
"drivers/gpu/drm/xe/xe_guc_ct.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd4e41545d5955e6f7b4a0c4b56d21010ce8e812",
"status": "affected",
"version": "231c4110873a5db4975512c30aa10edcc5be56e2",
"versionType": "git"
},
{
"lessThan": "52faa05fcd9f78af99abebe30a4b7b444744c991",
"status": "affected",
"version": "231c4110873a5db4975512c30aa10edcc5be56e2",
"versionType": "git"
},
{
"lessThan": "ee4b32220a6b41e71512e8804585325e685456ba",
"status": "affected",
"version": "231c4110873a5db4975512c30aa10edcc5be56e2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_guc.c",
"drivers/gpu/drm/xe/xe_guc_ct.c",
"drivers/gpu/drm/xe/xe_guc_ct.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Add devm release action to safely tear down CT\n\nWhen a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE\nflag, the driver initiates TLB invalidation requests via the CTB mechanism\nwhile releasing the BO. However a premature release of the CTB BO can lead\nto system crashes, as observed in:\n\nOops: Oops: 0000 [#1] SMP NOPTI\nRIP: 0010:h2g_write+0x2f3/0x7c0 [xe]\nCall Trace:\n guc_ct_send_locked+0x8b/0x670 [xe]\n xe_guc_ct_send_locked+0x19/0x60 [xe]\n send_tlb_invalidation+0xb4/0x460 [xe]\n xe_gt_tlb_invalidation_ggtt+0x15e/0x2e0 [xe]\n ggtt_invalidate_gt_tlb.part.0+0x16/0x90 [xe]\n ggtt_node_remove+0x110/0x140 [xe]\n xe_ggtt_node_remove+0x40/0xa0 [xe]\n xe_ggtt_remove_bo+0x87/0x250 [xe]\n\nIntroduce a devm-managed release action during xe_guc_ct_init() and\nxe_guc_ct_init_post_hwconfig() to ensure proper CTB disablement before\nresource deallocation, preventing the use-after-free scenario."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:02.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd4e41545d5955e6f7b4a0c4b56d21010ce8e812"
},
{
"url": "https://git.kernel.org/stable/c/52faa05fcd9f78af99abebe30a4b7b444744c991"
},
{
"url": "https://git.kernel.org/stable/c/ee4b32220a6b41e71512e8804585325e685456ba"
}
],
"title": "drm/xe/guc: Add devm release action to safely tear down CT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68193",
"datePublished": "2025-12-16T13:43:19.702Z",
"dateReserved": "2025-12-16T13:41:40.253Z",
"dateUpdated": "2026-10-21T12:38:02.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89812 (GCVE-0-2026-89812)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: force complete the MES ring fences on reset
The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is
skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses
a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1
reset, while fence_drv.sync_seq keeps advancing for every packet.
When the reset is triggered because MES itself stopped responding, the
timed-out packets advance sync_seq past the last hw fence value MES wrote.
After resume the first MES submission polls forever on a seq that is never
written back, failing the resume and wedging the box on a second reset:
amdgpu: MES ring buffer is full.
amdgpu: *ERROR* ring gfx_0.0.0 test failed (-110)
amdgpu: resume of IP block <gfx_v11_0> failed -110
amdgpu: GPU reset end with ret = -110
Force complete the MES scheduler ring fences together with the scheduler rings
so their hw fence is realigned to sync_seq.
v2: cover all XCCs (one scheduler ring each), not just mes.ring[0].
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c48d5a4d2863e56a6692ecb6cd6c32404f40cd0f",
"status": "affected",
"version": "34e087e8920e635c62e2ed6a758b0cd27f836d13",
"versionType": "git"
},
{
"lessThan": "7d722821e2f626c4e34c8510f0ce1d6f10c77a3b",
"status": "affected",
"version": "34e087e8920e635c62e2ed6a758b0cd27f836d13",
"versionType": "git"
},
{
"lessThan": "ebe7542553d008e2285e0fbba0c63f0295a7e694",
"status": "affected",
"version": "34e087e8920e635c62e2ed6a758b0cd27f836d13",
"versionType": "git"
},
{
"lessThan": "48dc279c3010ac8f91b1845b2abb3a1e9943a0f5",
"status": "affected",
"version": "34e087e8920e635c62e2ed6a758b0cd27f836d13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: force complete the MES ring fences on reset\n\nThe MES scheduler ring has no drm scheduler (no_scheduler = true), so it is\nskipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses\na polling fence whose hw value lives in wb (GTT) memory and survives a MODE1\nreset, while fence_drv.sync_seq keeps advancing for every packet.\n\nWhen the reset is triggered because MES itself stopped responding, the\ntimed-out packets advance sync_seq past the last hw fence value MES wrote.\nAfter resume the first MES submission polls forever on a seq that is never\nwritten back, failing the resume and wedging the box on a second reset:\n\n amdgpu: MES ring buffer is full.\n amdgpu: *ERROR* ring gfx_0.0.0 test failed (-110)\n amdgpu: resume of IP block \u003cgfx_v11_0\u003e failed -110\n amdgpu: GPU reset end with ret = -110\n\nForce complete the MES scheduler ring fences together with the scheduler rings\nso their hw fence is realigned to sync_seq.\n\nv2: cover all XCCs (one scheduler ring each), not just mes.ring[0]."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:52.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c48d5a4d2863e56a6692ecb6cd6c32404f40cd0f"
},
{
"url": "https://git.kernel.org/stable/c/7d722821e2f626c4e34c8510f0ce1d6f10c77a3b"
},
{
"url": "https://git.kernel.org/stable/c/ebe7542553d008e2285e0fbba0c63f0295a7e694"
},
{
"url": "https://git.kernel.org/stable/c/48dc279c3010ac8f91b1845b2abb3a1e9943a0f5"
}
],
"title": "drm/amdgpu: force complete the MES ring fences on reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89812",
"datePublished": "2026-09-16T10:30:45.246Z",
"dateReserved": "2026-09-11T19:38:34.768Z",
"dateUpdated": "2026-10-21T12:48:52.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74605 (GCVE-0-2026-74605)
Vulnerability from cvelistv5
Published
2026-08-22 15:31
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
eventfs: Use children field for rcu head and add memory barriers
When an eventfs inode is freed, it sets ei->is_freed and then uses its
ei->list to add it to the srcu link list as the list field is a union with
the rcu list head. As the ei->list is used to iterate over an SRCU
protected list without taking the eventfs_mutex, there's nothing stopping
the iteration over that list to see the ei->rcu instead of the ei->list
and it will read a corrupt target.
To fix this, change the union of the rcu list head with the children list.
On freeing the eventfs inode, set the is_free and execute a smp_wmb()
before adding the eventfs inode to the SRCU list.
On iteration of the ei->children list, at the start, execute a smp_rmb()
and then read the is_freed of the ei to see if the children list is still
valid. If is_freed is set, then the ei_child read is not valid and the
loop should exit immediately.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f3f41f444b321ec393edbc251e024fd62658ce55 Version: 704f960dbee2f1634f4b4e16f208cb16eaf41c1e Version: 704f960dbee2f1634f4b4e16f208cb16eaf41c1e Version: 704f960dbee2f1634f4b4e16f208cb16eaf41c1e Version: 704f960dbee2f1634f4b4e16f208cb16eaf41c1e Version: 305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa Version: 6.6.18 ≤ Version: 6.7.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/tracefs/event_inode.c",
"fs/tracefs/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25d27d5fa8645ab61018c3efec5c69f49280ca7d",
"status": "affected",
"version": "f3f41f444b321ec393edbc251e024fd62658ce55",
"versionType": "git"
},
{
"lessThan": "1b95382da85cff3bf0f922ff0275f186abdadfce",
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"versionType": "git"
},
{
"lessThan": "2b80707b9e27671e10840d17c6f8f774c4ad9847",
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"versionType": "git"
},
{
"lessThan": "004f7232e49730448f91665e76bdd7dff8e0c638",
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"versionType": "git"
},
{
"lessThan": "f0ece16ffca7384787b692431961ce202907acf5",
"status": "affected",
"version": "704f960dbee2f1634f4b4e16f208cb16eaf41c1e",
"versionType": "git"
},
{
"status": "affected",
"version": "305c4e4d80aca2c2d9cf2ebdea56e2eca6d3a6aa",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.18",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/tracefs/event_inode.c",
"fs/tracefs/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventfs: Use children field for rcu head and add memory barriers\n\nWhen an eventfs inode is freed, it sets ei-\u003eis_freed and then uses its\nei-\u003elist to add it to the srcu link list as the list field is a union with\nthe rcu list head. As the ei-\u003elist is used to iterate over an SRCU\nprotected list without taking the eventfs_mutex, there\u0027s nothing stopping\nthe iteration over that list to see the ei-\u003ercu instead of the ei-\u003elist\nand it will read a corrupt target.\n\nTo fix this, change the union of the rcu list head with the children list.\nOn freeing the eventfs inode, set the is_free and execute a smp_wmb()\nbefore adding the eventfs inode to the SRCU list.\n\nOn iteration of the ei-\u003echildren list, at the start, execute a smp_rmb()\nand then read the is_freed of the ei to see if the children list is still\nvalid. If is_freed is set, then the ei_child read is not valid and the\nloop should exit immediately."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local syscalls (getdents64/readdir on tracefs eventfs directories through eventfs_iterate); tracefs is a kernel pseudo-filesystem under /sys/kernel/tracing with no network, adjacent-wireless, or physical-device entry path.\nAC:L - A single multithreaded attacker can loop getdents on events/ or events/kprobes/ while concurrently adding/removing kprobes via kprobe_events writes that call eventfs_remove_dir; the attacker controls both the SRCU list walk and the free path, making the race reliably triggerable.\nPR:L - Exploitation needs only local tracefs read/write access (getdents plus kprobe_events to create/remove eventfs children); kprobe_events checks only LOCKDOWN_TRACEFS and DAC with no capable(), and tracing-group gid mounts, Android/ChromeOS, and developer systems commonly grant this to unprivileged users.\nUI:N - The attacker performs all concurrent directory reads and dynamic event removals in their own process; no separate victim mount, click, or configuration action is required beyond tracefs already being accessible on the system.\nS:U - The union misuse causes kernel heap/list corruption and use-after-free within the tracing filesystem subsystem on the same host; it does not cross VM, container, IOMMU, or other security boundaries to affect a different authority.\nC:H - During list_for_each_entry_srcu over ei-\u003echildren, a concurrently freed child repurposes ei-\u003elist (union with rcu_head) for SRCU teardown, so the iterator follows corrupt list pointers and dereferences freed or attacker-influenced kernel memory typical of UAF read primitives.\nI:H - Corrupt SRCU list traversal over freed eventfs_inode objects is classic kernel UAF memory corruption that can be combined with heap grooming from repeated kprobe create/delete to obtain arbitrary kernel writes and local privilege escalation, not merely a bounded crash.\nA:H - Following a child\u0027s list.next after the list/rcu union is switched during free_ei() readily causes invalid pointer dereferences, kernel oops, or panic; the race can be retriggered at will by alternating getdents with dynamic event teardown."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:03.903Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25d27d5fa8645ab61018c3efec5c69f49280ca7d"
},
{
"url": "https://git.kernel.org/stable/c/1b95382da85cff3bf0f922ff0275f186abdadfce"
},
{
"url": "https://git.kernel.org/stable/c/2b80707b9e27671e10840d17c6f8f774c4ad9847"
},
{
"url": "https://git.kernel.org/stable/c/004f7232e49730448f91665e76bdd7dff8e0c638"
},
{
"url": "https://git.kernel.org/stable/c/f0ece16ffca7384787b692431961ce202907acf5"
}
],
"title": "eventfs: Use children field for rcu head and add memory barriers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74605",
"datePublished": "2026-08-22T15:31:53.063Z",
"dateReserved": "2026-08-15T05:44:03.919Z",
"dateUpdated": "2026-10-21T12:46:03.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74529 (GCVE-0-2026-74529)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
There is theoretical UAF if the conn is freed while the hci_sync task is
running.
Hold refcount to avoid that.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eb8b860e87b296bd1874c79a668081efd00f9754 Version: 6d0417e4e1cf66fd917f06f0454958362714ef7d Version: 6d0417e4e1cf66fd917f06f0454958362714ef7d Version: 6d0417e4e1cf66fd917f06f0454958362714ef7d Version: 94bf6380e936339a700c0b3171a49baf512aa70b Version: 6.12.28 ≤ Version: 6.14.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74529",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:13.725492Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:53.194Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40ef39f1d755ff8d54423345c73d187e77854d0b",
"status": "affected",
"version": "eb8b860e87b296bd1874c79a668081efd00f9754",
"versionType": "git"
},
{
"lessThan": "68ffe4265775ed9e09e18e9a3b388740e25257bf",
"status": "affected",
"version": "6d0417e4e1cf66fd917f06f0454958362714ef7d",
"versionType": "git"
},
{
"lessThan": "c53c70ec289ee12f20c4f1b2fbfd151762c01f67",
"status": "affected",
"version": "6d0417e4e1cf66fd917f06f0454958362714ef7d",
"versionType": "git"
},
{
"lessThan": "44fc74069d8988f2825246f9401218e29de2c0ab",
"status": "affected",
"version": "6d0417e4e1cf66fd917f06f0454958362714ef7d",
"versionType": "git"
},
{
"status": "affected",
"version": "94bf6380e936339a700c0b3171a49baf512aa70b",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.28",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reached only via local AF_BLUETOOTH BTPROTO_ISO SOCK_SEQPACKET listen() for LE broadcast PA sync (iso_listen_bis\u2192hci_pa_create_sync\u2192hci_connect_pa_sync); no over-the-air packet parsing triggers the bug and a remote Bluetooth peer alone cannot invoke it.\nAC:L - Use-after-free race is attacker-controlled: a local process can listen() to start hci_le_pa_create_sync and immediately close/unlink the socket to drop the PA_LINK hci_conn while cmd_sync_work is still running, retrying until the callback dereferences freed memory.\nPR:L - ISO sockets perform no capability checks in iso_sock_create/bt_sock_create (only init_net), so any unprivileged local user who can open AF_BLUETOOTH sockets on a BT_ISO-capable host can reach hci_connect_pa_sync without CAP_NET_ADMIN or root.\nUI:N - Exploitation requires no victim action; the attacker opens, binds, and listens on their own ISO socket and races teardown\u2014typical on phones/headsets running LE Audio broadcast receivers with Bluetooth access granted to the attacking app/process.\nS:U - Impact stays within kernel memory via hci_conn UAF in create_pa_complete/hci_le_pa_create_sync; this is standard kernel memory corruption/privilege escalation, not a cross-boundary escape (VM, IOMMU, or sandbox).\nC:H - UAF of struct hci_conn lets an attacker influence freed slab contents and read adjacent kernel data through hci_conn_valid(), conn-\u003eflags, and conn-\u003eiso_qos dereferences during async PA sync work and error callbacks.\nI:H - Freed hci_conn is written via set_bit/clear_bit on conn-\u003eflags and error-path hci_connect_cfm()/hci_conn_add_unset in create_pa_complete; heap grooming of the reclaimed allocation enables arbitrary kernel writes and control-flow hijack.\nA:H - Dereferencing or deleting a freed hci_conn in hci_cmd_sync_work reliably causes kernel memory corruption, oops, or panic; UAFs in this subsystem have been observed to crash the host even when not fully exploited for privilege escalation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:47.259Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40ef39f1d755ff8d54423345c73d187e77854d0b"
},
{
"url": "https://git.kernel.org/stable/c/68ffe4265775ed9e09e18e9a3b388740e25257bf"
},
{
"url": "https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67"
},
{
"url": "https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab"
}
],
"title": "Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74529",
"datePublished": "2026-08-15T12:27:44.783Z",
"dateReserved": "2026-08-15T05:44:03.912Z",
"dateUpdated": "2026-10-21T12:45:47.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74752 (GCVE-0-2026-74752)
Vulnerability from cvelistv5
Published
2026-08-26 14:36
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cookie AUTH state before use
When cookie authentication is disabled, COOKIE_ECHO restores fixed-size
AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM
length, HMAC list, or CHUNKS list can then reach association consumers
with lengths or identifiers that were never validated against the local
backing arrays.
A forged RANDOM length can cause out-of-bounds reads during key-vector
construction. A forged HMAC identifier also caused a 32-byte write past
a zero-length AUTH chunk, providing a primitive for a local privilege
escalation chain.
Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie
trust boundary before copying them into the association. Reject invalid
types, malformed lengths, unsupported HMAC identifiers, HMAC lists
without SHA1, and forbidden chunk ids.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74752",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:16:25.350604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:24.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sctp/auth.h",
"net/sctp/auth.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a4410de8dc6903d859c9e1731fc6dcee28bd072",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "7f17984cfa697613800eb693e183b06884129bd3",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "88619b117be1daf633ce32210570ce35a0bd1c98",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "3dbb44d88b1e94dd31fe43588af7437b34b44d56",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sctp/auth.h",
"net/sctp/auth.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes. A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction. A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie\u0027s RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association. Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO to a listening endpoint; packets enter sctp_rcv() and are handled in sctp_sf_do_5_1D_ce()/sctp_unpack_cookie() with no local syscall required on the victim.\nAC:L - With SCTP-AUTH enabled and cookie_hmac_alg=none, an attacker completes INIT/INIT-ACK, forges peer-controlled AUTH fields in the returned cookie, and reliably triggers sctp_auth_make_key_vector()/sctp_auth_calculate_hmac() via COOKIE-ECHO without races or uncontrollable conditions.\nPR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local account privileges, capabilities, or init-namespace root on the target host.\nUI:N - No victim user action is required beyond normal SCTP listener operation; exploitation is achieved solely by sending attacker-crafted COOKIE-ECHO packets over the network during association setup or restart.\nS:U - The vulnerability corrupts kernel memory inside the SCTP stack on the target host and enables kernel privilege escalation; it does not cross a separate security boundary such as guest-to-host VM escape or IOMMU/DMA isolation bypass.\nC:H - A forged RANDOM length copied from an unauthenticated cookie drives sctp_auth_make_key_vector() to memcpy() beyond the fixed auth_random backing array, enabling out-of-bounds kernel memory reads during association shared-key construction.\nI:H - Forged HMAC identifiers from the cookie can yield a zero-length AUTH chunk while sctp_auth_calculate_hmac() still writes a 32-byte digest past the allocation, providing a heap overflow primitive the fix commit notes can chain to local privilege escalation.\nA:H - Out-of-bounds reads and the 32-byte heap overflow during COOKIE-ECHO processing can trigger kernel faults, oops, or panic on SCTP servers, and malformed AUTH state can repeatedly crash association input handling."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:23.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072"
},
{
"url": "https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3"
},
{
"url": "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98"
},
{
"url": "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"
}
],
"title": "sctp: validate cookie AUTH state before use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74752",
"datePublished": "2026-08-26T14:36:59.548Z",
"dateReserved": "2026-08-15T05:44:03.931Z",
"dateUpdated": "2026-10-21T12:46:23.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23371 (GCVE-0-2026-23371)
Vulnerability from cvelistv5
Published
2026-03-25 10:27
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
Running stress-ng --schedpolicy 0 on an RT kernel on a big machine
might lead to the following WARNINGs (edited).
sched: DL de-boosted task PID 22725: REPLENISH flag missing
WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8
... (running_bw underflow)
Call trace:
dequeue_task_dl+0x15c/0x1f8 (P)
dequeue_task+0x80/0x168
deactivate_task+0x24/0x50
push_dl_task+0x264/0x2e0
dl_task_timer+0x1b0/0x228
__hrtimer_run_queues+0x188/0x378
hrtimer_interrupt+0xfc/0x260
...
The problem is that when a SCHED_DEADLINE task (lock holder) is
changed to a lower priority class via sched_setscheduler(), it may
fail to properly inherit the parameters of potential DEADLINE donors
if it didn't already inherit them in the past (shorter deadline than
donor's at that time). This might lead to bandwidth accounting
corruption, as enqueue_task_dl() won't recognize the lock holder as
boosted.
The scenario occurs when:
1. A DEADLINE task (donor) blocks on a PI mutex held by another
DEADLINE task (holder), but the holder doesn't inherit parameters
(e.g., it already has a shorter deadline)
2. sched_setscheduler() changes the holder from DEADLINE to a lower
class while still holding the mutex
3. The holder should now inherit DEADLINE parameters from the donor
and be enqueued with ENQUEUE_REPLENISH, but this doesn't happen
Fix the issue by introducing __setscheduler_dl_pi(), which detects when
a DEADLINE (proper or boosted) task gets setscheduled to a lower
priority class. In case, the function makes the task inherit DEADLINE
parameters of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to
ensure proper bandwidth accounting during the next enqueue operation.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2279f540ea7d05f22d2f0c4224319330228586bc Version: 2279f540ea7d05f22d2f0c4224319330228586bc Version: 2279f540ea7d05f22d2f0c4224319330228586bc Version: 2279f540ea7d05f22d2f0c4224319330228586bc Version: 2279f540ea7d05f22d2f0c4224319330228586bc Version: 2279f540ea7d05f22d2f0c4224319330228586bc Version: 3cc3d77dc541181f97f1dc96d2977ef8359fd760 Version: d2b65976bf1ae9d0d9dd5770cd01695559438309 Version: 4.19.257 ≤ Version: 5.4.212 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/syscalls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0e20852d44261a9d69188bc483872930e7ba727",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"lessThan": "ce6253fe718811cceb3a0ae0dbf0a5941dea3eb6",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"lessThan": "65af3633caf195d397ec4c39f51ae7615bd5a627",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"lessThan": "0638bf16b7a73a2fe63624bd0d16d9fd904805c3",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"lessThan": "ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"lessThan": "d658686a1331db3bb108ca079d76deb3208ed949",
"status": "affected",
"version": "2279f540ea7d05f22d2f0c4224319330228586bc",
"versionType": "git"
},
{
"status": "affected",
"version": "3cc3d77dc541181f97f1dc96d2977ef8359fd760",
"versionType": "git"
},
{
"status": "affected",
"version": "d2b65976bf1ae9d0d9dd5770cd01695559438309",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.257",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.212",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/syscalls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.212",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting\n\nRunning stress-ng --schedpolicy 0 on an RT kernel on a big machine\nmight lead to the following WARNINGs (edited).\n\n sched: DL de-boosted task PID 22725: REPLENISH flag missing\n\n WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8\n ... (running_bw underflow)\n Call trace:\n dequeue_task_dl+0x15c/0x1f8 (P)\n dequeue_task+0x80/0x168\n deactivate_task+0x24/0x50\n push_dl_task+0x264/0x2e0\n dl_task_timer+0x1b0/0x228\n __hrtimer_run_queues+0x188/0x378\n hrtimer_interrupt+0xfc/0x260\n ...\n\nThe problem is that when a SCHED_DEADLINE task (lock holder) is\nchanged to a lower priority class via sched_setscheduler(), it may\nfail to properly inherit the parameters of potential DEADLINE donors\nif it didn\u0027t already inherit them in the past (shorter deadline than\ndonor\u0027s at that time). This might lead to bandwidth accounting\ncorruption, as enqueue_task_dl() won\u0027t recognize the lock holder as\nboosted.\n\nThe scenario occurs when:\n1. A DEADLINE task (donor) blocks on a PI mutex held by another\n DEADLINE task (holder), but the holder doesn\u0027t inherit parameters\n (e.g., it already has a shorter deadline)\n2. sched_setscheduler() changes the holder from DEADLINE to a lower\n class while still holding the mutex\n3. The holder should now inherit DEADLINE parameters from the donor\n and be enqueued with ENQUEUE_REPLENISH, but this doesn\u0027t happen\n\nFix the issue by introducing __setscheduler_dl_pi(), which detects when\na DEADLINE (proper or boosted) task gets setscheduled to a lower\npriority class. In case, the function makes the task inherit DEADLINE\nparameters of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to\nensure proper bandwidth accounting during the next enqueue operation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:00.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0e20852d44261a9d69188bc483872930e7ba727"
},
{
"url": "https://git.kernel.org/stable/c/ce6253fe718811cceb3a0ae0dbf0a5941dea3eb6"
},
{
"url": "https://git.kernel.org/stable/c/65af3633caf195d397ec4c39f51ae7615bd5a627"
},
{
"url": "https://git.kernel.org/stable/c/0638bf16b7a73a2fe63624bd0d16d9fd904805c3"
},
{
"url": "https://git.kernel.org/stable/c/ba1c22924ddcc280672a2a06a9ca99ee3a1b92c3"
},
{
"url": "https://git.kernel.org/stable/c/d658686a1331db3bb108ca079d76deb3208ed949"
}
],
"title": "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23371",
"datePublished": "2026-03-25T10:27:52.158Z",
"dateReserved": "2026-01-13T15:37:46.003Z",
"dateUpdated": "2026-10-30T12:24:00.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43191 (GCVE-0-2026-43191)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
[Why]
A backport of the change made for DCN401 that addresses an issue where
we turn off the PHY PLL when disabling TMDS output, which causes the
OTG to remain stuck.
The OTG being stuck can lead to a hang in the DCHVM's ability to ACK
invalidations when it thinks the HUBP is still on but it's not receiving
global sync.
The transition to PLL_ON needs to be atomic as there's no guarantee
that the thread isn't pre-empted or is able to complete before the
IOMMU watchdog times out.
[How]
Backport the implementation from dcn401 back to dcn35.
There's a functional difference in when the eDP output is disabled in
dcn401 code so we don't want to utilize it directly.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:30:34.879497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:35.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be43c36ac13d3a158791566c9fe60511022b7a15",
"status": "affected",
"version": "ec129fa356bea5411cb16833cc5dab32689ea389",
"versionType": "git"
},
{
"lessThan": "02b033e18e08a1d0b53cf540196688c82af60a2f",
"status": "affected",
"version": "ec129fa356bea5411cb16833cc5dab32689ea389",
"versionType": "git"
},
{
"lessThan": "d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51",
"status": "affected",
"version": "ec129fa356bea5411cb16833cc5dab32689ea389",
"versionType": "git"
},
{
"lessThan": "75372d75a4e23783583998ed99d5009d555850da",
"status": "affected",
"version": "ec129fa356bea5411cb16833cc5dab32689ea389",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM\u0027s ability to ACK\ninvalidations when it thinks the HUBP is still on but it\u0027s not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there\u0027s no guarantee\nthat the thread isn\u0027t pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere\u0027s a functional difference in when the eDP output is disabled in\ndcn401 code so we don\u0027t want to utilize it directly."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:15.487Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be43c36ac13d3a158791566c9fe60511022b7a15"
},
{
"url": "https://git.kernel.org/stable/c/02b033e18e08a1d0b53cf540196688c82af60a2f"
},
{
"url": "https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51"
},
{
"url": "https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da"
}
],
"title": "drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43191",
"datePublished": "2026-05-06T11:28:00.470Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-11-06T15:32:35.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98049 (GCVE-0-2026-98049)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: zero extend the result of an arena 32-bit cmpxchg
bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from
BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before
bpf_opt_subreg_zext_lo32_rnd_hi32().
That pass emits an explicit zero extension for a 32-bit cmpxchg even
when bpf_jit_needs_zext() is false. This is done because on some
architectures 32-bit cmpxchg requires explicit zero extension for the
dst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax
if comparison is successful, while BPF semantics declare that each
operation on a 32-bit register zero extends it's upper half.
is_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena
cmpxchg misses said zero extension adjustment. This patch adjusts
is_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/fixups.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1bb1be18263995b159cf5afad3a05500ba6d2a7b",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
},
{
"lessThan": "6bb6ae5ab1beffda51dabf41612f501d07f10fc6",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
},
{
"lessThan": "1c1b476d43a8b6c9bc04600369dd8cc39950d98e",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
},
{
"lessThan": "4814ed6406f3493bd554ad046da5f7fc04833571",
"status": "affected",
"version": "d503a04f8bc0c75dc9db9452d8cc79d748afb752",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/fixups.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: zero extend the result of an arena 32-bit cmpxchg\n\nbpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from\nBPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before\nbpf_opt_subreg_zext_lo32_rnd_hi32().\n\nThat pass emits an explicit zero extension for a 32-bit cmpxchg even\nwhen bpf_jit_needs_zext() is false. This is done because on some\narchitectures 32-bit cmpxchg requires explicit zero extension for the\ndst register. E.g. on x86-64 \u0027lock cmpxchg\u0027 does not change the %eax\nif comparison is successful, while BPF semantics declare that each\noperation on a 32-bit register zero extends it\u0027s upper half.\n\nis_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena\ncmpxchg misses said zero extension adjustment. This patch adjusts\nis_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:16.141Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1bb1be18263995b159cf5afad3a05500ba6d2a7b"
},
{
"url": "https://git.kernel.org/stable/c/6bb6ae5ab1beffda51dabf41612f501d07f10fc6"
},
{
"url": "https://git.kernel.org/stable/c/1c1b476d43a8b6c9bc04600369dd8cc39950d98e"
},
{
"url": "https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"
}
],
"title": "bpf: zero extend the result of an arena 32-bit cmpxchg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98049",
"datePublished": "2026-09-25T10:23:58.561Z",
"dateReserved": "2026-09-25T10:19:56.072Z",
"dateUpdated": "2026-10-21T12:54:16.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99201 (GCVE-0-2026-99201)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlink: avoid hashing the network namespace pointer
The netlink rhashtable key includes a raw struct net pointer and a
user-controlled port ID. Both /proc/net/netlink and socket diagnostics
expose the table's bucket order. By binding and rebinding chosen
NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal
buckets and recover the low bits of the Jenkins hash. Its 32-bit seed
and the limited set of kernel-image slides can then be searched offline
to recover the address of init_net.
Use the namespace's unique, non-address net_cookie in the comparison
key instead. It is assigned before the per-net initializers run and
remains unchanged for the namespace's lifetime. The lookup key and
object hash are still built by netlink_compare_arg_init(), keeping
lookup, insertion, removal and rehashing consistent while preserving
namespace separation. Neither public table walker needs to change.
Reading the socket's namespace cookie in netlink_compare() is safe
under RCU, including during namespace teardown. netlink_release()
removes the socket from the hash table and defers its final put with
call_rcu(). cleanup_net() runs the per-net exit methods and waits for
outstanding RCU callbacks with rcu_barrier() before freeing namespace
storage.
Unlike ns.ns_id, net_cookie is also available and initialized during
setup_net() in older stable kernels, making the change straightforward
to backport to v5.15 and later.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 Version: c428ecd1a21f1457ca3beb4df71b8a079c410e41 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c61431f3b8c9824e9848a0308054f92b27fa7794",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "c03fb9c4be3b2dd0996d91e54f65407f7f475238",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "41a2f69f091b0765f17890d8ac04852c12f25cf6",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "18edcb9945118beb7a1b64a31a7370ecab485a79",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "bdd55b8a8acbf6b4840ab420eb6a63774bf4593b",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "078deff25f8a849ecd1c3fe17b1e473b1cf44f28",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "f88bb3606e4bd11ee035b682cddc2999e604609a",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table\u0027s bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace\u0027s unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace\u0027s lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket\u0027s namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:51.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c61431f3b8c9824e9848a0308054f92b27fa7794"
},
{
"url": "https://git.kernel.org/stable/c/f8d2690f3c5dfad1fc306f6d5d84a1d3176c3af9"
},
{
"url": "https://git.kernel.org/stable/c/c03fb9c4be3b2dd0996d91e54f65407f7f475238"
},
{
"url": "https://git.kernel.org/stable/c/41a2f69f091b0765f17890d8ac04852c12f25cf6"
},
{
"url": "https://git.kernel.org/stable/c/18edcb9945118beb7a1b64a31a7370ecab485a79"
},
{
"url": "https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b"
},
{
"url": "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28"
},
{
"url": "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"
}
],
"title": "netlink: avoid hashing the network namespace pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99201",
"datePublished": "2026-10-28T10:35:56.069Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-30T12:42:51.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68409 (GCVE-0-2026-68409)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: defer link RX stats percpu free to RCU
sta_remove_link() frees a removed MLO link's RX stats percpu buffer right
away, but defers only the link container to RCU:
sta_info_free_link(&alloc->info);
kfree_rcu(alloc, rcu_head);
The RX fast path reads link_sta under rcu_read_lock and writes the percpu
stats. A reader that resolved link_sta before the removal keeps the
pointer. The container stays alive from the kfree_rcu, so the read still
works. But the percpu block it points to is already freed. This needs
uses_rss. That is when pcpu_rx_stats exists.
The full STA teardown frees the deflink stats only after
synchronize_net(). The link removal path had no such barrier. The race is
hard to win in practice, but the free should still wait for RCU.
Free the link together with its data from a single RCU callback, so the
percpu block is reclaimed only after readers drain.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c71420db653aba30a234d1e4cf86dde376e604fa Version: c71420db653aba30a234d1e4cf86dde376e604fa Version: c71420db653aba30a234d1e4cf86dde376e604fa Version: c71420db653aba30a234d1e4cf86dde376e604fa Version: c71420db653aba30a234d1e4cf86dde376e604fa Version: c71420db653aba30a234d1e4cf86dde376e604fa |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:24.807491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/sta_info.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "acd5931d5adf12f0163f83dc00320e7011f4da92",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "a5afc00280986063f1c355821544fabbb2a960f7",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "b679c1cffb2f3d0854b8b05ea9e909ad6489046f",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "2aa1789880fa5e41049b0f6a74a4fc2fa1997610",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "a03fceae0c65b31ce31840dac5e26684ceecb65b",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "aa2eb62525188269cdd402a583b9a8ed94657ff0",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/sta_info.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The race is driven entirely over the air: the RX fast path writing the freed percpu stats is fed by received 802.11 data frames, and the link removal that frees them is triggered by AP-originated ML reconfiguration/association-response handling in ieee80211_ml_reconf_work(). A rogue AP or frame injector within radio range of the victim station suffices, so this is adjacent (Wi-Fi) rather than routable network access.\nAC:L - The attacker controls both sides of the race \u2014 it supplies the RX traffic stream that dereferences link_sta and writes pcpu_rx_stats, and it triggers the MLO link removal that frees that percpu block \u2014 and can repeat link add/remove cycles indefinitely under high packet rates spread across many CPUs by RSS. No condition outside the attacker\u0027s influence is needed beyond a mainstream RSS-capable MLO driver (iwlwifi, ath11k/ath12k).\nPR:N - No privileges or accounts on the victim system are required; the frames come from the peer AP, and a rogue AP or spoofed ML reconfiguration/data frames reach the code with no authorization on the target host.\nUI:N - Frame reception, MLO link reconfiguration and station link teardown are all handled automatically by mac80211 with no action by the device\u0027s user.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed percpu block can be reallocated to other subsystems, and the RX path continues reading fields such as last_signal, chains and counters from it, so attacker-influenced reuse of that memory can expose kernel data; per use-after-free scoring this is treated as high confidentiality impact.\nI:H - The RX fast path performs repeated writes (last_rx, last_rate, fragments, packets, chain_signal_last) into the already-freed percpu allocation, corrupting whatever percpu data is reallocated there \u2014 an attacker-timed write primitive into arbitrary recycled kernel state.\nA:H - Writing through a freed percpu pointer from the RX hot path corrupts kernel allocator state and unrelated percpu data, readily producing oopses or panics; KASAN-instrumented kernels report the use-after-free outright."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:32.032Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/acd5931d5adf12f0163f83dc00320e7011f4da92"
},
{
"url": "https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7"
},
{
"url": "https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f"
},
{
"url": "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610"
},
{
"url": "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b"
},
{
"url": "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"
}
],
"title": "wifi: mac80211: defer link RX stats percpu free to RCU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68409",
"datePublished": "2026-08-10T12:04:29.238Z",
"dateReserved": "2026-07-30T09:28:09.390Z",
"dateUpdated": "2026-10-30T12:28:32.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90106 (GCVE-0-2026-90106)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: arp/nd proxy: fix reading neigh ha
Currently neigh ha address is read directly, but that can result in
torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot
to take a stable snapshot of the address.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 057658cb33fbf4d4309f01fe8845903b1cd07fad Version: 057658cb33fbf4d4309f01fe8845903b1cd07fad Version: 057658cb33fbf4d4309f01fe8845903b1cd07fad Version: 057658cb33fbf4d4309f01fe8845903b1cd07fad Version: 057658cb33fbf4d4309f01fe8845903b1cd07fad Version: 057658cb33fbf4d4309f01fe8845903b1cd07fad |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2365b25b4add42bb5f652920b45bc9ad0e35cbc7",
"status": "affected",
"version": "057658cb33fbf4d4309f01fe8845903b1cd07fad",
"versionType": "git"
},
{
"lessThan": "490c72868443ff90f47f4ccbaaff1eaf8fed46ab",
"status": "affected",
"version": "057658cb33fbf4d4309f01fe8845903b1cd07fad",
"versionType": "git"
},
{
"lessThan": "a178bcb01051688fb085ffb72cc4b13b5df0fc0f",
"status": "affected",
"version": "057658cb33fbf4d4309f01fe8845903b1cd07fad",
"versionType": "git"
},
{
"lessThan": "884cbf15ccd3980bcc9583073045f91798a86d4e",
"status": "affected",
"version": "057658cb33fbf4d4309f01fe8845903b1cd07fad",
"versionType": "git"
},
{
"lessThan": "291c9e137b7c74e8a512cded4845352da4c4adda",
"status": "affected",
"version": "057658cb33fbf4d4309f01fe8845903b1cd07fad",
"versionType": "git"
},
{
"lessThan": "57549ab9079122991dfa0f8248ca00e101e8e69b",
"status": "affected",
"version": "057658cb33fbf4d4309f01fe8845903b1cd07fad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: arp/nd proxy: fix reading neigh ha\n\nCurrently neigh ha address is read directly, but that can result in\ntorn/partial reads if the neigh is being updated. Use neigh_ha_snapshot\nto take a stable snapshot of the address."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:10.967Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2365b25b4add42bb5f652920b45bc9ad0e35cbc7"
},
{
"url": "https://git.kernel.org/stable/c/490c72868443ff90f47f4ccbaaff1eaf8fed46ab"
},
{
"url": "https://git.kernel.org/stable/c/a178bcb01051688fb085ffb72cc4b13b5df0fc0f"
},
{
"url": "https://git.kernel.org/stable/c/884cbf15ccd3980bcc9583073045f91798a86d4e"
},
{
"url": "https://git.kernel.org/stable/c/291c9e137b7c74e8a512cded4845352da4c4adda"
},
{
"url": "https://git.kernel.org/stable/c/57549ab9079122991dfa0f8248ca00e101e8e69b"
}
],
"title": "net: bridge: arp/nd proxy: fix reading neigh ha",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90106",
"datePublished": "2026-09-17T16:06:15.470Z",
"dateReserved": "2026-09-11T19:38:34.787Z",
"dateUpdated": "2026-10-30T12:34:10.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72440 (GCVE-0-2026-72440)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: fix writes_pending and barrier reference leaks on write failures
raid1_make_request() acquires a writes_pending reference with
md_write_start() before calling raid1_write_request(). Several failure
paths in raid1_write_request() complete the bio and return without
reaching the normal write completion path, causing the corresponding
md_write_end() to be skipped.
Make raid1_write_request() return a status indicating whether the write
request was successfully queued. This allows raid1_make_request() to
call md_write_end() when raid1_write_request() fails.
Additionally, if wait_blocked_rdev() fails after wait_barrier()
succeeds, the associated barrier reference is not released.
Call allow_barrier() before returning from that path to keep the barrier
accounting balanced.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5aa705039c4fca84575539bfa2b8a28454a3d2ca Version: 5aa705039c4fca84575539bfa2b8a28454a3d2ca Version: 5aa705039c4fca84575539bfa2b8a28454a3d2ca Version: 5aa705039c4fca84575539bfa2b8a28454a3d2ca Version: 5aa705039c4fca84575539bfa2b8a28454a3d2ca Version: 5aa705039c4fca84575539bfa2b8a28454a3d2ca |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:04.662710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:24.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "874f54243d881fde1890849000beb88a7880d1ec",
"status": "affected",
"version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
"versionType": "git"
},
{
"lessThan": "921e2baa626d1504bf30295816aaeb90ac8c82f4",
"status": "affected",
"version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
"versionType": "git"
},
{
"lessThan": "a846affa813013204d0cce0cfdaeb99e8fcce188",
"status": "affected",
"version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
"versionType": "git"
},
{
"lessThan": "7a450460687919e79b5f8503bdeb13ecf4cca311",
"status": "affected",
"version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
"versionType": "git"
},
{
"lessThan": "bffbbfcbd9393e315a7a4286dcd70e875265db9a",
"status": "affected",
"version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
"versionType": "git"
},
{
"lessThan": "8e065a1602511282fc0da2dc89445e0eb71a681c",
"status": "affected",
"version": "5aa705039c4fca84575539bfa2b8a28454a3d2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix writes_pending and barrier reference leaks on write failures\n\nraid1_make_request() acquires a writes_pending reference with\nmd_write_start() before calling raid1_write_request(). Several failure\npaths in raid1_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid1_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid1_make_request() to\ncall md_write_end() when raid1_write_request() fails.\n\nAdditionally, if wait_blocked_rdev() fails after wait_barrier()\nsucceeds, the associated barrier reference is not released.\n\nCall allow_barrier() before returning from that path to keep the barrier\naccounting balanced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in md/raid1 write handling reached via block-layer writes to RAID1-backed volumes; on storage servers and appliances, remote NFS, SMB (ksmbd), iSCSI, and NVMe-oF clients submit those writes through md_submit_bio() to raid1_make_request() the same as local I/O.\nAC:L - An attacker with write access can reliably trigger the leaks using RWF_NOWAIT during active resync/barriers, against mirrors in BlockedBadBlocks state after prior write errors, or via bio_submit_split_bioset() failure paths; they control I/O timing and concurrency without uncontrollable races.\nPR:L - Exploitation requires only the ability to issue writes to the RAID1 array\u2014via a mounted filesystem, O_RDWR on /dev/mdX, or an authenticated network storage client\u2014not CAP_SYS_ADMIN or other privileges needed to create or reconfigure the md array.\nUI:N - No victim interaction is required; the attacker or their storage client issues the triggering RWF_NOWAIT or failing write requests directly, with no separate mount, file open, or administrator action needed at exploitation time.\nS:U - Impact is confined to kernel md RAID1 write/barrier accounting and array lifecycle state within the same host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:N - Leaked writes_pending and nr_pending reference counters do not corrupt memory, read out of bounds, or use-after-free; there is no kernel pointer leak or arbitrary memory disclosure primitive.\nI:L - Skipped md_write_end() on failure paths leaves writes_pending inflated and prevents set_in_sync()/clean sysfs transitions, causing persistent incorrect RAID1 dirty/clean metadata state that cannot be corrected until reboot.\nA:H - Leaked conf-\u003enr_pending from the wait_blocked_rdev()+REQ_NOWAIT path inflates get_unqueued_pending() so freeze_array() wait_event never completes, deadlocking array quiesce, reshape, removal, and read-error recovery while array_frozen blocks new I/O."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:25.252Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/874f54243d881fde1890849000beb88a7880d1ec"
},
{
"url": "https://git.kernel.org/stable/c/921e2baa626d1504bf30295816aaeb90ac8c82f4"
},
{
"url": "https://git.kernel.org/stable/c/a846affa813013204d0cce0cfdaeb99e8fcce188"
},
{
"url": "https://git.kernel.org/stable/c/7a450460687919e79b5f8503bdeb13ecf4cca311"
},
{
"url": "https://git.kernel.org/stable/c/bffbbfcbd9393e315a7a4286dcd70e875265db9a"
},
{
"url": "https://git.kernel.org/stable/c/8e065a1602511282fc0da2dc89445e0eb71a681c"
}
],
"title": "md/raid1: fix writes_pending and barrier reference leaks on write failures",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72440",
"datePublished": "2026-08-15T05:56:52.662Z",
"dateReserved": "2026-08-09T03:40:39.930Z",
"dateUpdated": "2026-10-30T12:29:25.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46059 (GCVE-0-2026-46059)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
For guests with NRIPS disabled, L1 does not provide NextRIP when running
an L2 with an injected soft interrupt, instead it advances the current RIP
before running it. KVM uses the current RIP as the NextRIP in vmcb02 to
emulate a CPU without NRIPS.
However, after L2 runs the first time, NextRIP will be updated by the CPU
and/or KVM, and the current RIP is no longer the correct value to use in
vmcb02. Hence, after save/restore, use the current RIP if and only if a
nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the
same treatment, as it's the same logic, just for a narrower use case.
[sean: give soft_int_next_rip the same treatment]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:06:48.257171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:34.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98717fb482fa269db491f7c84aec777d3aeb2cd1",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "b1a45e8a59bcf1f1ec0da6d4e42190b4211c67fc",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "f9197a9dd1408e203147326139122f9c5312ce9c",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "69fe1411a5ce678b4da6489b5d2282b4e1d13acf",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "8d397582f6b5e9fbcf09781c7c934b4910e94a50",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use NextRIP as vmcb02\u0027s NextRIP after first L2 VMRUN\n\nFor guests with NRIPS disabled, L1 does not provide NextRIP when running\nan L2 with an injected soft interrupt, instead it advances the current RIP\nbefore running it. KVM uses the current RIP as the NextRIP in vmcb02 to\nemulate a CPU without NRIPS.\n\nHowever, after L2 runs the first time, NextRIP will be updated by the CPU\nand/or KVM, and the current RIP is no longer the correct value to use in\nvmcb02. Hence, after save/restore, use the current RIP if and only if a\nnested run is pending, otherwise use NextRIP. Give soft_int_next_rip the\nsame treatment, as it\u0027s the same logic, just for a narrower use case.\n\n[sean: give soft_int_next_rip the same treatment]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:58.422Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98717fb482fa269db491f7c84aec777d3aeb2cd1"
},
{
"url": "https://git.kernel.org/stable/c/b1a45e8a59bcf1f1ec0da6d4e42190b4211c67fc"
},
{
"url": "https://git.kernel.org/stable/c/f9197a9dd1408e203147326139122f9c5312ce9c"
},
{
"url": "https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb"
},
{
"url": "https://git.kernel.org/stable/c/69fe1411a5ce678b4da6489b5d2282b4e1d13acf"
},
{
"url": "https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50"
}
],
"title": "KVM: nSVM: Always use NextRIP as vmcb02\u0027s NextRIP after first L2 VMRUN",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46059",
"datePublished": "2026-05-27T12:57:19.928Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-11-06T16:13:34.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99161 (GCVE-0-2026-99161)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any
subsequent operation fails or when the module is unloaded, the clock
reference count is never decremented via clk_put(), leading to a
resource leak.
Switch to devm_clk_get() so that the clock is automatically managed
and released.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 Version: 560746eb79d3124a278452c8dd968682b521cc82 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-viai2c-wmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e48754da403f61a347d2198fd8b50111319b3a52",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "f66341404d6ee3f5d451cc97c2f2c5b771e48d25",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "aa910d9d4c2711478ed1567bc691d0f9651166cb",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "9504c8b6644f3c8799206c2e2840260bd416f341",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "a1b0b91c663be67072a76d76d980577a160ce694",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "5d476bb76b7d72d8b7ed04a9c614900b097e3af7",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "1875de656370c89b99a150d220df876288ee0344",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
},
{
"lessThan": "aaabefc79b0ff0018e8e3832169bbe359d0551fc",
"status": "affected",
"version": "560746eb79d3124a278452c8dd968682b521cc82",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-viai2c-wmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()\n\nIn wmt_i2c_probe(), i2c-\u003eclk is acquired using of_clk_get(). If any\nsubsequent operation fails or when the module is unloaded, the clock\nreference count is never decremented via clk_put(), leading to a\nresource leak.\n\nSwitch to devm_clk_get() so that the clock is automatically managed\nand released."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:28.035Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e48754da403f61a347d2198fd8b50111319b3a52"
},
{
"url": "https://git.kernel.org/stable/c/f66341404d6ee3f5d451cc97c2f2c5b771e48d25"
},
{
"url": "https://git.kernel.org/stable/c/aa910d9d4c2711478ed1567bc691d0f9651166cb"
},
{
"url": "https://git.kernel.org/stable/c/9504c8b6644f3c8799206c2e2840260bd416f341"
},
{
"url": "https://git.kernel.org/stable/c/a1b0b91c663be67072a76d76d980577a160ce694"
},
{
"url": "https://git.kernel.org/stable/c/5d476bb76b7d72d8b7ed04a9c614900b097e3af7"
},
{
"url": "https://git.kernel.org/stable/c/1875de656370c89b99a150d220df876288ee0344"
},
{
"url": "https://git.kernel.org/stable/c/aaabefc79b0ff0018e8e3832169bbe359d0551fc"
}
],
"title": "i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99161",
"datePublished": "2026-10-28T10:35:13.970Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-30T12:42:28.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90205 (GCVE-0-2026-90205)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate orphan slot during inode read
Patch series "ocfs2: validate active orphan slots during inode read".
OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.
A corrupted slot can therefore index osb_orphan_wipes or the slot-local
system-inode cache outside their allocations before the corruption is
reported.
Patch 1 validates the ordinary orphan slot used by inode wipe processing.
Patch 2 validates the append-DIO orphan slot used by DIO completion and
orphan recovery. Both checks reject corrupt metadata at the existing inode
validation boundary.
This patch (of 2):
[BUG]
A corrupted dinode with OCFS2_ORPHANED_FL can carry an
i_orphaned_slot outside the mounted filesystem slot range.
ocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking
up the orphan directory, causing an out-of-bounds memory access.
BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102
Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85
Call Trace:
...
ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102
ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840
ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]
ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295
evict+0x38e/0x8f0 fs/inode.c:810
iput_final fs/inode.c:1914 [inline]
iput fs/inode.c:1966 [inline]
iput+0x55b/0x8b0 fs/inode.c:1926
ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374
ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373
...
[CAUSE]
ocfs2_validate_inode_block() validates i_suballoc_slot but leaves
the active ordinary orphan slot unchecked. Downstream consumers
assume that the value is smaller than osb->max_slots.
[FIX]
Reject an active i_orphaned_slot outside the slot range during
dinode validation, before the inode reaches orphan wipe processing.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b4df6ed8db0c387d38292e31f00adc4cd297ed5a Version: b4df6ed8db0c387d38292e31f00adc4cd297ed5a Version: b4df6ed8db0c387d38292e31f00adc4cd297ed5a Version: b4df6ed8db0c387d38292e31f00adc4cd297ed5a Version: b4df6ed8db0c387d38292e31f00adc4cd297ed5a Version: b4df6ed8db0c387d38292e31f00adc4cd297ed5a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "edd76be702c0f8702472888425237fb9219e1c43",
"status": "affected",
"version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
"versionType": "git"
},
{
"lessThan": "f535a34831f8325950933b401c76bfa99624419c",
"status": "affected",
"version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
"versionType": "git"
},
{
"lessThan": "dea50e8049b0db2eb3d468e2505034962e81d8cd",
"status": "affected",
"version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
"versionType": "git"
},
{
"lessThan": "c6c908f9b4edfb04534b15573168ae038f7a9cbf",
"status": "affected",
"version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
"versionType": "git"
},
{
"lessThan": "3d7c4b7ce7b4baedfd8699fa692cd95f77d332de",
"status": "affected",
"version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
"versionType": "git"
},
{
"lessThan": "b2d31acbd3b182755b019183fb46949ba5e39b9f",
"status": "affected",
"version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"lessThan": "2.6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate orphan slot during inode read\n\nPatch series \"ocfs2: validate active orphan slots during inode read\".\n\nOCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.\nA corrupted slot can therefore index osb_orphan_wipes or the slot-local\nsystem-inode cache outside their allocations before the corruption is\nreported.\n\nPatch 1 validates the ordinary orphan slot used by inode wipe processing.\nPatch 2 validates the append-DIO orphan slot used by DIO completion and\norphan recovery. Both checks reject corrupt metadata at the existing inode\nvalidation boundary.\n\n\nThis patch (of 2):\n\n[BUG]\nA corrupted dinode with OCFS2_ORPHANED_FL can carry an\ni_orphaned_slot outside the mounted filesystem slot range.\nocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking\nup the orphan directory, causing an out-of-bounds memory access.\n\nBUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\nRead of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85\nCall Trace:\n ...\n ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\n ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840\n ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]\n ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295\n evict+0x38e/0x8f0 fs/inode.c:810\n iput_final fs/inode.c:1914 [inline]\n iput fs/inode.c:1966 [inline]\n iput+0x55b/0x8b0 fs/inode.c:1926\n ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374\n ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373\n ...\n\n[CAUSE]\nocfs2_validate_inode_block() validates i_suballoc_slot but leaves\nthe active ordinary orphan slot unchecked. Downstream consumers\nassume that the value is smaller than osb-\u003emax_slots.\n\n[FIX]\nReject an active i_orphaned_slot outside the slot range during\ndinode validation, before the inode reaches orphan wipe processing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled field is dinode i_orphaned_slot, read from the mounted block device in ocfs2_validate_inode_block()/ocfs2_read_locked_inode() and consumed by ocfs2_wipe_inode(); it is not a field of an o2net, NFS, or SMB message. Delivery is a locally mounted OCFS2 image (loop or other block device).\nAC:L - A crafted dinode with OCFS2_ORPHANED_FL and an attacker-chosen i_orphaned_slot is accepted before the fix. ocfs2_fill_super() calls ocfs2_complete_mount_recovery(), which queues ocfs2_recover_orphans(); that igets the orphan and iputs it into ocfs2_evict_inode()\u2192ocfs2_wipe_inode() with no race.\nPR:N - ocfs2_fs_type.fs_flags has no FS_USERNS_MOUNT, so only a privileged mount(2) via ocfs2_get_tree()/ocfs2_fill_super() reaches recovery. The attacker who supplies the image needs no host credentials; unlink cannot plant this value because ocfs2_orphan_add() writes osb-\u003eslot_num.\nUI:R - The bug fires from ocfs2_complete_recovery()\u2192ocfs2_recover_orphans() after the victim mounts the crafted volume through ocfs2_fill_super(). That mount is the required user action and cannot be treated as a standing export of already-on-disk metadata.\nS:U - The out-of-bounds accesses in ocfs2_check_orphan_recovery_state() and get_local_system_inode() corrupt memory in the kernel that mounted the OCFS2 volume. No KVM, Xen, or IOMMU boundary is crossed.\nC:H - get_local_system_inode() computes index = i_orphaned_slot * NUM_LOCAL_SYSTEM_INODES and reads an 8-byte inode pointer past the kcalloc\u0027d local_system_inodes array (KASAN UAF read in ocfs2_get_system_file_inode). A non-NULL value is passed to igrab(), disclosing adjacent slab contents.\nI:H - ocfs2_check_orphan_recovery_state() does osb-\u003eosb_orphan_wipes[slot]++ with the untrusted i_orphaned_slot against a kcalloc(max_slots) array (max_slots \u2264 255), a heap out-of-bounds increment. The OOB pointer is then used as an inode in inode_lock/ocfs2_inode_lock.\nA:H - ocfs2_node_map_test_bit() BUG()s when i_orphaned_slot \u003e= OCFS2_NODE_MAP_MAX_NODES (256). Smaller out-of-range slots still OOB-index osb_orphan_wipes[] and local_system_inodes[], which KASAN reported as slab-use-after-free during ocfs2_recover_orphans() in ocfs2_complete_recovery()."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:45.443Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/edd76be702c0f8702472888425237fb9219e1c43"
},
{
"url": "https://git.kernel.org/stable/c/f535a34831f8325950933b401c76bfa99624419c"
},
{
"url": "https://git.kernel.org/stable/c/dea50e8049b0db2eb3d468e2505034962e81d8cd"
},
{
"url": "https://git.kernel.org/stable/c/c6c908f9b4edfb04534b15573168ae038f7a9cbf"
},
{
"url": "https://git.kernel.org/stable/c/3d7c4b7ce7b4baedfd8699fa692cd95f77d332de"
},
{
"url": "https://git.kernel.org/stable/c/b2d31acbd3b182755b019183fb46949ba5e39b9f"
}
],
"title": "ocfs2: validate orphan slot during inode read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90205",
"datePublished": "2026-09-17T16:07:21.521Z",
"dateReserved": "2026-09-11T19:38:34.793Z",
"dateUpdated": "2026-10-30T12:34:45.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98124 (GCVE-0-2026-98124)
Vulnerability from cvelistv5
Published
2026-09-25 10:36
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/client: invalidate fscache for fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and
smb3_collapse_range() modify file contents through server-side range
operations. These operations discard the affected page cache, but leave
the FS-Cache cookie valid, so a later read may return data cached before
the range operation.
Fix this by invalidating FS-Cache after outstanding I/O has completed
and before modifying the file on the server.
Run the following as root on a CIFS mount with fsc enabled and an active
CacheFiles backend:
bash -c '
MNT=/mnt/cifs
FILE="$MNT/repro"
# Generate four 1 MiB random blocks: [A][B][C][D].
dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none
# Expected contents after zeroing B: [A][zero][C][D].
cp /tmp/src /tmp/expected
dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \
conv=notrunc status=none
cp /tmp/src "$FILE"
# Populate FS-Cache, then discard the page cache.
sync
echo 1 > /proc/sys/vm/drop_caches
cat "$FILE" > /dev/null
sync
echo 1 > /proc/sys/vm/drop_caches
fallocate --zero-range -o 1M -l 1M "$FILE"
if cmp -s /tmp/expected "$FILE"; then
echo "readback: OK"
else
echo "readback: STALE DATA"
fi
'
Before this change, the readback differs from /tmp/expected:
readback: STALE DATA
After this change, it matches:
readback: OK
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc7202a51b8777a757bda9dcfbf339f828c6a130",
"status": "affected",
"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6",
"versionType": "git"
},
{
"lessThan": "dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5",
"status": "affected",
"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6",
"versionType": "git"
},
{
"lessThan": "93c6e5a8d7c5071d586c1411596d5db5faad22b2",
"status": "affected",
"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6",
"versionType": "git"
},
{
"lessThan": "448ba0ae65ca61064183564d2983c9aa59bd6ba7",
"status": "affected",
"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: invalidate fscache for fallocate range operations\n\nsmb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and\nsmb3_collapse_range() modify file contents through server-side range\noperations. These operations discard the affected page cache, but leave\nthe FS-Cache cookie valid, so a later read may return data cached before\nthe range operation.\n\nFix this by invalidating FS-Cache after outstanding I/O has completed\nand before modifying the file on the server.\n\nRun the following as root on a CIFS mount with fsc enabled and an active\nCacheFiles backend:\n\n bash -c \u0027\n MNT=/mnt/cifs\n FILE=\"$MNT/repro\"\n\n # Generate four 1 MiB random blocks: [A][B][C][D].\n dd if=/dev/urandom of=/tmp/src bs=1M count=4 status=none\n\n # Expected contents after zeroing B: [A][zero][C][D].\n cp /tmp/src /tmp/expected\n dd if=/dev/zero of=/tmp/expected bs=1M seek=1 count=1 \\\n conv=notrunc status=none\n cp /tmp/src \"$FILE\"\n\n # Populate FS-Cache, then discard the page cache.\n sync\n echo 1 \u003e /proc/sys/vm/drop_caches\n cat \"$FILE\" \u003e /dev/null\n sync\n echo 1 \u003e /proc/sys/vm/drop_caches\n\n fallocate --zero-range -o 1M -l 1M \"$FILE\"\n\n if cmp -s /tmp/expected \"$FILE\"; then\n echo \"readback: OK\"\n else\n echo \"readback: STALE DATA\"\n fi\n \u0027\n\nBefore this change, the readback differs from /tmp/expected:\n\n readback: STALE DATA\n\nAfter this change, it matches:\n\n readback: OK"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:35.267Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc7202a51b8777a757bda9dcfbf339f828c6a130"
},
{
"url": "https://git.kernel.org/stable/c/dd8b1e808f5c19479e6ed47e2f88a1fd46f8b0e5"
},
{
"url": "https://git.kernel.org/stable/c/93c6e5a8d7c5071d586c1411596d5db5faad22b2"
},
{
"url": "https://git.kernel.org/stable/c/448ba0ae65ca61064183564d2983c9aa59bd6ba7"
}
],
"title": "smb/client: invalidate fscache for fallocate range operations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98124",
"datePublished": "2026-09-25T10:36:06.581Z",
"dateReserved": "2026-09-25T10:25:14.318Z",
"dateUpdated": "2026-10-21T12:54:35.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72439 (GCVE-0-2026-72439)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix writes_pending leak on write request failures
raid10_make_request() acquires a writes_pending reference with
md_write_start() before dispatching write requests. Several failure
paths in raid10_write_request() complete the bio and return without
reaching the normal write completion path, causing the corresponding
md_write_end() to be skipped.
Make raid10_write_request() return a status indicating whether the write
request was successfully queued. This allows raid10_make_request() to
release the writes_pending reference with md_write_end() when a write
request fails.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2 Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2 Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2 Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2 Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2 Version: c9aa889b035fca4598ae985a0f0c76ebbb547ad2 Version: 39db562b3fedb93978a7e42dd216b306740959f8 Version: 5.15.111 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "55dc3d1d6a9983867273d3531e3ddd743428db8d",
"status": "affected",
"version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
"versionType": "git"
},
{
"lessThan": "f076460c5205c9687059e5a3afeed37d2f2ceb6b",
"status": "affected",
"version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
"versionType": "git"
},
{
"lessThan": "b6667d925c274910423385042edf18f6788dbceb",
"status": "affected",
"version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
"versionType": "git"
},
{
"lessThan": "c642583adc136d4c70ce3c65c3f43e847d26c776",
"status": "affected",
"version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
"versionType": "git"
},
{
"lessThan": "f94031c94eaebe14a7c9e91720064de0c5a54a6c",
"status": "affected",
"version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
"versionType": "git"
},
{
"lessThan": "e045d6ed33f8faa3e3dd6dc33c62ec01e3ad275d",
"status": "affected",
"version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
"versionType": "git"
},
{
"status": "affected",
"version": "39db562b3fedb93978a7e42dd216b306740959f8",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.111",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.111",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending leak on write request failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before dispatching write requests. Several failure\npaths in raid10_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid10_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid10_make_request() to\nrelease the writes_pending reference with md_write_end() when a write\nrequest fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:24.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/55dc3d1d6a9983867273d3531e3ddd743428db8d"
},
{
"url": "https://git.kernel.org/stable/c/f076460c5205c9687059e5a3afeed37d2f2ceb6b"
},
{
"url": "https://git.kernel.org/stable/c/b6667d925c274910423385042edf18f6788dbceb"
},
{
"url": "https://git.kernel.org/stable/c/c642583adc136d4c70ce3c65c3f43e847d26c776"
},
{
"url": "https://git.kernel.org/stable/c/f94031c94eaebe14a7c9e91720064de0c5a54a6c"
},
{
"url": "https://git.kernel.org/stable/c/e045d6ed33f8faa3e3dd6dc33c62ec01e3ad275d"
}
],
"title": "md/raid10: fix writes_pending leak on write request failures",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72439",
"datePublished": "2026-08-15T05:56:52.023Z",
"dateReserved": "2026-08-09T03:40:39.930Z",
"dateUpdated": "2026-10-30T12:29:24.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68258 (GCVE-0-2026-68258)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
We weren't checking whether the values provided in the private
data in kfd CRIU restore were within bounds.
For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided
type is less than it.
For mqd_size, add new function mqd_size_from_queue_type and confirm
that the provided mqd_size matches expectations.
(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 42c6c48214b726c30918e8dc80e2168607d13ae4 Version: 42c6c48214b726c30918e8dc80e2168607d13ae4 Version: 42c6c48214b726c30918e8dc80e2168607d13ae4 Version: 42c6c48214b726c30918e8dc80e2168607d13ae4 Version: 42c6c48214b726c30918e8dc80e2168607d13ae4 Version: 42c6c48214b726c30918e8dc80e2168607d13ae4 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68258",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:19.338740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:58.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c",
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h",
"drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dcd8f5e049ff31e73f91fbccd9a9b9d725a2ff3e",
"status": "affected",
"version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
"versionType": "git"
},
{
"lessThan": "2b817c0dfc653bf33d0e0ab8155ff7807a617487",
"status": "affected",
"version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
"versionType": "git"
},
{
"lessThan": "1956aa246c65c5895589664ccb37d0710aa8d304",
"status": "affected",
"version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
"versionType": "git"
},
{
"lessThan": "fd1691ec62701c982ea32e749678988c67fd4c21",
"status": "affected",
"version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
"versionType": "git"
},
{
"lessThan": "cc10a5839756982504ee8568fc1e1625962ab7f8",
"status": "affected",
"version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
"versionType": "git"
},
{
"lessThan": "47ea05f246bebc81c7796f56265cffd812cf0601",
"status": "affected",
"version": "42c6c48214b726c30918e8dc80e2168607d13ae4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c",
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h",
"drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds on CRIU restore queue type and mqd size\n\nWe weren\u0027t checking whether the values provided in the private\ndata in kfd CRIU restore were within bounds.\n\nFor queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided\ntype is less than it.\n\nFor mqd_size, add new function mqd_size_from_queue_type and confirm\nthat the provided mqd_size matches expectations.\n\n(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through the AMDKFD_IOC_CRIU_OP ioctl on the local /dev/kfd character device; there is no remote or adjacent-network path into amdkfd CRIU restore handling.\nAC:L - The attacker directly supplies mqd_size and type in the CRIU private data, so a single ioctl deterministically triggers the over-read or the ZERO_SIZE_PTR dereference; restore runs under p-\u003emutex so no race must be won.\nPR:L - The attacker needs /dev/kfd access (render group) plus CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN; CAP_CHECKPOINT_RESTORE is a delegated, non-root capability routinely granted to CRIU tooling and container checkpoint/restore services, so this is a limited privilege rather than full administrative control.\nUI:N - The attacker issues the CRIU restore and checkpoint ioctls entirely against its own KFD process context; no action by another user or victim process is required.\nS:U - The out-of-bounds read and resulting crash stay within the kernel\u0027s own security authority on the host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - restore_mqd() memcpy\u0027s a full ASIC MQD (e.g. sizeof(struct v9_mqd)) out of a kmalloc buffer sized by the attacker\u0027s smaller mqd_size, and criu_checkpoint_queues_device() then copies the entire MQD back to userspace, disclosing adjacent kernel slab contents.\nI:N - The destination MQD buffer is allocated by the mqd manager at its own correct size and ctl_stack_size is validated against node_props, so nothing is written out of bounds; the defect is purely a source-side over-read.\nA:H - With mqd_size and ctl_stack_size both zero, kmalloc(0) returns ZERO_SIZE_PTR and the memcpy faults reading address 0x10 while dqm_lock is held, oopsing the kernel; an out-of-range queue type also trips WARN(), panicking systems with panic_on_warn."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:16.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dcd8f5e049ff31e73f91fbccd9a9b9d725a2ff3e"
},
{
"url": "https://git.kernel.org/stable/c/2b817c0dfc653bf33d0e0ab8155ff7807a617487"
},
{
"url": "https://git.kernel.org/stable/c/1956aa246c65c5895589664ccb37d0710aa8d304"
},
{
"url": "https://git.kernel.org/stable/c/fd1691ec62701c982ea32e749678988c67fd4c21"
},
{
"url": "https://git.kernel.org/stable/c/cc10a5839756982504ee8568fc1e1625962ab7f8"
},
{
"url": "https://git.kernel.org/stable/c/47ea05f246bebc81c7796f56265cffd812cf0601"
}
],
"title": "drm/amdkfd: Check bounds on CRIU restore queue type and mqd size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68258",
"datePublished": "2026-08-10T12:01:32.149Z",
"dateReserved": "2026-07-30T09:28:09.378Z",
"dateUpdated": "2026-10-30T12:28:16.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99163 (GCVE-0-2026-99163)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
In check_synth_field(), when a synthetic event field is a stacktrace
(field->is_stack) and the histogram field is not a "long[" stacktrace
array, validation falls through to the generic size and signedness
comparison.
Because parse_synth_field() sets a stacktrace field's type to
"__data_loc unsigned long[]", its size is sizeof(u64) and
synth_field_signed() marks it as signed. Consequently, any 8-byte
signed scalar histogram field passes the fallback check, and its scalar
value is subsequently dereferenced as a kernel stacktrace pointer in
get_field_size() and trace_stack().
Furthermore, checking strstr(hist_field->type, "long[") is insufficient
because tracepoint fields defined with __bitmask() or __rel_bitmask()
also have type "__data_loc unsigned long[]" or "__rel_loc unsigned
long[]", whilst create_hist_field() treats them as 4-byte scalar values
without HIST_FIELD_FL_STACKTRACE.
Propagate HIST_FIELD_FL_STACKTRACE to variable references and field
variables (whilst excluding variable aliases from per-element
stacktrace capture), and reject any mismatch between
HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b9453380c1c542fd095a4dbe9251eeba4022bbce Version: 5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55 Version: f3baa42afeea0d5f04ad31525e861199d02210cc Version: 00cf3d672a9dd409418647e9f98784c339c3ff63 Version: 00cf3d672a9dd409418647e9f98784c339c3ff63 Version: 00cf3d672a9dd409418647e9f98784c339c3ff63 Version: 00cf3d672a9dd409418647e9f98784c339c3ff63 Version: 00cf3d672a9dd409418647e9f98784c339c3ff63 Version: 5.10.237 ≤ Version: 5.15.124 ≤ Version: 6.1.43 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5",
"status": "affected",
"version": "b9453380c1c542fd095a4dbe9251eeba4022bbce",
"versionType": "git"
},
{
"lessThan": "326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be",
"status": "affected",
"version": "5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55",
"versionType": "git"
},
{
"lessThan": "6c4e4946febb585d2fc93a02a0cd12cec715bb32",
"status": "affected",
"version": "f3baa42afeea0d5f04ad31525e861199d02210cc",
"versionType": "git"
},
{
"lessThan": "7e0d05a6234a984ac23b8a563fb7f66f2572b668",
"status": "affected",
"version": "00cf3d672a9dd409418647e9f98784c339c3ff63",
"versionType": "git"
},
{
"lessThan": "648687f2b448d8527cd7b112fe5d4bd0fec85a87",
"status": "affected",
"version": "00cf3d672a9dd409418647e9f98784c339c3ff63",
"versionType": "git"
},
{
"lessThan": "1f36e4ddd05d540f363dbaa4c23042549f15b3ef",
"status": "affected",
"version": "00cf3d672a9dd409418647e9f98784c339c3ff63",
"versionType": "git"
},
{
"lessThan": "deb336ae7c7b341591a6862cf6fcfeca97c77dfd",
"status": "affected",
"version": "00cf3d672a9dd409418647e9f98784c339c3ff63",
"versionType": "git"
},
{
"lessThan": "a244c241593b5b38a08f0df2cb43c26574efbdcb",
"status": "affected",
"version": "00cf3d672a9dd409418647e9f98784c339c3ff63",
"versionType": "git"
},
{
"lessThan": "5.10.273",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.224",
"status": "affected",
"version": "5.15.124",
"versionType": "semver"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.43",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15.124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field-\u003eis_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\n\nBecause parse_synth_field() sets a stacktrace field\u0027s type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed. Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\n\nFurthermore, checking strstr(hist_field-\u003etype, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\n\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field-\u003eis_stack in check_synth_field()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Local writes to tracefs synthetic_events and events/.../trigger supply the bad field/action; event_trigger_write() \u2192 event_hist_trigger_parse() \u2192 create_actions() \u2192 the patched check_synth_field(). No network or physical input reaches it.\nAC:L - The attacker can deterministically create the stack field, map an 8-byte signed scalar or expression to it, enable the synthetic event, and issue their own triggering syscall; no race or uncontrollable state is required.\nPR:L - Although these files are mode 0640, tracefs_parse_param() accepts uid= and tracefs_apply_options() propagates that owner to synthetic_events and eventfs trigger files, allowing a delegated non-root tracing account to write both; user namespaces alone cannot mount tracefs.\nUI:N - The attacker performs every required tracefs write and triggers the configured histogram through their own syscall or selected tracepoint, without another user\u0027s action.\nS:U - The invalid pointer dereference and ring-buffer overwrite occur entirely within the host kernel\u0027s tracing subsystem and do not cross a VM, IOMMU, or separate security authority.\nC:H - An 8-byte signed histogram expression can hold a chosen address; get_field_size() dereferences it and trace_stack() copies up to 16 machine words into a synthetic-event record readable from the trace buffer, permitting repeatable kernel-memory disclosure.\nI:H - get_field_size() sizes the record from the pointer\u0027s first word, while trace_stack() independently scans up to 16 nonzero words before memcpy(); a mismatched count therefore writes past the reserved ring-buffer record.\nA:H - Mapping raw_syscalls:sys_enter.id directly to the stack field makes get_field_size() dereference a small invalid address on the attacker\u0027s next syscall, producing a deterministic, repeatable kernel oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:20.055Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5"
},
{
"url": "https://git.kernel.org/stable/c/326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be"
},
{
"url": "https://git.kernel.org/stable/c/6c4e4946febb585d2fc93a02a0cd12cec715bb32"
},
{
"url": "https://git.kernel.org/stable/c/7e0d05a6234a984ac23b8a563fb7f66f2572b668"
},
{
"url": "https://git.kernel.org/stable/c/648687f2b448d8527cd7b112fe5d4bd0fec85a87"
},
{
"url": "https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef"
},
{
"url": "https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd"
},
{
"url": "https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb"
}
],
"title": "tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99163",
"datePublished": "2026-10-28T10:35:15.577Z",
"dateReserved": "2026-09-25T10:25:14.398Z",
"dateUpdated": "2026-10-31T12:44:20.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40355 (GCVE-0-2025-40355)
Vulnerability from cvelistv5
Published
2025-12-16 13:30
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sysfs: check visibility before changing group attribute ownership
Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for
phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can
hit WARN_ON() when trying to change owner of a file that isn't visible.
See the trace below:
WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30
CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f
Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025
RIP: 0010:__dev_change_net_namespace+0xb89/0xc30
[...]
Call Trace:
<TASK>
? if6_seq_show+0x30/0x50
do_setlink.isra.0+0xc7/0x1270
? __nla_validate_parse+0x5c/0xcc0
? security_capable+0x94/0x1a0
rtnl_newlink+0x858/0xc20
? update_curr+0x8e/0x1c0
? update_entity_lag+0x71/0x80
? sched_balance_newidle+0x358/0x450
? psi_task_switch+0x113/0x2a0
? __pfx_rtnl_newlink+0x10/0x10
rtnetlink_rcv_msg+0x346/0x3e0
? sched_clock+0x10/0x30
? __pfx_rtnetlink_rcv_msg+0x10/0x10
netlink_rcv_skb+0x59/0x110
netlink_unicast+0x285/0x3c0
? __alloc_skb+0xdb/0x1a0
netlink_sendmsg+0x20d/0x430
____sys_sendmsg+0x39f/0x3d0
? import_iovec+0x2f/0x40
___sys_sendmsg+0x99/0xe0
__sys_sendmsg+0x8a/0xf0
do_syscall_64+0x81/0x970
? __sys_bind+0xe3/0x110
? syscall_exit_work+0x143/0x1b0
? do_syscall_64+0x244/0x970
? sock_alloc_file+0x63/0xc0
? syscall_exit_work+0x143/0x1b0
? do_syscall_64+0x244/0x970
? alloc_fd+0x12e/0x190
? put_unused_fd+0x2a/0x70
? do_sys_openat2+0xa2/0xe0
? syscall_exit_work+0x143/0x1b0
? do_syscall_64+0x244/0x970
? exc_page_fault+0x7e/0x1a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
[...]
</TASK>
Fix this by checking is_visible() before trying to touch the attribute.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/sysfs/group.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e963b5aca9c1c23f7a040d555a9bc21c0ab8819",
"status": "affected",
"version": "303a42769c4c4d8e5e3ad928df87eb36f8c1fa60",
"versionType": "git"
},
{
"lessThan": "ac2c526e103285d80a0330b91a318f6c9276d35a",
"status": "affected",
"version": "303a42769c4c4d8e5e3ad928df87eb36f8c1fa60",
"versionType": "git"
},
{
"lessThan": "c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33",
"status": "affected",
"version": "303a42769c4c4d8e5e3ad928df87eb36f8c1fa60",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/sysfs/group.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.6",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysfs: check visibility before changing group attribute ownership\n\nSince commit 0c17270f9b92 (\"net: sysfs: Implement is_visible for\nphys_(port_id, port_name, switch_id)\"), __dev_change_net_namespace() can\nhit WARN_ON() when trying to change owner of a file that isn\u0027t visible.\nSee the trace below:\n\n WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30\n CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f\n Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025\n RIP: 0010:__dev_change_net_namespace+0xb89/0xc30\n [...]\n Call Trace:\n \u003cTASK\u003e\n ? if6_seq_show+0x30/0x50\n do_setlink.isra.0+0xc7/0x1270\n ? __nla_validate_parse+0x5c/0xcc0\n ? security_capable+0x94/0x1a0\n rtnl_newlink+0x858/0xc20\n ? update_curr+0x8e/0x1c0\n ? update_entity_lag+0x71/0x80\n ? sched_balance_newidle+0x358/0x450\n ? psi_task_switch+0x113/0x2a0\n ? __pfx_rtnl_newlink+0x10/0x10\n rtnetlink_rcv_msg+0x346/0x3e0\n ? sched_clock+0x10/0x30\n ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x59/0x110\n netlink_unicast+0x285/0x3c0\n ? __alloc_skb+0xdb/0x1a0\n netlink_sendmsg+0x20d/0x430\n ____sys_sendmsg+0x39f/0x3d0\n ? import_iovec+0x2f/0x40\n ___sys_sendmsg+0x99/0xe0\n __sys_sendmsg+0x8a/0xf0\n do_syscall_64+0x81/0x970\n ? __sys_bind+0xe3/0x110\n ? syscall_exit_work+0x143/0x1b0\n ? do_syscall_64+0x244/0x970\n ? sock_alloc_file+0x63/0xc0\n ? syscall_exit_work+0x143/0x1b0\n ? do_syscall_64+0x244/0x970\n ? alloc_fd+0x12e/0x190\n ? put_unused_fd+0x2a/0x70\n ? do_sys_openat2+0xa2/0xe0\n ? syscall_exit_work+0x143/0x1b0\n ? do_syscall_64+0x244/0x970\n ? exc_page_fault+0x7e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [...]\n \u003c/TASK\u003e\n\nFix this by checking is_visible() before trying to touch the attribute."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:58.178Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e963b5aca9c1c23f7a040d555a9bc21c0ab8819"
},
{
"url": "https://git.kernel.org/stable/c/ac2c526e103285d80a0330b91a318f6c9276d35a"
},
{
"url": "https://git.kernel.org/stable/c/c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33"
}
],
"title": "sysfs: check visibility before changing group attribute ownership",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40355",
"datePublished": "2025-12-16T13:30:28.017Z",
"dateReserved": "2025-04-16T07:20:57.187Z",
"dateUpdated": "2026-10-21T12:37:58.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90301 (GCVE-0-2026-90301)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: o2hb: quiesce negotiate handlers and timeout work
Heartbeat regions publish struct o2hb_region as the private data for the
NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()
creates the configfs region. The approve handler can call
o2hb_arm_timeout(), so a peer can touch the region timeout work before
dev_store() has finished building the heartbeat runtime, or after teardown
has started to shut that runtime back down.
The final configfs put also has to keep reg alive until the last in-flight
o2net callback drops its handler reference.
o2net_unregister_handler_list() blocks future handler lookups, but it does
not wait for sc_rx_work that already passed o2net_handler_get(). That
drain needs to cover local listener teardown as well, where the o2net
ordered workqueue may already be inside destroy_workqueue().
Fix the lifetime rule in both directions. Initialize the region delayed
works before publishing reg through the o2net handler table, keep new or
stopping regions non-armable with hr_stopping, and quiesce both delayed
works on failed-start and teardown paths even when no heartbeat thread is
left to call o2hb_disarm_timeout(). Then unregister handlers before
tearing down handler-visible region state and make the drain wait for the
active or destroying o2net ordered workqueue before release frees reg.
The buggy scenario involves two paths, with each column showing the order
within that path:
region lifecycle: late negotiate callback:
1. make_item() registers the 1. o2net_process_message() gets a
region handlers before heartbeat handler for reg.
dev_store() has built a 2. The callback runs after the lookup
runnable heartbeat context. lock is dropped and dereferences reg.
2. A failed start or rmdir 3. An approve or timeout path tries to
stops the heartbeat thread, queue reg's delayed work, or release
quiesces existing work, and races the callback body after handler
drops the final configfs ref. unregister.
3. region_release() must drain 4. The callback or delayed work can
handler-visible o2net rx work outlive reg unless lifecycle code
before freeing reg. keeps the region non-armable and
drains the active-or-destroying
o2net workqueue.
Validation reproduced this kernel report:
KASAN slab-use-after-free in __run_timers+0x22c/0x5b0
Write of size 8
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
__run_timers+0x22c/0x5b0
kasan_report+0xe0/0x110
_raw_spin_unlock_irqrestore+0x27/0x60
try_to_wake_up+0x191/0xf70
timer_expire_remote+0xae/0xf0
run_timer_softirq+0x19b/0x1a0
handle_softirqs+0x156/0x660
__irq_exit_rcu+0xc4/0x160
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0x6c/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
Allocated by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
o2hb_heartbeat_group_make_item+0x3c/0x600
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 34069b886f95356d68bf8315fa648c4ab3193cdd Version: 34069b886f95356d68bf8315fa648c4ab3193cdd Version: 34069b886f95356d68bf8315fa648c4ab3193cdd Version: 34069b886f95356d68bf8315fa648c4ab3193cdd Version: 34069b886f95356d68bf8315fa648c4ab3193cdd Version: 34069b886f95356d68bf8315fa648c4ab3193cdd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/cluster/heartbeat.c",
"fs/ocfs2/cluster/tcp.c",
"fs/ocfs2/cluster/tcp.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed3c9aebd6bb5aa6ccc2a9177fab7a87ae895715",
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"versionType": "git"
},
{
"lessThan": "b672d4de13247369c8dc394ba83f2a896d9cc25c",
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"versionType": "git"
},
{
"lessThan": "f218d70f27bb326f5e9b2f33503e253851b3bafa",
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"versionType": "git"
},
{
"lessThan": "9d44822ba34d6035690f725f9de602744a6e1946",
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"versionType": "git"
},
{
"lessThan": "b5a2907bdeced0949bcddc84b95ba7d4cb93841b",
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"versionType": "git"
},
{
"lessThan": "011291b70ba4832e136b7b581825b2bc0f525bf6",
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/cluster/heartbeat.c",
"fs/ocfs2/cluster/tcp.c",
"fs/ocfs2/cluster/tcp.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: o2hb: quiesce negotiate handlers and timeout work\n\nHeartbeat regions publish struct o2hb_region as the private data for the\nNEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()\ncreates the configfs region. The approve handler can call\no2hb_arm_timeout(), so a peer can touch the region timeout work before\ndev_store() has finished building the heartbeat runtime, or after teardown\nhas started to shut that runtime back down.\n\nThe final configfs put also has to keep reg alive until the last in-flight\no2net callback drops its handler reference. \no2net_unregister_handler_list() blocks future handler lookups, but it does\nnot wait for sc_rx_work that already passed o2net_handler_get(). That\ndrain needs to cover local listener teardown as well, where the o2net\nordered workqueue may already be inside destroy_workqueue().\n\nFix the lifetime rule in both directions. Initialize the region delayed\nworks before publishing reg through the o2net handler table, keep new or\nstopping regions non-armable with hr_stopping, and quiesce both delayed\nworks on failed-start and teardown paths even when no heartbeat thread is\nleft to call o2hb_disarm_timeout(). Then unregister handlers before\ntearing down handler-visible region state and make the drain wait for the\nactive or destroying o2net ordered workqueue before release frees reg.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nregion lifecycle: late negotiate callback:\n1. make_item() registers the 1. o2net_process_message() gets a\n region handlers before heartbeat handler for reg.\n dev_store() has built a 2. The callback runs after the lookup\n runnable heartbeat context. lock is dropped and dereferences reg.\n2. A failed start or rmdir 3. An approve or timeout path tries to\n stops the heartbeat thread, queue reg\u0027s delayed work, or release\n quiesces existing work, and races the callback body after handler\n drops the final configfs ref. unregister.\n3. region_release() must drain 4. The callback or delayed work can\n handler-visible o2net rx work outlive reg unless lifecycle code\n before freeing reg. keeps the region non-armable and\n drains the active-or-destroying\n o2net workqueue.\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in __run_timers+0x22c/0x5b0\nWrite of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n __run_timers+0x22c/0x5b0\n kasan_report+0xe0/0x110\n _raw_spin_unlock_irqrestore+0x27/0x60\n try_to_wake_up+0x191/0xf70\n timer_expire_remote+0xae/0xf0\n run_timer_softirq+0x19b/0x1a0\n handle_softirqs+0x156/0x660\n __irq_exit_rcu+0xc4/0x160\n irq_exit_rcu+0xe/0x20\n sysvec_apic_timer_interrupt+0x6c/0x80\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nAllocated by task stack:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n o2hb_heartbeat_group_make_item+0x3c/0x600"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - O2HB_NEGO_APPROVE_MSG and O2HB_NEGO_TIMEOUT_MSG arrive as o2net TCP payloads. o2net_data_ready queues sc_rx_work; o2net_rx_until_empty \u2192 o2net_advance_rx \u2192 o2net_process_message looks up the handler by msg_type and hr_key and calls o2hb_nego_approve_handler or o2hb_nego_timeout_handler, so the peer supplies the triggering bytes on a routable IPv4 TCP session.\nAC:H - Memory corruption requires the region to be between o2hb_heartbeat_group_make_item() publishing handlers (hr_steady_iterations still 0, delayed work uninitialized) and INIT_DELAYED_WORK in o2hb_region_dev_store(), or o2net_handler_get() racing o2hb_region_release()\u0027s kfree. The peer sends NEGO_APPROVE but cannot mkdir/rmdir the configfs region that opens those windows.\nPR:N - o2net_accept_one admits the TCP peer after o2nm_get_node_by_ip() and o2hb_check_node_heartbeating_from_callback(); o2net_check_handshake only compares protocol version and idle/keepalive/heartbeat timeouts. No user login or capability check runs before o2hb_nego_approve_handler, so no account on the victim is required.\nUI:N - Once an o2net session exists, the attacker triggers the bug by sending O2HB_NEGO_APPROVE_MSG. Configfs heartbeat-region create or rmdir is cluster bring-up or shutdown timing, not a victim action such as mounting a filesystem or opening a file.\nS:U - The UAF writes the freed o2hb_region from o2hb_arm_timeout() and __run_timers stay in the host kernel on that cluster node and do not cross a guest-to-host, VM, or IOMMU boundary.\nC:H - KASAN reported a slab-use-after-free of the o2hb_region allocated by o2hb_heartbeat_group_make_item. o2hb_nego_timeout_handler still reads hr_nego_node_bitmap and config_item_name after free, and reclaiming the slab gives the attacker the freed object contents, enabling disclosure of adjacent kernel memory.\nI:H - o2hb_nego_approve_handler calls o2hb_arm_timeout(), which schedule_delayed_work\u0027s hr_write_timeout_work and hr_nego_timeout_work on a not-yet-initialized or already-freed o2hb_region. The reproduced bug is an 8-byte write in __run_timers on that freed object, a UAF write that can hijack kernel control flow.\nA:H - The UAF write in __run_timers runs from run_timer_softirq and oopses the node. If the wrongly armed hr_write_timeout_work fires, o2hb_write_timeout() also calls o2quo_disk_timeout() \u2192 o2quo_fence_self(), fencing the victim."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:05.737Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed3c9aebd6bb5aa6ccc2a9177fab7a87ae895715"
},
{
"url": "https://git.kernel.org/stable/c/b672d4de13247369c8dc394ba83f2a896d9cc25c"
},
{
"url": "https://git.kernel.org/stable/c/f218d70f27bb326f5e9b2f33503e253851b3bafa"
},
{
"url": "https://git.kernel.org/stable/c/9d44822ba34d6035690f725f9de602744a6e1946"
},
{
"url": "https://git.kernel.org/stable/c/b5a2907bdeced0949bcddc84b95ba7d4cb93841b"
},
{
"url": "https://git.kernel.org/stable/c/011291b70ba4832e136b7b581825b2bc0f525bf6"
}
],
"title": "ocfs2: o2hb: quiesce negotiate handlers and timeout work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90301",
"datePublished": "2026-09-17T16:08:25.152Z",
"dateReserved": "2026-09-11T19:38:34.799Z",
"dateUpdated": "2026-10-30T12:35:05.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89906 (GCVE-0-2026-89906)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Refactor jump offset calculation in tail call
The old macro-based jmp_offset calculation derives the jump distance
from a stale prior-pass code stride, which can lead to wrong branch
offsets and soft lockups under extra JIT passes.
Fix this by calculating the offset directly on the absolute target:
"ctx->offset[insn + 1] - ctx->idx".
To avoid a false 16-bit range check abort during size estimation, add
a "ctx->image == NULL" guard to inject a safe dummy offset.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 17c010fe45def335fe03a0718935416b04c7f349 Version: f83d469e16bb1f75991ca67c56786fb2aaa42bea Version: cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 Version: cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 Version: cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 Version: 1a782fa32e644aa9fbae6c8488f3e61221ac96e1 Version: f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f Version: 9262e3e04621558e875eb5afb5e726b648cd5949 Version: 6.6.103 ≤ Version: 6.12.43 ≤ Version: 6.1.149 ≤ Version: 6.15.11 ≤ Version: 6.16.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/loongarch/net/bpf_jit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50fbc294e4e96246d60cd66f98acf043a362e3a0",
"status": "affected",
"version": "17c010fe45def335fe03a0718935416b04c7f349",
"versionType": "git"
},
{
"lessThan": "89819868cde78cb2f748533785a46a3430873f20",
"status": "affected",
"version": "f83d469e16bb1f75991ca67c56786fb2aaa42bea",
"versionType": "git"
},
{
"lessThan": "882b8912b7e92341fdb115ba0e2e5142a28684ff",
"status": "affected",
"version": "cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
"versionType": "git"
},
{
"lessThan": "96f44d493c280ea161569c43d7ed0f3b0815803a",
"status": "affected",
"version": "cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
"versionType": "git"
},
{
"lessThan": "37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8",
"status": "affected",
"version": "cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
"versionType": "git"
},
{
"status": "affected",
"version": "1a782fa32e644aa9fbae6c8488f3e61221ac96e1",
"versionType": "git"
},
{
"status": "affected",
"version": "f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f",
"versionType": "git"
},
{
"status": "affected",
"version": "9262e3e04621558e875eb5afb5e726b648cd5949",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/loongarch/net/bpf_jit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Refactor jump offset calculation in tail call\n\nThe old macro-based jmp_offset calculation derives the jump distance\nfrom a stale prior-pass code stride, which can lead to wrong branch\noffsets and soft lockups under extra JIT passes.\n\nFix this by calculating the offset directly on the absolute target:\n\"ctx-\u003eoffset[insn + 1] - ctx-\u003eidx\".\n\nTo avoid a false 16-bit range check abort during size estimation, add\na \"ctx-\u003eimage == NULL\" guard to inject a safe dummy offset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the LoongArch eBPF JIT emit_bpf_tail_call() and is reached only by loading a program that uses bpf_tail_call via bpf(BPF_PROG_LOAD) on the local host. Kernel CNA guidance classifies BPF as a local attack vector.\nAC:L - The attacker fully controls the BPF bytecode, including bpf2bpf subprograms that force the extra JIT pass where the stale prior-pass stride is used. Wrong jmp_offset encodings are deterministic for a given program (the in-tree tailcall_bpf2bpf_1 case), with no race or layout outside attacker control.\nPR:L - BPF_MAP_TYPE_PROG_ARRAY is an unprivileged map type, bpf_tail_call_proto is returned before the CAP_BPF gate, and SOCKET_FILTER programs load without CAP_BPF where unprivileged BPF is enabled. Otherwise only CAP_BPF or a delegated BPF token in a user namespace is required, not init-namespace root.\nUI:N - The attacker loads the crafted program, attaches it to a socket they own or runs it with BPF_PROG_TEST_RUN, and triggers the miscompiled tail call themselves. No separate victim action is required.\nS:U - The wrong branches execute inside the host kernel\u0027s own JIT image and corrupt in-kernel control flow. That is standard kernel privilege-escalation impact, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - Miscomputed tail-call \"goto out\" branches can land inside the remaining sequence after the max_entries check, so an out-of-range index performs an OOB load of array-\u003eptrs[] and treats the result as a function pointer, disclosing kernel memory. Mid-image jumps likewise execute attacker-shaped JIT loads at kernel privilege.\nI:H - The same OOB ptrs[] load is followed by an indirect jump through prog-\u003ebpf_func, hijacking kernel control flow. Branches that skip the NULL or tail-call-count checks, or that land mid-instruction, likewise yield a kernel-mode write and control-flow primitive.\nA:H - The fix and the prior incomplete tail-call offset patch document watchdog soft lockups from wrong, including backward, branches looping in kernel context. Any such hang, oops, or panic is Availability High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:06.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50fbc294e4e96246d60cd66f98acf043a362e3a0"
},
{
"url": "https://git.kernel.org/stable/c/89819868cde78cb2f748533785a46a3430873f20"
},
{
"url": "https://git.kernel.org/stable/c/882b8912b7e92341fdb115ba0e2e5142a28684ff"
},
{
"url": "https://git.kernel.org/stable/c/96f44d493c280ea161569c43d7ed0f3b0815803a"
},
{
"url": "https://git.kernel.org/stable/c/37d545d12f21c4d50612ecaebd7ae1e5bf91b2d8"
}
],
"title": "LoongArch: BPF: Refactor jump offset calculation in tail call",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89906",
"datePublished": "2026-09-16T10:32:05.157Z",
"dateReserved": "2026-09-11T19:38:34.774Z",
"dateUpdated": "2026-10-21T12:49:06.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74520 (GCVE-0-2026-74520)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/iommufd: Fix IOPF group ownership UAF
iopf_group_alloc() links each last-page IOPF group into the generic IOPF
pending list before invoking the domain fault handler.
iommufd_fault_iopf_handler() also queued an accepted group in the
IOMMUFD deliver list without removing it from the generic pending list.
When detach or HWPT replacement drops the device's IOPF reference count
to zero, an IOMMU driver may call iopf_queue_remove_device(). That
function responds to and frees groups through the generic pending list
without removing the same groups from IOMMUFD's deliver list or response
xarray. A later read, response, or cleanup can then access the freed
group and cause a UAF.
Fix this by dequeuing an accepted group from the generic pending list
before IOMMUFD queues it for userspace response.
Make iopf_group_response() send a response regardless of pending-list
membership, so the dequeued group can still be completed by IOMMUFD.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74520",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:01.666687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:52.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/io-pgfault.c",
"drivers/iommu/iommufd/eventq.c",
"include/linux/iommu.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8563099bc4b03e1894a983a394225d69b05d9277",
"status": "affected",
"version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
"versionType": "git"
},
{
"lessThan": "6da8f37419dd4c456f26fc203f04e000186f4b3d",
"status": "affected",
"version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
"versionType": "git"
},
{
"lessThan": "4e74a369236424114b94cf6a9f5ff9e848b430b4",
"status": "affected",
"version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
"versionType": "git"
},
{
"lessThan": "738e6f32e61d80b554e37015ecb7bc620b88001c",
"status": "affected",
"version": "34765cbc679c59ea5d952d738d2d16bf4aadc497",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/io-pgfault.c",
"drivers/iommu/iommufd/eventq.c",
"include/linux/iommu.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device\u0027s IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD\u0027s deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local ioctl/read/write on /dev/iommu or /dev/vfio and the iommufd fault-queue fd; the UAF is reached only through userspace-driven IOPF setup, fault delivery, and detach/HWPT-replace, not via any network packet or remote protocol handler.\nAC:L - The attacker controls both sides of the race by concurrently triggering IOMMU page faults (device DMA to unmapped IOVAs) and detaching or replacing the HWPT via iommufd ioctls, then reading/responding on the fault fd; no victim timing or uncontrollable memory layout is required.\nPR:L - Only a local process with access to an iommufd/VFIO context and an IOPF-capable assigned device (typical GPU/accelerator passthrough tenant) is needed; no host root/CAP_SYS_ADMIN is required once the device is bound to the caller\u0027s iommufd fd.\nUI:N - All steps\u2014allocating the fault queue, attaching a fault-enabled HWPT, provoking PRI/IOPF events, detaching/replacing, and reading/writing the fault fd\u2014are performed entirely by the attacking process without requiring any separate victim user action.\nS:C - The UAF corrupts iopf_group objects that hold attach_handle and fault_param pointers governing IOMMU page-fault responses and DMA translation; successful exploitation can bypass IOMMU DMA isolation or compromise the host from a VFIO device assignment security boundary.\nC:H - Use-after-free of iopf_group lets an attacker reclaim the freed slab and control fields such as attach_handle and fault_param, enabling arbitrary kernel memory reads through subsequent fault-queue read/response paths and iopf_group_response dereferences.\nI:H - Controlled reuse of the freed iopf_group can corrupt list/xarray links and attach_handle pointers used by iopf_group_response and IOMMU fault completion, providing heap-spray-based arbitrary write and potential control-flow hijack for privilege escalation or DMA remapping.\nA:H - Accessing a freed iopf_group during fault-fd read, write, auto-response on detach, or fault-object destruction causes kernel oops/panic; the bug is a confirmed UAF in a hot fault-handling path with reliably triggerable crash outcomes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:45.054Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8563099bc4b03e1894a983a394225d69b05d9277"
},
{
"url": "https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d"
},
{
"url": "https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4"
},
{
"url": "https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c"
}
],
"title": "iommu/iommufd: Fix IOPF group ownership UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74520",
"datePublished": "2026-08-15T12:27:38.712Z",
"dateReserved": "2026-08-15T05:44:03.911Z",
"dateUpdated": "2026-10-21T12:45:45.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90320 (GCVE-0-2026-90320)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate external xattr entries when reading metadata
ocfs2_validate_xattr_block() checks the xattr block header before the
block reaches higher-level xattr users, but it does not verify that a
non-indexed block's xh_count and entry offsets fit inside the block.
Indexed buckets likewise reach list/get consumers after ECC without an
entry-bounds check.
Use the flat xattr entry validator for non-indexed external xattr blocks,
and use a bucket-specific validator for indexed buckets at metadata read
time. The bucket validator keeps the entry array bounded by the first
bucket block while checking name/value offsets against the bucket block
they target.
Reject corrupted external xattr metadata before listxattr() or getxattr()
can walk out-of-range entry arrays or name/value offsets.
Validation reproduced this kernel report:
BUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190
Read of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630
Call Trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
kasan_report+0xe0/0x110
ocfs2_xattr_list_entries+0xd7/0x190
ocfs2_listxattr+0x3f6/0x610
listxattr+0x90/0xe0
path_listxattrat+0xed/0x220
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dc5778dbd0b6c411107a0e37e913a94b3c2f2728",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
},
{
"lessThan": "ee4ef26927e967ea699b3f0d7ecf97ce044fbc79",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
},
{
"lessThan": "9f4129b6905b7d638bbc9eb8013c3989cbe30b7e",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
},
{
"lessThan": "2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6",
"status": "affected",
"version": "cf1d6c763fbcb115263114302485ad17e7933d87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate external xattr entries when reading metadata\n\nocfs2_validate_xattr_block() checks the xattr block header before the\nblock reaches higher-level xattr users, but it does not verify that a\nnon-indexed block\u0027s xh_count and entry offsets fit inside the block. \nIndexed buckets likewise reach list/get consumers after ECC without an\nentry-bounds check.\n\nUse the flat xattr entry validator for non-indexed external xattr blocks,\nand use a bucket-specific validator for indexed buckets at metadata read\ntime. The bucket validator keeps the entry array bounded by the first\nbucket block while checking name/value offsets against the bucket block\nthey target.\n\nReject corrupted external xattr metadata before listxattr() or getxattr()\ncan walk out-of-range entry arrays or name/value offsets.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190\nRead of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630\nCall Trace:\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n kasan_report+0xe0/0x110\n ocfs2_xattr_list_entries+0xd7/0x190\n ocfs2_listxattr+0x3f6/0x610\n listxattr+0x90/0xe0\n path_listxattrat+0xed/0x220\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled bytes are on-disk ocfs2_xattr_header.xh_count and ocfs2_xattr_entry.xe_name_offset in an external xattr block or bucket, read by ocfs2_read_xattr_block()/ocfs2_read_xattr_bucket() when path_listxattrat() reaches ocfs2_listxattr()\u2192ocfs2_xattr_block_list(); no network protocol carries those fields.\nAC:L - The crafted image fully controls xh_count and xe_name_offset; once the volume is mounted, ocfs2_xattr_list_entries() walks header-\u003exh_entries[i] and forms name from xe_name_offset with no race, matching the deterministic KASAN UAF in that function.\nPR:N - ocfs2_xa_set() writes well-formed entry arrays, so planting a bad xh_count needs a crafted image; ocfs2_fs_type has no FS_USERNS_MOUNT, so the attacker cannot self-mount, and after the victim\u0027s ocfs2_fill_super() vfs_listxattr() calls ocfs2_listxattr() with no MAY_READ/DAC check.\nUI:R - The malformed external xattr header is inert until a victim or admin mounts the crafted OCFS2 image through ocfs2_fill_super(); listxattr/getxattr on that volume is the follow-on action that reaches ocfs2_xattr_list_entries() or ocfs2_xattr_block_get().\nS:U - The OOB/UAF is in kernel buffers for the ocfs2_xattr_block or xattr bucket on the same host that parsed the metadata and does not cross a VM, IOMMU, or guest-to-host boundary.\nC:H - ocfs2_xattr_list_entries() indexes xh_entries with unbounded on-disk xh_count, then memcpy\u0027s xe_name_len bytes from header+xe_name_offset into the listxattr buffer (copy_to_user); the repro is a KASAN UAF read of size 1 there, disclosing adjacent kernel memory.\nI:H - The same unvalidated xh_count/xe_name_offset are a kernel UAF/OOB walk; ocfs2_xa_bucket_add_entry() memmove\u0027s count*sizeof(ocfs2_xattr_entry) on setxattr and ocfs2_xattr_block_get() memcpy\u0027s xe_value_size from the unvalidated name offset, giving write/control-flow primitives.\nA:H - The KASAN report is a use-after-free in ocfs2_xattr_list_entries() from listxattr; the unbounded xh_count walk and ocfs2_xattr_bucket_get_name_value() indexing bu_bhs[name_offset\u003e\u003eblocksize_bits] past bu_blocks can oops or panic the node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:55.685Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dc5778dbd0b6c411107a0e37e913a94b3c2f2728"
},
{
"url": "https://git.kernel.org/stable/c/ee4ef26927e967ea699b3f0d7ecf97ce044fbc79"
},
{
"url": "https://git.kernel.org/stable/c/9f4129b6905b7d638bbc9eb8013c3989cbe30b7e"
},
{
"url": "https://git.kernel.org/stable/c/2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6"
}
],
"title": "ocfs2: validate external xattr entries when reading metadata",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90320",
"datePublished": "2026-09-17T16:08:37.497Z",
"dateReserved": "2026-09-11T19:38:34.802Z",
"dateUpdated": "2026-10-21T12:50:55.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43309 (GCVE-0-2026-43309)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md raid: fix hang when stopping arrays with metadata through dm-raid
When using device-mapper's dm-raid target, stopping a RAID array can cause
the system to hang under specific conditions.
This occurs when:
- A dm-raid managed device tree is suspended from top to bottom
(the top-level RAID device is suspended first, followed by its
underlying metadata and data devices)
- The top-level RAID device is then removed
Removing the top-level device triggers a hang in the following sequence:
the dm-raid destructor calls md_stop(), which tries to flush the
write-intent bitmap by writing to the metadata sub-devices. However, these
devices are already suspended, making them unable to complete the write-intent
operations and causing an indefinite block.
Fix:
- Prevent bitmap flushing when md_stop() is called from dm-raid
destructor context
and avoid a quiescing/unquescing cycle which could also cause I/O
- Still allow write-intent bitmap flushing when called from dm-raid
suspend context
This ensures that RAID array teardown can complete successfully even when the
underlying devices are in a suspended state.
This second patch uses md_is_rdwr() to distinguish between suspend and
destructor paths as elaborated on above.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0dd84b319352bb8ba64752d4e45396d8b13e6018 Version: 0dd84b319352bb8ba64752d4e45396d8b13e6018 Version: 0dd84b319352bb8ba64752d4e45396d8b13e6018 Version: 0dd84b319352bb8ba64752d4e45396d8b13e6018 Version: 1678ca35b80a94d474fdc31e2497ce5d7ed52512 Version: 690b5c90fd2d81fd1d2b6110fa36783232f6dce2 Version: 8e7fb19f1a744fd34e982633ced756fee0498ef7 Version: a5a58fab556bfe618b4c9719eb85712d78c6cb10 Version: 661c01b2181d9413c799127f13143583b69f20fd Version: f42a9819ba84bed2e609a4dff56af37063dcabdc Version: 4.14.292 ≤ Version: 4.19.257 ≤ Version: 5.4.212 ≤ Version: 5.10.140 ≤ Version: 5.15.64 ≤ Version: 5.19.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43309",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:35:03.007086Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:47.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/md.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "63054027d95200b04f3cf624faa7817e0555d56a",
"status": "affected",
"version": "0dd84b319352bb8ba64752d4e45396d8b13e6018",
"versionType": "git"
},
{
"lessThan": "24783dd06de870d646c25207bae186f78195f912",
"status": "affected",
"version": "0dd84b319352bb8ba64752d4e45396d8b13e6018",
"versionType": "git"
},
{
"lessThan": "338378dfffbdbb8d37a18f0a0c0358812671f91e",
"status": "affected",
"version": "0dd84b319352bb8ba64752d4e45396d8b13e6018",
"versionType": "git"
},
{
"lessThan": "cefcb9297fbdb6d94b61787b4f8d84f55b741470",
"status": "affected",
"version": "0dd84b319352bb8ba64752d4e45396d8b13e6018",
"versionType": "git"
},
{
"status": "affected",
"version": "1678ca35b80a94d474fdc31e2497ce5d7ed52512",
"versionType": "git"
},
{
"status": "affected",
"version": "690b5c90fd2d81fd1d2b6110fa36783232f6dce2",
"versionType": "git"
},
{
"status": "affected",
"version": "8e7fb19f1a744fd34e982633ced756fee0498ef7",
"versionType": "git"
},
{
"status": "affected",
"version": "a5a58fab556bfe618b4c9719eb85712d78c6cb10",
"versionType": "git"
},
{
"status": "affected",
"version": "661c01b2181d9413c799127f13143583b69f20fd",
"versionType": "git"
},
{
"status": "affected",
"version": "f42a9819ba84bed2e609a4dff56af37063dcabdc",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.292",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.257",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.212",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.140",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.64",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/md.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.292",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.212",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd raid: fix hang when stopping arrays with metadata through dm-raid\n\nWhen using device-mapper\u0027s dm-raid target, stopping a RAID array can cause\nthe system to hang under specific conditions.\n\nThis occurs when:\n\n- A dm-raid managed device tree is suspended from top to bottom\n (the top-level RAID device is suspended first, followed by its\n underlying metadata and data devices)\n\n- The top-level RAID device is then removed\n\nRemoving the top-level device triggers a hang in the following sequence:\nthe dm-raid destructor calls md_stop(), which tries to flush the\nwrite-intent bitmap by writing to the metadata sub-devices. However, these\ndevices are already suspended, making them unable to complete the write-intent\noperations and causing an indefinite block.\n\nFix:\n\n- Prevent bitmap flushing when md_stop() is called from dm-raid\ndestructor context\n and avoid a quiescing/unquescing cycle which could also cause I/O\n\n- Still allow write-intent bitmap flushing when called from dm-raid\nsuspend context\n\nThis ensures that RAID array teardown can complete successfully even when the\nunderlying devices are in a suspended state.\n\nThis second patch uses md_is_rdwr() to distinguish between suspend and\ndestructor paths as elaborated on above."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:34.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/63054027d95200b04f3cf624faa7817e0555d56a"
},
{
"url": "https://git.kernel.org/stable/c/24783dd06de870d646c25207bae186f78195f912"
},
{
"url": "https://git.kernel.org/stable/c/338378dfffbdbb8d37a18f0a0c0358812671f91e"
},
{
"url": "https://git.kernel.org/stable/c/cefcb9297fbdb6d94b61787b4f8d84f55b741470"
}
],
"title": "md raid: fix hang when stopping arrays with metadata through dm-raid",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43309",
"datePublished": "2026-05-08T13:11:27.595Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-11-06T15:42:47.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64159 (GCVE-0-2026-64159)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix zeropoint update where i_size > remote_i_size
Fix the update of the zero point[*] by netfs_release_folio() when there is
uncommitted data in the pagecache beyond the folio being released but the
on-server EOF is in this folio (ie. i_size > remote_i_size). The update
needs to limit zero_point to remote_i_size, not i_size as i_size is a local
phenomenon reflecting updates made locally to the pagecache, not stuff
written to the server. remote_i_size tracks the server's i_size.
[*] The zero point is the file position from which we can assume that the
server will just return zeros, so we can avoid generating reads.
Note that netfs_invalidate_folio() probably doesn't need fixing as
zero_point should be updated by setattr after truncation or fallocate.
Found with:
fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \
/xfstest.test/junk --replay-ops=junk.fsxops
using the following as junk.fsxops:
truncate 0x0 0x1bbae 0x82864
write 0x3ef2e 0xf9c8 0x1bbae
write 0x67e05 0xcb5a 0x4e8f6
mapread 0x57781 0x85b6 0x7495f
copy_range 0x5d3d 0x10329 0x54fac 0x7495f
write 0x64710 0x1c2b 0x7495f
mapread 0x64000 0x1000 0x7495f
on cifs with the default cache option.
It shows read-gaps on folio 0x64 failing with a short read (ie. it hits
EOF) if the FMODE_READ check is commented out in netfs_perform_write():
if (//(file->f_mode & FMODE_READ) ||
netfs_is_cache_enabled(ctx)) {
and no fscache. This was initially found with the generic/522 xfstest.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cce6bfa6ca0e30af9927b0074c97fe6a92f28092 Version: cce6bfa6ca0e30af9927b0074c97fe6a92f28092 Version: cce6bfa6ca0e30af9927b0074c97fe6a92f28092 Version: cce6bfa6ca0e30af9927b0074c97fe6a92f28092 Version: e2814004138a541110d4b2dc254a8f619c2c4ce0 Version: 6.10.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f706e3889ff75877ecb3abae5ad667dbc990331e",
"status": "affected",
"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092",
"versionType": "git"
},
{
"lessThan": "5afc2d9b86bed2e4d9e1ba467790cbc793223f98",
"status": "affected",
"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092",
"versionType": "git"
},
{
"lessThan": "5cd5207de519ef0c085f4f559adf5eefcb4c5202",
"status": "affected",
"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092",
"versionType": "git"
},
{
"lessThan": "4543a4d737944134a1394afe797622546fbcc98a",
"status": "affected",
"version": "cce6bfa6ca0e30af9927b0074c97fe6a92f28092",
"versionType": "git"
},
{
"status": "affected",
"version": "e2814004138a541110d4b2dc254a8f619c2c4ce0",
"versionType": "git"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix zeropoint update where i_size \u003e remote_i_size\n\nFix the update of the zero point[*] by netfs_release_folio() when there is\nuncommitted data in the pagecache beyond the folio being released but the\non-server EOF is in this folio (ie. i_size \u003e remote_i_size). The update\nneeds to limit zero_point to remote_i_size, not i_size as i_size is a local\nphenomenon reflecting updates made locally to the pagecache, not stuff\nwritten to the server. remote_i_size tracks the server\u0027s i_size.\n\n[*] The zero point is the file position from which we can assume that the\n server will just return zeros, so we can avoid generating reads.\n\nNote that netfs_invalidate_folio() probably doesn\u0027t need fixing as\nzero_point should be updated by setattr after truncation or fallocate.\n\nFound with:\n\n fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \\\n /xfstest.test/junk --replay-ops=junk.fsxops\n\nusing the following as junk.fsxops:\n\n truncate 0x0 0x1bbae 0x82864\n write 0x3ef2e 0xf9c8 0x1bbae\n write 0x67e05 0xcb5a 0x4e8f6\n mapread 0x57781 0x85b6 0x7495f\n copy_range 0x5d3d 0x10329 0x54fac 0x7495f\n write 0x64710 0x1c2b 0x7495f\n mapread 0x64000 0x1000 0x7495f\n\non cifs with the default cache option.\n\nIt shows read-gaps on folio 0x64 failing with a short read (ie. it hits\nEOF) if the FMODE_READ check is commented out in netfs_perform_write():\n\n if (//(file-\u003ef_mode \u0026 FMODE_READ) ||\n netfs_is_cache_enabled(ctx)) {\n\nand no fscache. This was initially found with the generic/522 xfstest."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:09.056Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f706e3889ff75877ecb3abae5ad667dbc990331e"
},
{
"url": "https://git.kernel.org/stable/c/5afc2d9b86bed2e4d9e1ba467790cbc793223f98"
},
{
"url": "https://git.kernel.org/stable/c/5cd5207de519ef0c085f4f559adf5eefcb4c5202"
},
{
"url": "https://git.kernel.org/stable/c/4543a4d737944134a1394afe797622546fbcc98a"
}
],
"title": "netfs: Fix zeropoint update where i_size \u003e remote_i_size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64159",
"datePublished": "2026-07-19T15:40:46.400Z",
"dateReserved": "2026-07-19T07:54:57.038Z",
"dateUpdated": "2026-10-21T12:43:09.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99212 (GCVE-0-2026-99212)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-31 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
rds_rdma_cm_event_handler_cmn() hands the return value of
rdma_resolve_route() straight back to the rdma_cm on
RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM
from the route work allocation, an SA query that cannot be set up, a
RoCE route with no usable device - makes addr_handler() destroy the
id the event was delivered on. That id is ic->i_cm_id, and nothing
clears the pointer: the connection sits in RDS_CONN_CONNECTING with a
freed id until its shutdown calls rdma_disconnect() and
rdma_destroy_id() on it.
The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()
forces a zero return while ic->i_cm_id == cm_id, as the comment there
explains. Do the same here - drop the connection and return 0 - so
the id stays RDS's to destroy from the shutdown, and the reconnect
gets a fresh one.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea Version: 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "664fd3205cbec71ac52c005ee705cd917bb6fb1a",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "b8f141f65885810e24fc23b8a71692db62d535bf",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "e677eda15df7d5ce256654343418043c7ffd6f9b",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "92143c5d80382588d5a3047a4f14023ee9ef6485",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "a7c7d0ff876377fea7ae876a28d6df8d9349df57",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "91ece3efa064f0b3b3c67b9b045d9eeb4a034e43",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "98d446b7c013254a8a7b49720557676a3a851fde",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don\u0027t let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on. That id is ic-\u003ei_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect() and\nrdma_destroy_id() on it.\n\nThe ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()\nforces a zero return while ic-\u003ei_cm_id == cm_id, as the comment there\nexplains. Do the same here - drop the connection and return 0 - so\nthe id stays RDS\u0027s to destroy from the shutdown, and the reconnect\ngets a fresh one."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An unprivileged process reaches patched rds_rdma_cm_event_handler_cmn() through AF_RDS sendmsg() \u2192 rds_connect_worker() \u2192 rds_ib_conn_path_connect() \u2192 addr_handler(). The failure occurs in local rdma_resolve_route() setup before any RDS message reaches a peer; no remote protocol message carries the trigger.\nAC:H - The synchronous error requires cma_resolve_ib_route() allocation/SA setup failure or cma_resolve_iboe_route() finding no usable netdevice or MTU. Choosing an RDS destination cannot reliably create those allocator, fabric-manager, or device states; an ordinary unreachable peer instead fails outside this ownership-error path.\nPR:L - rds_create(), rds_bind(), and rds_sendmsg() contain no capability check, and rds_ib_laddr_check() requires init_net but not root. Thus an ordinary host user can bind a configured IB/RoCE address and initiate the affected connection.\nUI:N - The attacker performs the AF_RDS sendmsg() themselves and can subsequently use RDS_CMSG_RDMA_MAP to reach __rds_rdma_map() \u2192 rds_ib_get_mr(), which dereferences the stale ic-\u003ei_cm_id. No victim action is required.\nS:U - The freed rdma_id_private and subsequent stale-pointer operations remain within the host kernel\u0027s RDS/RDMA security authority; no VM, IOMMU, or other distinct boundary is crossed.\nC:H - addr_handler() frees rdma_id_private while ic-\u003ei_cm_id retains its address, and rds_ib_get_mr() later reads qp from that reclaimed object. This kernel heap UAF permits controlled slab reuse and can be leveraged for arbitrary memory disclosure.\nI:H - If the reclaimed i_cm_id supplies a non-NULL qp, rds_ib_post_reg_frmr() passes it to ib_post_send(), reaching device operations through freed data; shutdown also calls rdma_disconnect() and rdma_destroy_id() on the stale ID. These provide control-flow and double-free corruption primitives.\nA:H - rds_ib_get_mr() can oops while reading ic-\u003ei_cm_id-\u003eqp, while rds_ib_conn_path_shutdown() later disconnects and destroys the already-freed ID. Either UAF path can panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:45:05.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/664fd3205cbec71ac52c005ee705cd917bb6fb1a"
},
{
"url": "https://git.kernel.org/stable/c/b8f141f65885810e24fc23b8a71692db62d535bf"
},
{
"url": "https://git.kernel.org/stable/c/e677eda15df7d5ce256654343418043c7ffd6f9b"
},
{
"url": "https://git.kernel.org/stable/c/92143c5d80382588d5a3047a4f14023ee9ef6485"
},
{
"url": "https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57"
},
{
"url": "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43"
},
{
"url": "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"
}
],
"title": "net/rds: don\u0027t let the rdma_cm destroy an id RDS still owns on route failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99212",
"datePublished": "2026-10-28T10:36:05.612Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-31T12:45:05.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38132 (GCVE-0-2025-38132)
Vulnerability from cvelistv5
Published
2025-07-03 08:35
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
coresight: holding cscfg_csdev_lock while removing cscfg from csdev
There'll be possible race scenario for coresight config:
CPU0 CPU1
(perf enable) load module
cscfg_load_config_sets()
activate config. // sysfs
(sys_active_cnt == 1)
...
cscfg_csdev_enable_active_config()
lock(csdev->cscfg_csdev_lock)
deactivate config // sysfs
(sys_activec_cnt == 0)
cscfg_unload_config_sets()
<iterating config_csdev_list> cscfg_remove_owned_csdev_configs()
// here load config activate by CPU1
unlock(csdev->cscfg_csdev_lock)
iterating config_csdev_list could be raced with config_csdev_list's
entry delete.
To resolve this race , hold csdev->cscfg_csdev_lock() while
cscfg_remove_owned_csdev_configs()
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-syscfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18a3a21c39cca593762aa90f322bd74c18ec59d4",
"status": "affected",
"version": "02bd588e12df405bdf55244708151b7f238b79ba",
"versionType": "git"
},
{
"lessThan": "1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7",
"status": "affected",
"version": "02bd588e12df405bdf55244708151b7f238b79ba",
"versionType": "git"
},
{
"lessThan": "8f16b9caf0bdba46044e1d3727ee78291aa36347",
"status": "affected",
"version": "02bd588e12df405bdf55244708151b7f238b79ba",
"versionType": "git"
},
{
"lessThan": "42f8afb0b161631fd1d814d017f75f955475ad41",
"status": "affected",
"version": "02bd588e12df405bdf55244708151b7f238b79ba",
"versionType": "git"
},
{
"lessThan": "53b9e2659719b04f5ba7593f2af0f2335f75e94a",
"status": "affected",
"version": "02bd588e12df405bdf55244708151b7f238b79ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-syscfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: holding cscfg_csdev_lock while removing cscfg from csdev\n\nThere\u0027ll be possible race scenario for coresight config:\n\nCPU0 CPU1\n(perf enable) load module\n cscfg_load_config_sets()\n activate config. // sysfs\n (sys_active_cnt == 1)\n...\ncscfg_csdev_enable_active_config()\n lock(csdev-\u003ecscfg_csdev_lock)\n deactivate config // sysfs\n (sys_activec_cnt == 0)\n cscfg_unload_config_sets()\n \u003citerating config_csdev_list\u003e cscfg_remove_owned_csdev_configs()\n // here load config activate by CPU1\n unlock(csdev-\u003ecscfg_csdev_lock)\n\niterating config_csdev_list could be raced with config_csdev_list\u0027s\nentry delete.\n\nTo resolve this race , hold csdev-\u003ecscfg_csdev_lock() while\ncscfg_remove_owned_csdev_configs()"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:43.550Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18a3a21c39cca593762aa90f322bd74c18ec59d4"
},
{
"url": "https://git.kernel.org/stable/c/1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7"
},
{
"url": "https://git.kernel.org/stable/c/8f16b9caf0bdba46044e1d3727ee78291aa36347"
},
{
"url": "https://git.kernel.org/stable/c/42f8afb0b161631fd1d814d017f75f955475ad41"
},
{
"url": "https://git.kernel.org/stable/c/53b9e2659719b04f5ba7593f2af0f2335f75e94a"
}
],
"title": "coresight: holding cscfg_csdev_lock while removing cscfg from csdev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38132",
"datePublished": "2025-07-03T08:35:35.695Z",
"dateReserved": "2025-04-16T04:51:23.987Z",
"dateUpdated": "2026-10-30T12:21:43.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90267 (GCVE-0-2026-90267)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
sd_set_special_bvec() allocates a special payload page for UNMAP and
WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in
sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI
midlayer does not call uninit_command() because RQF_DONTPREP is not set
yet, leaking the page.
Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after
freeing the page.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 Version: 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 Version: 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 Version: 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 Version: 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 Version: 81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/sd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05bc68669549bfddfdeef2fd119855cab3e9615a",
"status": "affected",
"version": "81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87",
"versionType": "git"
},
{
"lessThan": "710a2448a06a8215ba8acb4a2791954800f7db0a",
"status": "affected",
"version": "81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87",
"versionType": "git"
},
{
"lessThan": "744a65e113094756e6c1cfba9ff1bf4247cb68d4",
"status": "affected",
"version": "81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87",
"versionType": "git"
},
{
"lessThan": "e90f746f4ca3896ca560e820b7b6b0a467026938",
"status": "affected",
"version": "81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87",
"versionType": "git"
},
{
"lessThan": "5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d",
"status": "affected",
"version": "81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87",
"versionType": "git"
},
{
"lessThan": "bb31844d88b77138b67aa20c3600203baff40140",
"status": "affected",
"version": "81d926e8b5520e38f1f72dd7bb7cfc81c1a69d87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/sd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails\n\nsd_set_special_bvec() allocates a special payload page for UNMAP and\nWRITE SAME commands. If scsi_alloc_sgtables() fails afterward in\nsd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI\nmidlayer does not call uninit_command() because RQF_DONTPREP is not set\nyet, leaking the page.\n\nCall sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after\nfreeing the page."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:01.469Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05bc68669549bfddfdeef2fd119855cab3e9615a"
},
{
"url": "https://git.kernel.org/stable/c/710a2448a06a8215ba8acb4a2791954800f7db0a"
},
{
"url": "https://git.kernel.org/stable/c/744a65e113094756e6c1cfba9ff1bf4247cb68d4"
},
{
"url": "https://git.kernel.org/stable/c/e90f746f4ca3896ca560e820b7b6b0a467026938"
},
{
"url": "https://git.kernel.org/stable/c/5d7d1b8b525e5eff33a01d07dfcf7bdd3b6d790d"
},
{
"url": "https://git.kernel.org/stable/c/bb31844d88b77138b67aa20c3600203baff40140"
}
],
"title": "scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90267",
"datePublished": "2026-09-17T16:08:02.624Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-30T12:35:01.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80747 (GCVE-0-2026-80747)
Vulnerability from cvelistv5
Published
2026-09-03 08:26
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add bounds check for CRAT subtype length
The CRAT parser validates that the subtype header fits within the image,
but does not verify that the advertised subtype length fits. A malformed
CRAT table with an oversized length field causes out-of-bounds reads when
kfd_parse_subtype() casts the header to specific subtype structures.
Add validation that sub_type_hdr + length does not exceed the image
boundary before parsing the subtype contents.
(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5b5c4e40a37e858e2bff8cd91be8e972256392c4 Version: 5b5c4e40a37e858e2bff8cd91be8e972256392c4 Version: 5b5c4e40a37e858e2bff8cd91be8e972256392c4 Version: 5b5c4e40a37e858e2bff8cd91be8e972256392c4 Version: 5b5c4e40a37e858e2bff8cd91be8e972256392c4 Version: 5b5c4e40a37e858e2bff8cd91be8e972256392c4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_crat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f9cc5375916b57acb1ad4443af7b4dbf347638a",
"status": "affected",
"version": "5b5c4e40a37e858e2bff8cd91be8e972256392c4",
"versionType": "git"
},
{
"lessThan": "fef8c8afcb85dce5ff115f82a148cdf87a9617b9",
"status": "affected",
"version": "5b5c4e40a37e858e2bff8cd91be8e972256392c4",
"versionType": "git"
},
{
"lessThan": "77b659fb104eb069ea7a61960699e4d1eea6567a",
"status": "affected",
"version": "5b5c4e40a37e858e2bff8cd91be8e972256392c4",
"versionType": "git"
},
{
"lessThan": "69164d6bdad5d6657e51436a3f602822f620a46a",
"status": "affected",
"version": "5b5c4e40a37e858e2bff8cd91be8e972256392c4",
"versionType": "git"
},
{
"lessThan": "ca91e0cc8087568e4b791648a7c01e804f48cb73",
"status": "affected",
"version": "5b5c4e40a37e858e2bff8cd91be8e972256392c4",
"versionType": "git"
},
{
"lessThan": "6e7566ba4739dd573c331adde1c96690f7a567bd",
"status": "affected",
"version": "5b5c4e40a37e858e2bff8cd91be8e972256392c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_crat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add bounds check for CRAT subtype length\n\nThe CRAT parser validates that the subtype header fits within the image,\nbut does not verify that the advertised subtype length fits. A malformed\nCRAT table with an oversized length field causes out-of-bounds reads when\nkfd_parse_subtype() casts the header to specific subtype structures.\n\nAdd validation that sub_type_hdr + length does not exceed the image\nboundary before parsing the subtype contents.\n\n(cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable kfd_parse_crat_table() runs only during amdgpu/amdkfd bring-up (kfd_topology_init at module load and kfd_topology_add_device on GPU probe). On affected kernels, ACPI CRAT is copied from firmware via acpi_get_table(\"CRAT\"); there is no network, ioctl, or /dev/kfd path to this parser.\nAC:L - A malicious ACPI CRAT can set subtype length so only the 8-byte generic header fits in the remaining image while kfd_parse_subtype() casts to larger structs (cache, CU, iolink). The out-of-bounds read is deterministic at boot with no races or attacker-uncontrollable memory layout.\nPR:N - Exploitation requires only a crafted ACPI CRAT in platform firmware/UEFI parsed automatically at boot via kfd_create_crat_image_acpi(). No Linux user account, capability, or /dev/kfd access is needed; only control of firmware-supplied CRAT contents before KFD topology initialization.\nUI:N - CRAT parsing occurs automatically during kernel boot and amdgpu/KFD module initialization when topology is built. No user mount, file open, or other discretionary action is required beyond powering on hardware that contains the malicious ACPI table.\nS:U - Impact is confined to kernel heap out-of-bounds reads and corrupted topology metadata within the host kernel security domain. This is not a guest/host VM escape, container sandbox breakout, or IOMMU/DMA boundary bypass.\nC:H - kfd_parse_subtype() casts the generic header to large subtype structures and reads past the CRAT buffer boundary (e.g., cache sibling_map[32], iolink, computeunit fields). Leaked adjacent kernel heap bytes populate topology objects exposed via world-readable /sys/class/kfd/kfd/topology/ attributes (0444).\nI:L - Out-of-bounds read values (sizes, proximity domains, sibling maps, bandwidth fields) are stored into kmalloc\u0027d kernel topology structures (mem_props, cache_props, io_link_props), modifying kernel metadata with attacker-influenced data derived from reads past the allocation.\nA:H - Out-of-bounds reads during early init can dereference unmapped pages and trigger a kernel oops or panic during amdgpu/KFD bring-up. Related malformed-CRAT parser bugs at the same code path also cause infinite-loop denial of service, confirming high availability impact from CRAT parsing flaws."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:04.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f9cc5375916b57acb1ad4443af7b4dbf347638a"
},
{
"url": "https://git.kernel.org/stable/c/fef8c8afcb85dce5ff115f82a148cdf87a9617b9"
},
{
"url": "https://git.kernel.org/stable/c/77b659fb104eb069ea7a61960699e4d1eea6567a"
},
{
"url": "https://git.kernel.org/stable/c/69164d6bdad5d6657e51436a3f602822f620a46a"
},
{
"url": "https://git.kernel.org/stable/c/ca91e0cc8087568e4b791648a7c01e804f48cb73"
},
{
"url": "https://git.kernel.org/stable/c/6e7566ba4739dd573c331adde1c96690f7a567bd"
}
],
"title": "drm/amdkfd: Add bounds check for CRAT subtype length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80747",
"datePublished": "2026-09-03T08:26:28.938Z",
"dateReserved": "2026-08-26T14:34:25.790Z",
"dateUpdated": "2026-10-30T12:31:04.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90265 (GCVE-0-2026-90265)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: defrag: fix deadlock between defrag and delalloc space reservation
While running fsstress with autodefrag and flushoncommit, hit a deadlock
due to the fact that defrag reserves delalloc space while it's holding
dirty and locked folios, besides the extent range lock. The stack traces
are the following:
[958.624] task:kworker/u50:3 state:D stack:0 pid:20365 tgid:20365 ppid:2 task_flags:0x4208060 flags:0x00080000
[958.626] Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs]
[958.627] Call Trace:
[958.628] <TASK>
[958.628] __schedule+0x4be/0x10f0
[958.629] ? preempt_count_add+0x69/0xa0
[958.630] schedule+0x26/0xd0
[958.631] wait_current_trans+0x102/0x160 [btrfs]
[958.632] ? __pfx_autoremove_wake_function+0x10/0x10
[958.633] start_transaction+0x374/0x900 [btrfs]
[958.634] btrfs_commit_current_transaction+0x1d/0x70 [btrfs]
[958.635] flush_space+0xca/0x5e0 [btrfs]
[958.636] ? _raw_spin_unlock+0x15/0x30
[958.637] ? btrfs_reduce_alloc_profile+0x8c/0x190 [btrfs]
[958.639] ? _raw_spin_unlock+0x15/0x30
[958.640] ? calc_available_free_space.isra.0+0x6f/0x110 [btrfs]
[958.641] do_async_reclaim_metadata_space+0x84/0x190 [btrfs]
[958.642] btrfs_async_reclaim_metadata_space+0x64/0x80 [btrfs]
[958.644] process_one_work+0x19d/0x3a0
[958.644] worker_thread+0x1c4/0x330
[958.645] ? __pfx_worker_thread+0x10/0x10
[958.646] kthread+0xfc/0x130
[958.647] ? __pfx_kthread+0x10/0x10
[958.648] ret_from_fork+0x1f7/0x2c0
[958.648] ? __pfx_kthread+0x10/0x10
[958.649] ret_from_fork_asm+0x1a/0x30
[958.650] </TASK>
[958.651] task:kworker/u49:7 state:D stack:0 pid:52990 tgid:52990 ppid:2 task_flags:0x4208060 flags:0x00080000
[958.653] Workqueue: writeback wb_workfn (flush-btrfs-334)
[958.655] Call Trace:
[958.655] <TASK>
[958.656] __schedule+0x4be/0x10f0
[958.657] ? __blk_flush_plug+0xe9/0x140
[958.658] schedule+0x26/0xd0
[958.658] io_schedule+0x42/0x70
[958.659] folio_wait_bit_common+0x12b/0x330
[958.660] ? folio_wait_bit_common+0x100/0x330
[958.662] ? __pfx_wake_page_function+0x10/0x10
[958.663] extent_write_cache_pages+0x599/0x830 [btrfs]
[958.664] ? acpi_fwnode_get_reference_args+0x1fa/0x270
[958.665] btrfs_writepages+0x77/0x130 [btrfs]
[958.666] ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]
[958.667] do_writepages+0xc6/0x160
[958.668] __writeback_single_inode+0x42/0x310
[958.669] writeback_sb_inodes+0x231/0x570
[958.670] wb_writeback+0x8a/0x340
[958.671] wb_workfn+0xbf/0x450
[958.672] ? finish_task_switch.isra.0+0xc1/0x350
[958.673] process_one_work+0x19d/0x3a0
[958.673] worker_thread+0x1c4/0x330
[958.674] ? __pfx_worker_thread+0x10/0x10
[958.675] kthread+0xfc/0x130
[958.676] ? __pfx_kthread+0x10/0x10
[958.676] ret_from_fork+0x1f7/0x2c0
[958.677] ? __pfx_kthread+0x10/0x10
[958.678] ret_from_fork_asm+0x1a/0x30
[958.679] </TASK>
[958.679] task:btrfs-cleaner state:D stack:0 pid:296750 tgid:296750 ppid:2 task_flags:0x208040 flags:0x00080000
[958.681] Call Trace:
[958.682] <TASK>
[958.682] __schedule+0x4be/0x10f0
[958.683] schedule+0x26/0xd0
[958.684] handle_reserve_ticket+0x1b9/0x2c0 [btrfs]
[958.685] ? __pfx_autoremove_wake_function+0x10/0x10
[958.686] reserve_bytes+0x283/0x4c0 [btrfs]
[958.687] btrfs_reserve_metadata_bytes+0x18/0xb0 [btrfs]
[958.688] btrfs_delalloc_reserve_metadata+0x121/0x320 [btrfs]
[958.690] btrfs_delalloc_reserve_space+0x46/0xb0 [btrfs]
[958.691] btrfs_defrag_file+0x903/0x1110 [btrfs]
[958.692] btrfs_run_defrag_inodes+0x334/0x430 [btrfs]
[958.694] cleaner_kthread+0x97/0x1c0 [btrfs]
[958.694] ? __pfx_cleaner_kthread+0x10/0x10 [btrfs]
[958.696] kthread+0xfc/0x130
[958.696] ? __pfx_kthread+0x10/0x10
[958.697] ret_
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 22b398eeeed43d51e85b1008e51bf9663ac1f491 Version: 22b398eeeed43d51e85b1008e51bf9663ac1f491 Version: 22b398eeeed43d51e85b1008e51bf9663ac1f491 Version: 22b398eeeed43d51e85b1008e51bf9663ac1f491 Version: 22b398eeeed43d51e85b1008e51bf9663ac1f491 Version: 22b398eeeed43d51e85b1008e51bf9663ac1f491 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/defrag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "046396bd16fdf0a9fbdf5f04c6eda26024e7695e",
"status": "affected",
"version": "22b398eeeed43d51e85b1008e51bf9663ac1f491",
"versionType": "git"
},
{
"lessThan": "c97277aa6ce8ac725642aced0fe20cd8d31f6e09",
"status": "affected",
"version": "22b398eeeed43d51e85b1008e51bf9663ac1f491",
"versionType": "git"
},
{
"lessThan": "37614074596827a5f292243673b699c90ff63e7d",
"status": "affected",
"version": "22b398eeeed43d51e85b1008e51bf9663ac1f491",
"versionType": "git"
},
{
"lessThan": "a9701dd06e82c345fe70debdf8835b7eb5000c59",
"status": "affected",
"version": "22b398eeeed43d51e85b1008e51bf9663ac1f491",
"versionType": "git"
},
{
"lessThan": "ac916391e1c70801649f7d6f85014f687983bc33",
"status": "affected",
"version": "22b398eeeed43d51e85b1008e51bf9663ac1f491",
"versionType": "git"
},
{
"lessThan": "ba02eab28041f9a4bbe9fc90c7249644fef6de0f",
"status": "affected",
"version": "22b398eeeed43d51e85b1008e51bf9663ac1f491",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/defrag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: defrag: fix deadlock between defrag and delalloc space reservation\n\nWhile running fsstress with autodefrag and flushoncommit, hit a deadlock\ndue to the fact that defrag reserves delalloc space while it\u0027s holding\ndirty and locked folios, besides the extent range lock. The stack traces\nare the following:\n\n [958.624] task:kworker/u50:3 state:D stack:0 pid:20365 tgid:20365 ppid:2 task_flags:0x4208060 flags:0x00080000\n [958.626] Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs]\n [958.627] Call Trace:\n [958.628] \u003cTASK\u003e\n [958.628] __schedule+0x4be/0x10f0\n [958.629] ? preempt_count_add+0x69/0xa0\n [958.630] schedule+0x26/0xd0\n [958.631] wait_current_trans+0x102/0x160 [btrfs]\n [958.632] ? __pfx_autoremove_wake_function+0x10/0x10\n [958.633] start_transaction+0x374/0x900 [btrfs]\n [958.634] btrfs_commit_current_transaction+0x1d/0x70 [btrfs]\n [958.635] flush_space+0xca/0x5e0 [btrfs]\n [958.636] ? _raw_spin_unlock+0x15/0x30\n [958.637] ? btrfs_reduce_alloc_profile+0x8c/0x190 [btrfs]\n [958.639] ? _raw_spin_unlock+0x15/0x30\n [958.640] ? calc_available_free_space.isra.0+0x6f/0x110 [btrfs]\n [958.641] do_async_reclaim_metadata_space+0x84/0x190 [btrfs]\n [958.642] btrfs_async_reclaim_metadata_space+0x64/0x80 [btrfs]\n [958.644] process_one_work+0x19d/0x3a0\n [958.644] worker_thread+0x1c4/0x330\n [958.645] ? __pfx_worker_thread+0x10/0x10\n [958.646] kthread+0xfc/0x130\n [958.647] ? __pfx_kthread+0x10/0x10\n [958.648] ret_from_fork+0x1f7/0x2c0\n [958.648] ? __pfx_kthread+0x10/0x10\n [958.649] ret_from_fork_asm+0x1a/0x30\n [958.650] \u003c/TASK\u003e\n [958.651] task:kworker/u49:7 state:D stack:0 pid:52990 tgid:52990 ppid:2 task_flags:0x4208060 flags:0x00080000\n [958.653] Workqueue: writeback wb_workfn (flush-btrfs-334)\n [958.655] Call Trace:\n [958.655] \u003cTASK\u003e\n [958.656] __schedule+0x4be/0x10f0\n [958.657] ? __blk_flush_plug+0xe9/0x140\n [958.658] schedule+0x26/0xd0\n [958.658] io_schedule+0x42/0x70\n [958.659] folio_wait_bit_common+0x12b/0x330\n [958.660] ? folio_wait_bit_common+0x100/0x330\n [958.662] ? __pfx_wake_page_function+0x10/0x10\n [958.663] extent_write_cache_pages+0x599/0x830 [btrfs]\n [958.664] ? acpi_fwnode_get_reference_args+0x1fa/0x270\n [958.665] btrfs_writepages+0x77/0x130 [btrfs]\n [958.666] ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]\n [958.667] do_writepages+0xc6/0x160\n [958.668] __writeback_single_inode+0x42/0x310\n [958.669] writeback_sb_inodes+0x231/0x570\n [958.670] wb_writeback+0x8a/0x340\n [958.671] wb_workfn+0xbf/0x450\n [958.672] ? finish_task_switch.isra.0+0xc1/0x350\n [958.673] process_one_work+0x19d/0x3a0\n [958.673] worker_thread+0x1c4/0x330\n [958.674] ? __pfx_worker_thread+0x10/0x10\n [958.675] kthread+0xfc/0x130\n [958.676] ? __pfx_kthread+0x10/0x10\n [958.676] ret_from_fork+0x1f7/0x2c0\n [958.677] ? __pfx_kthread+0x10/0x10\n [958.678] ret_from_fork_asm+0x1a/0x30\n [958.679] \u003c/TASK\u003e\n [958.679] task:btrfs-cleaner state:D stack:0 pid:296750 tgid:296750 ppid:2 task_flags:0x208040 flags:0x00080000\n [958.681] Call Trace:\n [958.682] \u003cTASK\u003e\n [958.682] __schedule+0x4be/0x10f0\n [958.683] schedule+0x26/0xd0\n [958.684] handle_reserve_ticket+0x1b9/0x2c0 [btrfs]\n [958.685] ? __pfx_autoremove_wake_function+0x10/0x10\n [958.686] reserve_bytes+0x283/0x4c0 [btrfs]\n [958.687] btrfs_reserve_metadata_bytes+0x18/0xb0 [btrfs]\n [958.688] btrfs_delalloc_reserve_metadata+0x121/0x320 [btrfs]\n [958.690] btrfs_delalloc_reserve_space+0x46/0xb0 [btrfs]\n [958.691] btrfs_defrag_file+0x903/0x1110 [btrfs]\n [958.692] btrfs_run_defrag_inodes+0x334/0x430 [btrfs]\n [958.694] cleaner_kthread+0x97/0x1c0 [btrfs]\n [958.694] ? __pfx_cleaner_kthread+0x10/0x10 [btrfs]\n [958.696] kthread+0xfc/0x130\n [958.696] ? __pfx_kthread+0x10/0x10\n [958.697] ret_\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:00.365Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/046396bd16fdf0a9fbdf5f04c6eda26024e7695e"
},
{
"url": "https://git.kernel.org/stable/c/c97277aa6ce8ac725642aced0fe20cd8d31f6e09"
},
{
"url": "https://git.kernel.org/stable/c/37614074596827a5f292243673b699c90ff63e7d"
},
{
"url": "https://git.kernel.org/stable/c/a9701dd06e82c345fe70debdf8835b7eb5000c59"
},
{
"url": "https://git.kernel.org/stable/c/ac916391e1c70801649f7d6f85014f687983bc33"
},
{
"url": "https://git.kernel.org/stable/c/ba02eab28041f9a4bbe9fc90c7249644fef6de0f"
}
],
"title": "btrfs: defrag: fix deadlock between defrag and delalloc space reservation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90265",
"datePublished": "2026-09-17T16:08:01.372Z",
"dateReserved": "2026-09-11T19:38:34.796Z",
"dateUpdated": "2026-10-30T12:35:00.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99138 (GCVE-0-2026-99138)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the
get_info function pointer without rcu_read_lock(). With BPF struct_ops
congestion control, ca_ops can point to dynamically allocated memory
that is freed concurrently, resulting in a use-after-free when the
kernel dereferences or calls through the stale pointer.
BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0
Read of size 8 at addr ffff888013701258 by task exploit/149
do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)
tcp_getsockopt+0x91/0xf0
__sys_getsockopt+0xf7/0x170
Fix this by wrapping the ca_ops load and get_info call within
rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load
the icsk_ca_ops pointer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp.c",
"net/ipv4/tcp_dctcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c312f17917455eedcea29735fa302ebb93cb9b9",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "66b831b427301a9c3e485564009d476631413103",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "a8b024cbf62b497062c86995737fc303e4cc384e",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "e057d201640eebb8ed47ec924872c41570a3bd28",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "86814e5370068ec2bf0caa6e6d55c3e5bfc6c324",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "39aa489e85752f9de214edb0f85e4d578e57af29",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "385e474086c2e7e29e2dded690be40dc273e20ee",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp.c",
"net/ipv4/tcp_dctcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)\n\ndo_tcp_getsockopt() reads icsk-\u003eicsk_ca_ops and dereferences the\nget_info function pointer without rcu_read_lock(). With BPF struct_ops\ncongestion control, ca_ops can point to dynamically allocated memory\nthat is freed concurrently, resulting in a use-after-free when the\nkernel dereferences or calls through the stale pointer.\n\n BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0\n Read of size 8 at addr ffff888013701258 by task exploit/149\n do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)\n tcp_getsockopt+0x91/0xf0\n __sys_getsockopt+0xf7/0x170\n\nFix this by wrapping the ca_ops load and get_info call within\nrcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load\nthe icsk_ca_ops pointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:10.759Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c312f17917455eedcea29735fa302ebb93cb9b9"
},
{
"url": "https://git.kernel.org/stable/c/66b831b427301a9c3e485564009d476631413103"
},
{
"url": "https://git.kernel.org/stable/c/a8b024cbf62b497062c86995737fc303e4cc384e"
},
{
"url": "https://git.kernel.org/stable/c/8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3"
},
{
"url": "https://git.kernel.org/stable/c/e057d201640eebb8ed47ec924872c41570a3bd28"
},
{
"url": "https://git.kernel.org/stable/c/86814e5370068ec2bf0caa6e6d55c3e5bfc6c324"
},
{
"url": "https://git.kernel.org/stable/c/39aa489e85752f9de214edb0f85e4d578e57af29"
},
{
"url": "https://git.kernel.org/stable/c/385e474086c2e7e29e2dded690be40dc273e20ee"
}
],
"title": "tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99138",
"datePublished": "2026-10-28T10:34:49.993Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-30T12:42:10.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68735 (GCVE-0-2025-68735)
Vulnerability from cvelistv5
Published
2025-12-24 12:09
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Prevent potential UAF in group creation
This commit prevents the possibility of a use after free issue in the
GROUP_CREATE ioctl function, which arose as pointer to the group is
accessed in that ioctl function after storing it in the Xarray.
A malicious userspace can second guess the handle of a group and try
to call GROUP_DESTROY ioctl from another thread around the same time
as GROUP_CREATE ioctl.
To prevent the use after free exploit, this commit uses a mark on an
entry of group pool Xarray which is added just before returning from
the GROUP_CREATE ioctl function. The mark is checked for all ioctls
that specify the group handle and so userspace won't be abe to delete
a group that isn't marked yet.
v2: Add R-bs and fixes tags
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c6bbec068a9accd6f1df05f3df9a5254c99292ee",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "c646ebff3fa571e7ea974235286fb9ed3edc260c",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "eec7e23d848d2194dd8791fcd0f4a54d4378eecd",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Prevent potential UAF in group creation\n\nThis commit prevents the possibility of a use after free issue in the\nGROUP_CREATE ioctl function, which arose as pointer to the group is\naccessed in that ioctl function after storing it in the Xarray.\nA malicious userspace can second guess the handle of a group and try\nto call GROUP_DESTROY ioctl from another thread around the same time\nas GROUP_CREATE ioctl.\n\nTo prevent the use after free exploit, this commit uses a mark on an\nentry of group pool Xarray which is added just before returning from\nthe GROUP_CREATE ioctl function. The mark is checked for all ioctls\nthat specify the group handle and so userspace won\u0027t be abe to delete\na group that isn\u0027t marked yet.\n\nv2: Add R-bs and fixes tags"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached through concurrent GROUP_CREATE and GROUP_DESTROY ioctls on a Panthor DRM device node, making it locally exploitable.\nAC:L - The attacker controls both racing threads, handles are predictably allocated from a 1\u2013128 range, and attacker-controlled queue allocations widen the repeatable race window.\nPR:L - Both ioctls have DRM_RENDER_ALLOW, and low or medium group priorities require no capability; a basic unprivileged process with render-node access suffices.\nUI:N - The attacker directly issues the concurrent ioctls without requiring any action from another user.\nS:U - The corruption affects the host kernel within the same security authority and represents standard local privilege escalation, not a VM or IOMMU-boundary escape.\nC:H - The group can be freed and reclaimed while creation continues dereferencing stale pointers, providing exploitable heap corruption that can enable arbitrary kernel-memory disclosure.\nI:H - Post-free operations write queue pointers, counters, list links, locks, and task metadata into reclaimed memory, enabling arbitrary corruption and potential control-flow hijacking.\nA:H - Concurrent cleanup can free the group and associated resources while they remain in use, allowing repeatable kernel crashes, oopses, or panics."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:25.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c6bbec068a9accd6f1df05f3df9a5254c99292ee"
},
{
"url": "https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05"
},
{
"url": "https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c"
},
{
"url": "https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd"
}
],
"title": "drm/panthor: Prevent potential UAF in group creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68735",
"datePublished": "2025-12-24T12:09:34.364Z",
"dateReserved": "2025-12-24T10:30:51.028Z",
"dateUpdated": "2026-10-21T12:38:25.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68360 (GCVE-0-2025-68360)
Vulnerability from cvelistv5
Published
2025-12-24 10:32
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
MT7996 driver can use both wed and wed_hif2 devices to offload traffic
from/to the wireless NIC. In the current codebase we assume to always
use the primary wed device in wed callbacks resulting in the following
crash if the hw runs wed_hif2 (e.g. 6GHz link).
[ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a
[ 297.464928] Mem abort info:
[ 297.467722] ESR = 0x0000000096000005
[ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits
[ 297.476766] SET = 0, FnV = 0
[ 297.479809] EA = 0, S1PTW = 0
[ 297.482940] FSC = 0x05: level 1 translation fault
[ 297.487809] Data abort info:
[ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000
[ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000
[ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP
[ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0
[ 297.723908] Tainted: [O]=OOT_MODULE
[ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT)
[ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table]
[ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76]
[ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80
[ 297.757126] sp : ffffffc080fe3ae0
[ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7
[ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00
[ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018
[ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000
[ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000
[ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da
[ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200
[ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002
[ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000
[ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8
[ 297.831686] Call trace:
[ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76]
[ 297.839254] mtk_wed_flow_remove+0x58/0x80
[ 297.843342] mtk_flow_offload_cmd+0x434/0x574
[ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40
[ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table]
[ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table]
[ 297.864463] process_one_work+0x174/0x300
[ 297.868465] worker_thread+0x278/0x430
[ 297.872204] kthread+0xd8/0xdc
[ 297.875251] ret_from_fork+0x10/0x20
[ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421)
[ 297.884901] ---[ end trace 0000000000000000 ]---
Fix the issue detecting the proper wed reference to use running wed
callabacks.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:04:51.508815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:43.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76.h",
"drivers/net/wireless/mediatek/mt76/mt7996/mmio.c",
"drivers/net/wireless/mediatek/mt76/wed.c",
"include/linux/soc/mediatek/mtk_wed.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "369cdd236970f7ad95e47eb2d43dbc759288a636",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
},
{
"lessThan": "ab94ecb997fd1bbc501a0116c7aad51556b67c86",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
},
{
"lessThan": "d582d0e988d696698c94edf097062bb987ae592c",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
},
{
"lessThan": "385aab8fccd7a8746b9f1a17f3c1e38498a14bc7",
"status": "affected",
"version": "83eafc9251d6d30574b629ac637c56d168fcbdd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76.h",
"drivers/net/wireless/mediatek/mt76/mt7996/mmio.c",
"drivers/net/wireless/mediatek/mt76/wed.c",
"include/linux/soc/mediatek/mtk_wed.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks\n\nMT7996 driver can use both wed and wed_hif2 devices to offload traffic\nfrom/to the wireless NIC. In the current codebase we assume to always\nuse the primary wed device in wed callbacks resulting in the following\ncrash if the hw runs wed_hif2 (e.g. 6GHz link).\n\n[ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a\n[ 297.464928] Mem abort info:\n[ 297.467722] ESR = 0x0000000096000005\n[ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 297.476766] SET = 0, FnV = 0\n[ 297.479809] EA = 0, S1PTW = 0\n[ 297.482940] FSC = 0x05: level 1 translation fault\n[ 297.487809] Data abort info:\n[ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000\n[ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000\n[ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP\n[ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0\n[ 297.723908] Tainted: [O]=OOT_MODULE\n[ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT)\n[ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table]\n[ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76]\n[ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80\n[ 297.757126] sp : ffffffc080fe3ae0\n[ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7\n[ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00\n[ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018\n[ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000\n[ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000\n[ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da\n[ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200\n[ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002\n[ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000\n[ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8\n[ 297.831686] Call trace:\n[ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76]\n[ 297.839254] mtk_wed_flow_remove+0x58/0x80\n[ 297.843342] mtk_flow_offload_cmd+0x434/0x574\n[ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40\n[ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table]\n[ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table]\n[ 297.864463] process_one_work+0x174/0x300\n[ 297.868465] worker_thread+0x278/0x430\n[ 297.872204] kthread+0xd8/0xdc\n[ 297.875251] ret_from_fork+0x10/0x20\n[ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421)\n[ 297.884901] ---[ end trace 0000000000000000 ]---\n\nFix the issue detecting the proper wed reference to use running wed\ncallabacks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote peer can establish and terminate a routed TCP or UDP flow whose egress is an HIF2 WiFi station, causing hardware-flow teardown to invoke the vulnerable callback without local access.\nAC:L - On a WED-enabled dual-HIF device with hardware flow offload configured, creating and ending a qualifying flow deterministically reaches the bug; no race or unpredictable heap layout is required.\nPR:N - The packet-driven trigger has no capability or authentication check, and the attacker\u0027s remote flow is sufficient; administrative setup of WED and the flowtable is a pre-existing deployment condition.\nUI:N - No victim action is required once the affected router and HIF2 wireless station are operating.\nS:U - The fault corrupts or crashes the host kernel within its existing security authority and does not cross a virtualization or IOMMU boundary.\nC:N - The displaced pointer causes internal invalid reads, but no read data is returned to the attacker and no information-disclosure primitive is evident.\nI:L - The enable callback writes a fixed token-limit value through the displaced device pointer into unrelated kernel state, providing constrained corruption but not an attacker-selected arbitrary-write primitive.\nA:H - Flow removal dereferences a bogus driver pointer and produces a kernel oops; it can also leave networking locks or state unusable and can be triggered again after recovery or reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:18.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/369cdd236970f7ad95e47eb2d43dbc759288a636"
},
{
"url": "https://git.kernel.org/stable/c/ab94ecb997fd1bbc501a0116c7aad51556b67c86"
},
{
"url": "https://git.kernel.org/stable/c/d582d0e988d696698c94edf097062bb987ae592c"
},
{
"url": "https://git.kernel.org/stable/c/385aab8fccd7a8746b9f1a17f3c1e38498a14bc7"
}
],
"title": "wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68360",
"datePublished": "2025-12-24T10:32:49.121Z",
"dateReserved": "2025-12-16T14:48:05.305Z",
"dateUpdated": "2026-10-21T12:38:18.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23385 (GCVE-0-2026-23385)
Vulnerability from cvelistv5
Published
2026-03-25 10:28
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: clone set on flush only
Syzbot with fault injection triggered a failing memory allocation with
GFP_KERNEL which results in a WARN splat:
iter.err
WARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992
Modules linked in:
CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845
Code: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 <0f> 0b 90 43
+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9
RSP: 0018:ffffc900045af780 EFLAGS: 00010293
RAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40
RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000
RBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0
R13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920
FS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0
Call Trace:
<TASK>
__nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115
nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761
__sock_release net/socket.c:662 [inline]
sock_close+0xc3/0x240 net/socket.c:1455
Restrict set clone to the flush set command in the preparation phase.
Add NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree
and pipapo backends to only clone the set when this iteration type is
used.
As for the existing NFT_ITER_UPDATE type, update the pipapo backend to
use the existing set clone if available, otherwise use the existing set
representation. After this update, there is no need to clone a set that
is being deleted, this includes bound anonymous set.
An alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone
interface and call it from the flush set path.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 11fb04a111934eb8fbed077cd943719ed16c6447 Version: 744dc9a47a8458ed49becd6123a092c7dae82b8b Version: 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc Version: 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc Version: 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc Version: 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc Version: 7c80229aa6e2707e59aa80cc041127cf9a79bcc9 Version: 6.1.184 ≤ Version: 6.6.148 ≤ Version: 5.15.217 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_hash.c",
"net/netfilter/nft_set_pipapo.c",
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e63e1c2b171d30f5351b89b0a5d3926902f9ca6",
"status": "affected",
"version": "11fb04a111934eb8fbed077cd943719ed16c6447",
"versionType": "git"
},
{
"lessThan": "e38f054f0af98224003e600545726fbd96379cfb",
"status": "affected",
"version": "744dc9a47a8458ed49becd6123a092c7dae82b8b",
"versionType": "git"
},
{
"lessThan": "454306ceb94dc47a52443181082c91204c007a74",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
},
{
"lessThan": "9154945a6394029822bd08c24cef5a3f86d0424a",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
},
{
"lessThan": "b7f67282ca2be14b727dd698b50e10cf5d8c66f9",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
},
{
"lessThan": "fb7fb4016300ac622c964069e286dc83166a5d52",
"status": "affected",
"version": "3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc",
"versionType": "git"
},
{
"status": "affected",
"version": "7c80229aa6e2707e59aa80cc041127cf9a79bcc9",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.217",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nf_tables_api.c",
"net/netfilter/nft_set_hash.c",
"net/netfilter/nft_set_pipapo.c",
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.184",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.217",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: clone set on flush only\n\nSyzbot with fault injection triggered a failing memory allocation with\nGFP_KERNEL which results in a WARN splat:\n\niter.err\nWARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992\nModules linked in:\nCPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026\nRIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845\nCode: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 \u003c0f\u003e 0b 90 43\n+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9\nRSP: 0018:ffffc900045af780 EFLAGS: 00010293\nRAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40\nRDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000\nRBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff\nR10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0\nR13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920\nFS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115\n nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187\n notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85\n blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380\n netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761\n __sock_release net/socket.c:662 [inline]\n sock_close+0xc3/0x240 net/socket.c:1455\n\nRestrict set clone to the flush set command in the preparation phase.\nAdd NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree\nand pipapo backends to only clone the set when this iteration type is\nused.\n\nAs for the existing NFT_ITER_UPDATE type, update the pipapo backend to\nuse the existing set clone if available, otherwise use the existing set\nrepresentation. After this update, there is no need to clone a set that\nis being deleted, this includes bound anonymous set.\n\nAn alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone\ninterface and call it from the flush set path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:04.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e63e1c2b171d30f5351b89b0a5d3926902f9ca6"
},
{
"url": "https://git.kernel.org/stable/c/e38f054f0af98224003e600545726fbd96379cfb"
},
{
"url": "https://git.kernel.org/stable/c/454306ceb94dc47a52443181082c91204c007a74"
},
{
"url": "https://git.kernel.org/stable/c/9154945a6394029822bd08c24cef5a3f86d0424a"
},
{
"url": "https://git.kernel.org/stable/c/b7f67282ca2be14b727dd698b50e10cf5d8c66f9"
},
{
"url": "https://git.kernel.org/stable/c/fb7fb4016300ac622c964069e286dc83166a5d52"
}
],
"title": "netfilter: nf_tables: clone set on flush only",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23385",
"datePublished": "2026-03-25T10:28:03.460Z",
"dateReserved": "2026-01-13T15:37:46.008Z",
"dateUpdated": "2026-10-30T12:24:04.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93144 (GCVE-0-2026-93144)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject writes through untrusted BTF pointers
check_ptr_to_btf_access() lets program-type btf_struct_access callbacks
validate writes before the default BTF access path rejects non-read
accesses. That bypasses the read-only policy for untrusted BTF pointers
created by helpers such as bpf_rdonly_cast().
Reject non-read accesses through PTR_UNTRUSTED BTF pointers at the
common entry point, before the callback branch to handle all cases.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56f92fecd80419567288b7972caa90107033836e",
"status": "affected",
"version": "282de143ead96a5d53331e946f31c977b4610a74",
"versionType": "git"
},
{
"lessThan": "c4dc883447ae38c4e22a29cc016046fa65d88994",
"status": "affected",
"version": "282de143ead96a5d53331e946f31c977b4610a74",
"versionType": "git"
},
{
"lessThan": "644cf4e77c2770d4246f6d12f99bc80d253b0ec6",
"status": "affected",
"version": "282de143ead96a5d53331e946f31c977b4610a74",
"versionType": "git"
},
{
"lessThan": "19d5566b84ca1af0256d0d0003e1a081580c3ba3",
"status": "affected",
"version": "282de143ead96a5d53331e946f31c977b4610a74",
"versionType": "git"
},
{
"lessThan": "ac65c710cc643cbc52b899627577357867249530",
"status": "affected",
"version": "282de143ead96a5d53331e946f31c977b4610a74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject writes through untrusted BTF pointers\n\ncheck_ptr_to_btf_access() lets program-type btf_struct_access callbacks\nvalidate writes before the default BTF access path rejects non-read\naccesses. That bypasses the read-only policy for untrusted BTF pointers\ncreated by helpers such as bpf_rdonly_cast().\n\nReject non-read accesses through PTR_UNTRUSTED BTF pointers at the\ncommon entry point, before the callback branch to handle all cases."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled input is BPF bytecode that calls bpf_rdonly_cast() then STX, submitted via bpf(BPF_PROG_LOAD) in SYSCALL_DEFINE5(bpf) \u2192 bpf_prog_load() \u2192 bpf_check() \u2192 do_check_main() \u2192 check_mem_access() \u2192 check_ptr_to_btf_access(); no remote protocol carries that untrusted pointer or the store.\nAC:L - A BPF_PROG_TYPE_STRUCT_OPS program attached to bpf_dummy_ops (check_struct_ops_btf_id() sets env-\u003eops to bpf_dummy_ops_btf_struct_access) or a BPF_PROG_TYPE_SCHED_CLS program (tc_cls_act_btf_struct_access) does bpf_rdonly_cast() then a store; the WRITE path ran the callback before the old \"only read is supported\" check. No race.\nPR:L - check_ptr_to_btf_access() returns -EPERM unless env-\u003eallow_ptr_leaks (bpf_token_capable(CAP_PERFMON)); STRUCT_OPS also fails is_perfmon_prog_type() without CAP_PERFMON, and add_subprog_and_kfunc() needs env-\u003ebpf_capable to emit bpf_rdonly_cast. bpf_token_capable() uses ns_capable() on a delegated token userns, not init-namespace root.\nUI:N - The attacker loads that program with BPF_PROG_LOAD and runs it via BPF_PROG_TEST_RUN (bpf_struct_ops_test_run() \u2192 dummy_ops_call_op() for bpf_dummy_ops, or bpf_prog_test_run_skb() for SCHED_CLS). No other user must mount, open a file, or cooperate.\nS:U - bpf_convert_ctx_accesses() leaves PTR_TO_BTF_ID|PTR_UNTRUSTED stores as plain STX (only reads become BPF_PROBE_MEM), so the write corrupts host kernel memory in the same authority as the bpf() caller; this is not a KVM/Xen guest-to-host escape or IOMMU bypass.\nC:H - The accepted STX writes attacker bytes through a bpf_rdonly_cast() pointer (obj__ign skips type checks) at bpf_dummy_ops_state.val, nf_conn.mark, or tcp_sock.snd_cwnd. That type-confused kernel write is a memory-corruption primitive that can be turned into an arbitrary kernel read.\nI:H - bpf_dummy_ops_btf_struct_access() accepts any store within sizeof(struct bpf_dummy_ops_state), and _nf_conntrack_btf_struct_access() accepts nf_conn.mark, on a PTR_UNTRUSTED base from bpf_rdonly_cast(); the JIT emits a plain store to that address, an arbitrary kernel write usable for control-flow hijacking.\nA:H - The same unprobed STX to bpf_rdonly_cast(0, btf_id) or to an out-of-bounds map/stack address page-faults in kernel context during bpf_struct_ops_test_run()/bpf_prog_test_run_skb() and oopses/panics, and the attacker can repeat BPF_PROG_TEST_RUN at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:02.003Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56f92fecd80419567288b7972caa90107033836e"
},
{
"url": "https://git.kernel.org/stable/c/c4dc883447ae38c4e22a29cc016046fa65d88994"
},
{
"url": "https://git.kernel.org/stable/c/644cf4e77c2770d4246f6d12f99bc80d253b0ec6"
},
{
"url": "https://git.kernel.org/stable/c/19d5566b84ca1af0256d0d0003e1a081580c3ba3"
},
{
"url": "https://git.kernel.org/stable/c/ac65c710cc643cbc52b899627577357867249530"
}
],
"title": "bpf: Reject writes through untrusted BTF pointers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93144",
"datePublished": "2026-09-17T16:11:42.757Z",
"dateReserved": "2026-09-17T16:02:15.088Z",
"dateUpdated": "2026-10-21T12:52:02.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74711 (GCVE-0-2026-74711)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus) Fix type confusion in notification logic
Sashiko reports:
At the start of the loop in pmbus_notify(), the code unconditionally casts
every attribute to a struct sensor_device_attribute:
drivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {
for (i = 0; i < data->num_attributes; i++) {
struct device_attribute *da = to_dev_attr(data->group.attrs[i]);
struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
int index = attr->index;
...
}
However, data->group.attrs can contain other types like struct
pmbus_samples_reg or struct pmbus_sensor, which only embed a base
struct device_attribute.
If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting
it to struct sensor_device_attribute and reading the index field appears
to access memory past the end of the allocation, which might trigger a
slab-out-of-bounds read.
Additionally, if da is a struct pmbus_sensor, casting it causes the index
field to overlap with the page, phase, and reg fields. Could this produce
a garbage mask on little-endian systems that spuriously matches the target
reg, page, and flags during an alert?
Fix the problem by using struct sensor_device_attr in struct pmbus_sensor
and struct pmbus_label. Since those attributes never trigger a
notification, set the value of attr->index to -1 for them. Use this value
to distinguish from boolean attributes which _can_ trigger a notification
and use the index field to encode mask, page, and register values.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce443f6827b97e03a0fb34ebfddc8939c85e0500",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "1c8dd39d48494cceb2c27c1911cbf26d10ce8514",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "821f6416e69782fa662aff94b5ea52c943042790",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "0b121de89a99c54bcf516999b04e8531c84f08d5",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
},
{
"lessThan": "59bd68ab05a8f9c9a60b6ec44682084184803ff4",
"status": "affected",
"version": "f469bde9afd136598a0c4edc054296e6046f90ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus) Fix type confusion in notification logic\n\nSashiko reports:\n\nAt the start of the loop in pmbus_notify(), the code unconditionally casts\nevery attribute to a struct sensor_device_attribute:\n\ndrivers/hwmon/pmbus/pmbus_core.c:pmbus_notify() {\n for (i = 0; i \u003c data-\u003enum_attributes; i++) {\n struct device_attribute *da = to_dev_attr(data-\u003egroup.attrs[i]);\n struct sensor_device_attribute *attr = to_sensor_dev_attr(da);\n int index = attr-\u003eindex;\n...\n}\n\nHowever, data-\u003egroup.attrs can contain other types like struct\npmbus_samples_reg or struct pmbus_sensor, which only embed a base\nstruct device_attribute.\n\nIf da is a struct pmbus_samples_reg, dev_attr is the last member. Casting\nit to struct sensor_device_attribute and reading the index field appears\nto access memory past the end of the allocation, which might trigger a\nslab-out-of-bounds read.\n\nAdditionally, if da is a struct pmbus_sensor, casting it causes the index\nfield to overlap with the page, phase, and reg fields. Could this produce\na garbage mask on little-endian systems that spuriously matches the target\nreg, page, and flags during an alert?\n\nFix the problem by using struct sensor_device_attr in struct pmbus_sensor\nand struct pmbus_label. Since those attributes never trigger a\nnotification, set the value of attr-\u003eindex to -1 for them. Use this value\nto distinguish from boolean attributes which _can_ trigger a notification\nand use the index field to encode mask, page, and register values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flawed pmbus_notify() runs only in the PMBus SMBALERT threaded IRQ handler after the host kernel reads fault status from an on-board I2C/SMBus PSU/PMIC; reaching it requires local presence on a system exposing that bus, not a remote network protocol.\nAC:L - Once SMBALERT IRQ handling is enabled, the type confusion and slab out-of-bounds read occur deterministically on every alert while iterating attributes; an attacker can repeatedly provoke PSU/PMIC faults (e.g., sustained CPU/GPU load) rather than depend on uncontrollable timing.\nPR:N - No special kernel capability is needed to hit the IRQ path\u2014any unprivileged local process that can drive hardware into an overcurrent/overtemp fault (cloud tenant, factory HMI user, embedded service account) can cause SMBALERT and exercise the bug.\nUI:N - Exploitation is driven by attacker-induced or naturally occurring PMBus fault interrupts and does not require any victim to open files, click prompts, or perform other interactive actions.\nS:U - Impact is confined to kernel memory safety within the host OS security authority; it is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority compromise.\nC:H - Casting pmbus_samples_reg device attributes to sensor_device_attribute reads attr-\u003eindex past the object end (slab out-of-bounds), and pmbus_sensor casts reinterpret adjacent page/phase/reg bytes as an index, enabling kernel heap metadata or pointer disclosure.\nI:H - This is a type confusion in kernel notification logic: mis-decoded indices can spuriously satisfy reg/page/mask checks and drive sysfs_notify/uevent on unintended attributes, a memory-safety defect with potential for further corruption primitives.\nA:H - The out-of-bounds slab read and malformed attribute matching in interrupt context can trigger KASAN/BUG faults or kernel oops/panic when alerts fire on production systems with PMBus SMBALERT wired."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:12.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce443f6827b97e03a0fb34ebfddc8939c85e0500"
},
{
"url": "https://git.kernel.org/stable/c/1c8dd39d48494cceb2c27c1911cbf26d10ce8514"
},
{
"url": "https://git.kernel.org/stable/c/821f6416e69782fa662aff94b5ea52c943042790"
},
{
"url": "https://git.kernel.org/stable/c/0b121de89a99c54bcf516999b04e8531c84f08d5"
},
{
"url": "https://git.kernel.org/stable/c/59bd68ab05a8f9c9a60b6ec44682084184803ff4"
}
],
"title": "hwmon: (pmbus) Fix type confusion in notification logic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74711",
"datePublished": "2026-08-22T15:33:07.779Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-10-21T12:46:12.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68368 (GCVE-0-2025-68368)
Vulnerability from cvelistv5
Published
2025-12-24 10:32
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md: init bioset in mddev_init
IO operations may be needed before md_run(), such as updating metadata
after writing sysfs. Without bioset, this triggers a NULL pointer
dereference as below:
BUG: kernel NULL pointer dereference, address: 0000000000000020
Call Trace:
md_update_sb+0x658/0xe00
new_level_store+0xc5/0x120
md_attr_store+0xc9/0x1e0
sysfs_kf_write+0x6f/0xa0
kernfs_fop_write_iter+0x141/0x2a0
vfs_write+0x1fc/0x5a0
ksys_write+0x79/0x180
__x64_sys_write+0x1d/0x30
x64_sys_call+0x2818/0x2880
do_syscall_64+0xa9/0x580
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Reproducer
```
mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd]
echo inactive > /sys/block/md0/md/array_state
echo 10 > /sys/block/md0/md/new_level
```
mddev_init() can only be called once per mddev, no need to test if bioset
has been initialized anymore.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/md.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "903fb4851ee8d291372d285f616c398a9c4cbbec",
"status": "affected",
"version": "d981ed8419303ed12351eea8541ad6cb76455fe3",
"versionType": "git"
},
{
"lessThan": "9d37fe37dfa0833a8768740f0575e0ffd793cb4a",
"status": "affected",
"version": "d981ed8419303ed12351eea8541ad6cb76455fe3",
"versionType": "git"
},
{
"lessThan": "381a3ce1c0ffed647c9b913e142b099c7e9d5afc",
"status": "affected",
"version": "d981ed8419303ed12351eea8541ad6cb76455fe3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/md.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: init bioset in mddev_init\n\nIO operations may be needed before md_run(), such as updating metadata\nafter writing sysfs. Without bioset, this triggers a NULL pointer\ndereference as below:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n Call Trace:\n md_update_sb+0x658/0xe00\n new_level_store+0xc5/0x120\n md_attr_store+0xc9/0x1e0\n sysfs_kf_write+0x6f/0xa0\n kernfs_fop_write_iter+0x141/0x2a0\n vfs_write+0x1fc/0x5a0\n ksys_write+0x79/0x180\n __x64_sys_write+0x1d/0x30\n x64_sys_call+0x2818/0x2880\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nReproducer\n```\n mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd]\n echo inactive \u003e /sys/block/md0/md/array_state\n echo 10 \u003e /sys/block/md0/md/new_level\n```\n\nmddev_init() can only be called once per mddev, no need to test if bioset\nhas been initialized anymore."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:19.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/903fb4851ee8d291372d285f616c398a9c4cbbec"
},
{
"url": "https://git.kernel.org/stable/c/9d37fe37dfa0833a8768740f0575e0ffd793cb4a"
},
{
"url": "https://git.kernel.org/stable/c/381a3ce1c0ffed647c9b913e142b099c7e9d5afc"
}
],
"title": "md: init bioset in mddev_init",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68368",
"datePublished": "2025-12-24T10:32:54.765Z",
"dateReserved": "2025-12-16T14:48:05.309Z",
"dateUpdated": "2026-10-21T12:38:19.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23377 (GCVE-0-2026-23377)
Vulnerability from cvelistv5
Published
2026-03-25 10:27
Modified
2026-11-05 21:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
The only user of frag_size field in XDP RxQ info is
bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead
of DMA write size. Different assumptions in ice driver configuration lead
to negative tailroom.
This allows to trigger kernel panic, when using
XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to
6912 and the requested offset to a huge value, e.g.
XSK_UMEM__MAX_FRAME_SIZE * 100.
Due to other quirks of the ZC configuration in ice, panic is not observed
in ZC mode, but tailroom growing still fails when it should not.
Use fill queue buffer truesize instead of DMA write size in XDP RxQ info.
Fix ZC mode too by using the new helper.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:29:03.158573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:33:44.050Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
},
{
"lessThan": "6aed180a44b1c0a3971107fa052a41b03acdb31e",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
},
{
"lessThan": "2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
},
{
"lessThan": "b0f05100e8795aadd1c0606bae9caefbda070d63",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
},
{
"lessThan": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7",
"status": "affected",
"version": "2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:02.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f2b29bbe355221a65c3eccf9500e5e33e4f1cb5c"
},
{
"url": "https://git.kernel.org/stable/c/6aed180a44b1c0a3971107fa052a41b03acdb31e"
},
{
"url": "https://git.kernel.org/stable/c/2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7"
},
{
"url": "https://git.kernel.org/stable/c/b0f05100e8795aadd1c0606bae9caefbda070d63"
},
{
"url": "https://git.kernel.org/stable/c/e142dc4ef0f451b7ef99d09aaa84e9389af629d7"
}
],
"title": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23377",
"datePublished": "2026-03-25T10:27:57.338Z",
"dateReserved": "2026-01-13T15:37:46.006Z",
"dateUpdated": "2026-11-05T21:33:44.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71141 (GCVE-0-2025-71141)
Vulnerability from cvelistv5
Published
2026-01-14 15:07
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/tilcdc: Fix removal actions in case of failed probe
The drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers
should only be called when the device has been successfully registered.
Currently, these functions are called unconditionally in tilcdc_fini(),
which causes warnings during probe deferral scenarios.
[ 7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68
...
[ 8.005820] drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108
[ 8.005858] drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8
[ 8.005885] drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144
[ 8.005911] drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]
[ 8.005957] tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]
Fix this by rewriting the failed probe cleanup path using the standard
goto error handling pattern, which ensures that cleanup functions are
only called on successfully initialized resources. Additionally, remove
the now-unnecessary is_registered flag.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 69f03be1fa08a66735d53d92d3429c052540e3bf Version: 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a Version: 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a Version: 3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a Version: 84021fa4cf190e257ae8b66d284cdb92e3fabe33 Version: 6.6.2 ≤ Version: 6.5.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/tilcdc/tilcdc_crtc.c",
"drivers/gpu/drm/tilcdc/tilcdc_drv.c",
"drivers/gpu/drm/tilcdc/tilcdc_drv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21e52dc7762908c3d499cfb493d1b8281fc1d3ab",
"status": "affected",
"version": "69f03be1fa08a66735d53d92d3429c052540e3bf",
"versionType": "git"
},
{
"lessThan": "28138ea7180c382b449ba9dce12fdec68880dea4",
"status": "affected",
"version": "3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a",
"versionType": "git"
},
{
"lessThan": "71be8825e83c90c1e020feb77b29e6a99629e642",
"status": "affected",
"version": "3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a",
"versionType": "git"
},
{
"lessThan": "a585c7ef9cabda58088916baedc6573e9a5cd2a7",
"status": "affected",
"version": "3c4babae3c4a1ae05f8f3f5f3d50c440ead7ca6a",
"versionType": "git"
},
{
"status": "affected",
"version": "84021fa4cf190e257ae8b66d284cdb92e3fabe33",
"versionType": "git"
},
{
"lessThan": "6.6.120",
"status": "affected",
"version": "6.6.2",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/tilcdc/tilcdc_crtc.c",
"drivers/gpu/drm/tilcdc/tilcdc_drv.c",
"drivers/gpu/drm/tilcdc/tilcdc_drv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "6.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tilcdc: Fix removal actions in case of failed probe\n\nThe drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers\nshould only be called when the device has been successfully registered.\nCurrently, these functions are called unconditionally in tilcdc_fini(),\nwhich causes warnings during probe deferral scenarios.\n\n[ 7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68\n...\n[ 8.005820] drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108\n[ 8.005858] drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8\n[ 8.005885] drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144\n[ 8.005911] drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]\n[ 8.005957] tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]\n\nFix this by rewriting the failed probe cleanup path using the standard\ngoto error handling pattern, which ensures that cleanup functions are\nonly called on successfully initialized resources. Additionally, remove\nthe now-unnecessary is_registered flag."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:35.452Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21e52dc7762908c3d499cfb493d1b8281fc1d3ab"
},
{
"url": "https://git.kernel.org/stable/c/28138ea7180c382b449ba9dce12fdec68880dea4"
},
{
"url": "https://git.kernel.org/stable/c/71be8825e83c90c1e020feb77b29e6a99629e642"
},
{
"url": "https://git.kernel.org/stable/c/a585c7ef9cabda58088916baedc6573e9a5cd2a7"
}
],
"title": "drm/tilcdc: Fix removal actions in case of failed probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71141",
"datePublished": "2026-01-14T15:07:54.456Z",
"dateReserved": "2026-01-13T15:30:19.661Z",
"dateUpdated": "2026-10-21T12:38:35.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43298 (GCVE-0-2026-43298)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Skip vcn poison irq release on VF
VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid
call trace during deinitialization.
[ 71.913601] [drm] clean up the vf2pf work item
[ 71.915088] ------------[ cut here ]------------
[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]
[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd
[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu
[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014
[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]
[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00
[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246
[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000
[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000
[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000
[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000
[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0
[ 71.915800] PKRU: 55555554
[ 71.915802] Call Trace:
[ 71.915805] <TASK>
[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43298",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:33:42.061881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:47.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87fc584a72bc47f984600f693501be06548d733e",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
},
{
"lessThan": "89008271744f13854cb30408cf9aaada313ebb4a",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
},
{
"lessThan": "8ee9aa80d4f1893a6699d46c403a1731548b544b",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
},
{
"lessThan": "f1db6fc5a834c8ca9485cc0596dd7df8b8619b64",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
},
{
"lessThan": "8980be03b3f9a4b58197ef95d3b37efa41a25331",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Skip vcn poison irq release on VF\n\nVF doesn\u0027t enable VCN poison irq in VCNv2.5. Skip releasing it and avoid\ncall trace during deinitialization.\n\n[ 71.913601] [drm] clean up the vf2pf work item\n[ 71.915088] ------------[ cut here ]------------\n[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]\n[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd\n[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu\n[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014\n[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]\n[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 \u003c0f\u003e 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00\n[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246\n[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000\n[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000\n[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000\n[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000\n[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000\n[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0\n[ 71.915800] PKRU: 55555554\n[ 71.915802] Call Trace:\n[ 71.915805] \u003cTASK\u003e\n[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:30.864Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87fc584a72bc47f984600f693501be06548d733e"
},
{
"url": "https://git.kernel.org/stable/c/89008271744f13854cb30408cf9aaada313ebb4a"
},
{
"url": "https://git.kernel.org/stable/c/8ee9aa80d4f1893a6699d46c403a1731548b544b"
},
{
"url": "https://git.kernel.org/stable/c/f1db6fc5a834c8ca9485cc0596dd7df8b8619b64"
},
{
"url": "https://git.kernel.org/stable/c/8980be03b3f9a4b58197ef95d3b37efa41a25331"
}
],
"title": "drm/amdgpu: Skip vcn poison irq release on VF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43298",
"datePublished": "2026-05-08T13:11:20.215Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-11-06T15:42:47.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46245 (GCVE-0-2026-46245)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix dc_link NULL handling in HPD init
amdgpu_dm_hpd_init() may see connectors without a valid dc_link.
The code already checks dc_link for the polling decision, but later
unconditionally dereferences it when setting up HPD interrupts.
Assign dc_link early and skip connectors where it is NULL.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()
error: we previously assumed 'dc_link' could be null (see line 931)
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c
923 /*
924 * Analog connectors may be hot-plugged unlike other connector
925 * types that don't support HPD. Only poll analog connectors.
926 */
927 use_polling |=
928 amdgpu_dm_connector->dc_link &&
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed
929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);
930
931 dc_link = amdgpu_dm_connector->dc_link;
dc_link assigned here.
932
933 /*
934 * Get a base driver irq reference for hpd ints for the lifetime
935 * of dm. Note that only hpd interrupt types are registered with
936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on
937 * hpd_rx isn't available. DM currently controls hpd_rx
938 * explicitly with dc_interrupt_set()
939 */
--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {
^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.
941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;
942 /*
943 * TODO: There's a mismatch between mode_info.num_hpd
944 * and what bios reports as the # of connectors with hpd
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46245",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:12:46.754116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:46.132Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d772e8570f19ac05fd9b11c8af86ada98f35f0c8",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "0965f1e775130e325e74152d867d2e8ce865fa05",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "1d15503e454bf117a0d0078332d48df86a41c828",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "a490e4d3c9fed1e690c8de348416eea3a9f054ff",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "226a40c06a183abaeb7529a4f54d6c203bd14407",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dc_link NULL handling in HPD init\n\namdgpu_dm_hpd_init() may see connectors without a valid dc_link.\n\nThe code already checks dc_link for the polling decision, but later\nunconditionally dereferences it when setting up HPD interrupts.\n\nAssign dc_link early and skip connectors where it is NULL.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: we previously assumed \u0027dc_link\u0027 could be null (see line 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Analog connectors may be hot-plugged unlike other connector\n 925 * types that don\u0027t support HPD. Only poll analog connectors.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector-\u003edc_link \u0026\u0026\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector-\u003edc_link-\u003elink_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector-\u003edc_link;\n\ndc_link assigned here.\n\n 932\n 933 /*\n 934 * Get a base driver irq reference for hpd ints for the lifetime\n 935 * of dm. Note that only hpd interrupt types are registered with\n 936 * base driver; hpd_rx types aren\u0027t. IOW, amdgpu_irq_get/put on\n 937 * hpd_rx isn\u0027t available. DM currently controls hpd_rx\n 938 * explicitly with dc_interrupt_set()\n 939 */\n--\u003e 940 if (dc_link-\u003eirq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ If it\u0027s NULL then we are trouble because we dereference it here.\n\n 941 irq_type = dc_link-\u003eirq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * TODO: There\u0027s a mismatch between mode_info.num_hpd\n 944 * and what bios reports as the # of connectors with hpd"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:29.783Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d772e8570f19ac05fd9b11c8af86ada98f35f0c8"
},
{
"url": "https://git.kernel.org/stable/c/0965f1e775130e325e74152d867d2e8ce865fa05"
},
{
"url": "https://git.kernel.org/stable/c/1d15503e454bf117a0d0078332d48df86a41c828"
},
{
"url": "https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff"
},
{
"url": "https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"
}
],
"title": "drm/amd/display: Fix dc_link NULL handling in HPD init",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46245",
"datePublished": "2026-06-03T15:49:40.645Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-11-06T16:13:46.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46228 (GCVE-0-2026-46228)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: ch341: fix devres lifetime
USB drivers bind to USB interfaces and any device managed resources
should have their lifetime tied to the interface rather than parent USB
device. This avoids issues like memory leaks when drivers are unbound
without their devices being physically disconnected (e.g. on probe
deferral or configuration changes).
Fix the controller and driver data lifetime so that they are released
on driver unbind.
Note that this also makes sure that the SPI controller is placed
correctly under the USB interface in the device tree.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-ch341.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42dfcd2ced905ea3993d88a051c13e04ab1029f7",
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"versionType": "git"
},
{
"lessThan": "4422fc2411cbbdf5104a914e0596bb483faea254",
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"versionType": "git"
},
{
"lessThan": "108a64b27a52f781c4f3751641e3dd65c7dd2fb5",
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"versionType": "git"
},
{
"lessThan": "abe572f630bc1f0e77041012ab075869036ede4f",
"status": "affected",
"version": "8846739f52afa07e63395c80227dc544f54bd7b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-ch341.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ch341: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the controller and driver data lifetime so that they are released\non driver unbind.\n\nNote that this also makes sure that the SPI controller is placed\ncorrectly under the USB interface in the device tree."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:27.598Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42dfcd2ced905ea3993d88a051c13e04ab1029f7"
},
{
"url": "https://git.kernel.org/stable/c/4422fc2411cbbdf5104a914e0596bb483faea254"
},
{
"url": "https://git.kernel.org/stable/c/108a64b27a52f781c4f3751641e3dd65c7dd2fb5"
},
{
"url": "https://git.kernel.org/stable/c/abe572f630bc1f0e77041012ab075869036ede4f"
}
],
"title": "spi: ch341: fix devres lifetime",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46228",
"datePublished": "2026-05-28T09:40:48.689Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-10-21T12:41:27.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43204 (GCVE-0-2026-43204)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6asm: drop DSP responses for closed data streams
'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses
after closing")' attempted to ignore DSP responses arriving
after a stream had been closed.
However, those responses were still handled, causing lockups.
Fix this by unconditionally dropping all DSP responses associated with
closed data streams.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 68fd8480bb7baaf361e983f75d8571f25e017c67 Version: 68fd8480bb7baaf361e983f75d8571f25e017c67 Version: 68fd8480bb7baaf361e983f75d8571f25e017c67 Version: 68fd8480bb7baaf361e983f75d8571f25e017c67 Version: 68fd8480bb7baaf361e983f75d8571f25e017c67 Version: 68fd8480bb7baaf361e983f75d8571f25e017c67 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6asm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "750b468d8e0ba0ba1774a0da55b950dc23ffda67",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
},
{
"lessThan": "414396c42ef20d2d0c9213adaf4dfa59490ca077",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
},
{
"lessThan": "c0b69245263ffa3db6f1be6e068528578fde635b",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
},
{
"lessThan": "3a409a64b2d61430c63cbb15d51681f13b8b0acd",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
},
{
"lessThan": "3249251eac6081d5169ba09f2d9cca66ab0cab0d",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
},
{
"lessThan": "8a066a81ee0c1b6cdbd81393536c3b2d19ccef25",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6asm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6asm: drop DSP responses for closed data streams\n\n\u0027Commit a354f030dbce (\"ASoC: qcom: q6asm: handle the responses\nafter closing\")\u0027 attempted to ignore DSP responses arriving\nafter a stream had been closed.\n\nHowever, those responses were still handled, causing lockups.\n\nFix this by unconditionally dropping all DSP responses associated with\nclosed data streams."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:09.149Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/750b468d8e0ba0ba1774a0da55b950dc23ffda67"
},
{
"url": "https://git.kernel.org/stable/c/414396c42ef20d2d0c9213adaf4dfa59490ca077"
},
{
"url": "https://git.kernel.org/stable/c/c0b69245263ffa3db6f1be6e068528578fde635b"
},
{
"url": "https://git.kernel.org/stable/c/3a409a64b2d61430c63cbb15d51681f13b8b0acd"
},
{
"url": "https://git.kernel.org/stable/c/3249251eac6081d5169ba09f2d9cca66ab0cab0d"
},
{
"url": "https://git.kernel.org/stable/c/8a066a81ee0c1b6cdbd81393536c3b2d19ccef25"
}
],
"title": "ASoC: qcom: q6asm: drop DSP responses for closed data streams",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43204",
"datePublished": "2026-05-06T11:28:09.617Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-10-30T12:25:09.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72329 (GCVE-0-2026-72329)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/liquidio: drop cached VF pci_dev LUT
The PF SR-IOV enable path caches VF pci_dev pointers in
dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those
entries do not own a reference, because the iterator drops the previous
device reference on each step. The cached pointer is then dereferenced
later when handling OCTEON_VF_FLR_REQUEST.
Replace the cached VF mapping with runtime lookup on the mailbox DPI
ring: derive the VF index from q_no, resolve the VF via exported PCI
IOV helpers, validate it with the PF pointer and VF ID, then issue
pcie_flr() and drop the reference with pci_dev_put(). Remove the
unused VF lookup table initialization and cleanup.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ca6139ffc67ee6ef0459f81e37894ed411083855 Version: ca6139ffc67ee6ef0459f81e37894ed411083855 Version: ca6139ffc67ee6ef0459f81e37894ed411083855 Version: ca6139ffc67ee6ef0459f81e37894ed411083855 Version: ca6139ffc67ee6ef0459f81e37894ed411083855 Version: ca6139ffc67ee6ef0459f81e37894ed411083855 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:47:03.690749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:18.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cavium/liquidio/lio_main.c",
"drivers/net/ethernet/cavium/liquidio/octeon_device.h",
"drivers/net/ethernet/cavium/liquidio/octeon_mailbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4ec87796fadf5a631ee6513c258c0e3d9ca62f79",
"status": "affected",
"version": "ca6139ffc67ee6ef0459f81e37894ed411083855",
"versionType": "git"
},
{
"lessThan": "e3b20de8d7c06c8f1a0ded1e52be9d282609c3da",
"status": "affected",
"version": "ca6139ffc67ee6ef0459f81e37894ed411083855",
"versionType": "git"
},
{
"lessThan": "1cf5c6a80adc31456f3e93b2922a2446fd63e2c4",
"status": "affected",
"version": "ca6139ffc67ee6ef0459f81e37894ed411083855",
"versionType": "git"
},
{
"lessThan": "08ff33dce6f91510bb296a753a232db0ca3fd3d8",
"status": "affected",
"version": "ca6139ffc67ee6ef0459f81e37894ed411083855",
"versionType": "git"
},
{
"lessThan": "81acef3a247fd523513a2e9f71de1c167bc0f882",
"status": "affected",
"version": "ca6139ffc67ee6ef0459f81e37894ed411083855",
"versionType": "git"
},
{
"lessThan": "5c0e3ba4f500fd4314ceb42f07f16bc445156431",
"status": "affected",
"version": "ca6139ffc67ee6ef0459f81e37894ed411083855",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cavium/liquidio/lio_main.c",
"drivers/net/ethernet/cavium/liquidio/octeon_device.h",
"drivers/net/ethernet/cavium/liquidio/octeon_mailbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/liquidio: drop cached VF pci_dev LUT\n\nThe PF SR-IOV enable path caches VF pci_dev pointers in\ndpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those\nentries do not own a reference, because the iterator drops the previous\ndevice reference on each step. The cached pointer is then dereferenced\nlater when handling OCTEON_VF_FLR_REQUEST.\n\nReplace the cached VF mapping with runtime lookup on the mailbox DPI\nring: derive the VF index from q_no, resolve the VF via exported PCI\nIOV helpers, validate it with the PF pointer and VF ID, then issue\npcie_flr() and drop the reference with pci_dev_put(). Remove the\nunused VF lookup table initialization and cleanup."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the Cavium LiquidIO CN23XX PF driver handling OCTEON_VF_FLR_REQUEST over the PCIe SR-IOV hardware mailbox, not via network packets; exploitation requires code running against an assigned VF (e.g., a cloud VM with SR-IOV passthrough).\nAC:L - VF pci_dev pointers in dpiring_to_vfpcidev_lut[] are stale immediately after SR-IOV enable because pci_get_device() drops references during iteration; an attacker controlling VF driver teardown can reliably send OCTEON_VF_FLR_REQUEST and repeat FLR attempts to influence heap reuse.\nPR:N - In the highest-impact deployment (multi-tenant cloud with VF passthrough), a tenant needs no host administrator privileges\u2014only control of the assigned VF from within their VM\u2014to trigger PF mailbox processing and pcie_flr() on the dangling pci_dev.\nUI:N - No victim interaction is required; triggering VF driver removal or module unload during octeon_destroy_resources() automatically sends the FLR mailbox request to the PF without any user action on the host.\nS:C - The vulnerable PF driver executes in the host kernel but is triggered from an isolated VF guest/tenant via the SR-IOV mailbox, crossing the VM/tenant security boundary into host kernel context.\nC:H - This is a use-after-free of struct pci_dev; pcie_flr() and pci_dev_reset_iommu_prepare() dereference freed pci_dev fields, enabling arbitrary kernel memory disclosure if the attacker reclaims the object via heap spraying.\nI:H - UAF of pci_dev causes pcie_flr() to issue PCI Express FLR config writes and IOMMU blocking on attacker-influenced memory, providing memory corruption primitives that can be leveraged for arbitrary kernel write or code execution.\nA:H - Dereferencing a stale pci_dev in pcie_flr() can oops or panic the host kernel, and issuing FLR/IOMMU operations against the wrong PCI function can disrupt host networking and device availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:05.019Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4ec87796fadf5a631ee6513c258c0e3d9ca62f79"
},
{
"url": "https://git.kernel.org/stable/c/e3b20de8d7c06c8f1a0ded1e52be9d282609c3da"
},
{
"url": "https://git.kernel.org/stable/c/1cf5c6a80adc31456f3e93b2922a2446fd63e2c4"
},
{
"url": "https://git.kernel.org/stable/c/08ff33dce6f91510bb296a753a232db0ca3fd3d8"
},
{
"url": "https://git.kernel.org/stable/c/81acef3a247fd523513a2e9f71de1c167bc0f882"
},
{
"url": "https://git.kernel.org/stable/c/5c0e3ba4f500fd4314ceb42f07f16bc445156431"
}
],
"title": "net/liquidio: drop cached VF pci_dev LUT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72329",
"datePublished": "2026-08-15T05:55:39.931Z",
"dateReserved": "2026-08-09T03:40:39.919Z",
"dateUpdated": "2026-10-30T12:29:05.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31493 (GCVE-0-2026-31493)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-11-05 21:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/efa: Fix use of completion ctx after free
On admin queue completion handling, if the admin command completed with
error we print data from the completion context. The issue is that we
already freed the completion context in polling/interrupts handler which
means we print data from context in an unknown state (it might be
already used again).
Change the admin submission flow so alloc/dealloc of the context will be
symmetric and dealloc will be called after any potential use of the
context.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:35:16.910245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:45:02.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/efa/efa_com.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c24b5179af260a5f36571c992d29aab1f448544",
"status": "affected",
"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a",
"versionType": "git"
},
{
"lessThan": "7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5",
"status": "affected",
"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a",
"versionType": "git"
},
{
"lessThan": "0dd98aea1c0c45987fa2dd92f988b0eb1a72c125",
"status": "affected",
"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a",
"versionType": "git"
},
{
"lessThan": "1cf95fe5dc5471efea947b4c6f8913da6bc7976e",
"status": "affected",
"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a",
"versionType": "git"
},
{
"lessThan": "ef3b06742c8a201d0e83edc9a33a89a4fe3009f8",
"status": "affected",
"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/efa/efa_com.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:20.213Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544"
},
{
"url": "https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5"
},
{
"url": "https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125"
},
{
"url": "https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e"
},
{
"url": "https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"
}
],
"title": "RDMA/efa: Fix use of completion ctx after free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31493",
"datePublished": "2026-04-22T13:54:16.255Z",
"dateReserved": "2026-03-09T15:48:24.102Z",
"dateUpdated": "2026-11-05T21:45:02.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89811 (GCVE-0-2026-89811)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
MES (Micro Engine Scheduler) does not perform heavy-weight TLB
invalidation after unmapping queues, unlike HWS which does this
automatically. This causes a race condition where in-flight DMA
descriptors can access memory that has been unmapped, leading to page
faults and GPU queue hangs during SVM page migration.
The issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest
failures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU
compute queue hangs with packets submitted but never consumed.
Add kfd_flush_tlb() calls after MES queue removal in two locations:
- evict_process_queues_cpsch(): after all queues removed during eviction
- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)
This ensures all in-flight memory accesses from unmapped queues are
flushed before memory is freed or migrated.
(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cc009e613de6560eb499f8bc92c80a737752cb30 Version: cc009e613de6560eb499f8bc92c80a737752cb30 Version: cc009e613de6560eb499f8bc92c80a737752cb30 Version: cc009e613de6560eb499f8bc92c80a737752cb30 Version: cc009e613de6560eb499f8bc92c80a737752cb30 Version: cc009e613de6560eb499f8bc92c80a737752cb30 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "750cd793ee69c27faf17fb9c49f92f71716bbc8b",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "e230c546ed93741833ab5babb0b202f9c2052b45",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "6aae545c87087e4dc96e205452243813bfa73ba2",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add TLB flush after MES queue eviction/suspension\n\nMES (Micro Engine Scheduler) does not perform heavy-weight TLB\ninvalidation after unmapping queues, unlike HWS which does this\nautomatically. This causes a race condition where in-flight DMA\ndescriptors can access memory that has been unmapped, leading to page\nfaults and GPU queue hangs during SVM page migration.\n\nThe issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest\nfailures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU\ncompute queue hangs with packets submitted but never consumed.\n\nAdd kfd_flush_tlb() calls after MES queue removal in two locations:\n- evict_process_queues_cpsch(): after all queues removed during eviction\n- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)\n\nThis ensures all in-flight memory accesses from unmapped queues are\nflushed before memory is freed or migrated.\n\n(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local /dev/kfd paths: AMDKFD_IOC_CREATE_QUEUE plus SVM/userptr activity (AMDKFD_IOC_SVM, munmap of USERPTR BOs) or KFD_IOC_DBG_TRAP_SUSPEND_QUEUES, which call evict_process_queues_cpsch()/suspend_queues(); there is no network, adjacent-wireless, or physical-device path.\nAC:L - The attacker controls both sides of the race: they keep DMA in flight on their own MES compute/SDMA queues while concurrently forcing eviction or suspend via SVM migration, userptr MMU notifiers, TTM pressure, or self-debug suspend, matching the MultiThreadMigrationTest trigger with no victim timing or uncontrollable layout required.\nPR:L - kfd_open() and the CREATE_QUEUE/SVM/DBG_TRAP ioctls perform no capability checks; a local unprivileged user with typical render/video-group access to /dev/kfd and /dev/dri/renderD* on desktops, ROCm nodes, and multi-tenant AMD GPU clouds is sufficient, not init-namespace root.\nUI:N - The attacker opens their own KFD and DRM render-node descriptors, submits compute work, and triggers queue eviction or suspend in that same process; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:C - MES queue removal omits the heavyweight PASID TLB invalidation HWS performs, so in-flight GPU DMA can use stale GPUVM translations to physical pages after they are unmapped, freed, or migrated, bypassing the GPUVM/PASID DMA isolation boundary that is supposed to confine GPU access.\nC:H - In-flight GPU DMA through stale GPUVM TLB entries can read physical pages after they leave the process mapping and are recycled to the page allocator, kernel, or another process, giving an arbitrary memory-disclosure primitive.\nI:H - The same stale translations allow GPU DMA writes into those recycled physical pages, enabling arbitrary memory corruption and control-flow hijacking through a device DMA write primitive.\nA:H - The issue is documented to cause GPU page faults and compute-queue hangs (packets submitted but never consumed), which can stall the shared GPU and force amdgpu reset, denying compute service to all co-located workloads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:08.863Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/750cd793ee69c27faf17fb9c49f92f71716bbc8b"
},
{
"url": "https://git.kernel.org/stable/c/5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1"
},
{
"url": "https://git.kernel.org/stable/c/bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372"
},
{
"url": "https://git.kernel.org/stable/c/e230c546ed93741833ab5babb0b202f9c2052b45"
},
{
"url": "https://git.kernel.org/stable/c/6aae545c87087e4dc96e205452243813bfa73ba2"
},
{
"url": "https://git.kernel.org/stable/c/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4"
}
],
"title": "drm/amdkfd: Add TLB flush after MES queue eviction/suspension",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89811",
"datePublished": "2026-09-16T10:30:44.274Z",
"dateReserved": "2026-09-11T19:38:34.768Z",
"dateUpdated": "2026-10-30T12:33:08.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90421 (GCVE-0-2026-90421)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix UAF when probe runs concurrent to dyn ID removal
Dynamic IDs are only guaranteed to be valid when dynids.lock is held,
as remove_id_store() can free the node. Thus, make a copy in
pci_match_device(). Also, clarify that the id parameter is only valid
during probe.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0994375e9614f78657031e04e30019b9cdb62795 Version: 0994375e9614f78657031e04e30019b9cdb62795 Version: 0994375e9614f78657031e04e30019b9cdb62795 Version: 0994375e9614f78657031e04e30019b9cdb62795 Version: 0994375e9614f78657031e04e30019b9cdb62795 Version: 0994375e9614f78657031e04e30019b9cdb62795 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci-driver.c",
"include/linux/pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "74133e74619d108eeaaa787d78906314d7a7b077",
"status": "affected",
"version": "0994375e9614f78657031e04e30019b9cdb62795",
"versionType": "git"
},
{
"lessThan": "d867db0a2602919510f346bc555f7b3093f6b6cc",
"status": "affected",
"version": "0994375e9614f78657031e04e30019b9cdb62795",
"versionType": "git"
},
{
"lessThan": "2cbcb0819c6367e1d5b0792a960594cc19576e23",
"status": "affected",
"version": "0994375e9614f78657031e04e30019b9cdb62795",
"versionType": "git"
},
{
"lessThan": "c36816feff47f676dcc51919777d483f4146c1ee",
"status": "affected",
"version": "0994375e9614f78657031e04e30019b9cdb62795",
"versionType": "git"
},
{
"lessThan": "42a5661ff7e4c7d3c5025d0f8e5079fb5479ea49",
"status": "affected",
"version": "0994375e9614f78657031e04e30019b9cdb62795",
"versionType": "git"
},
{
"lessThan": "3ffc4c9690c33ee28cdb3d0182b12f9c623e3acc",
"status": "affected",
"version": "0994375e9614f78657031e04e30019b9cdb62795",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci-driver.c",
"include/linux/pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix UAF when probe runs concurrent to dyn ID removal\n\nDynamic IDs are only guaranteed to be valid when dynids.lock is held,\nas remove_id_store() can free the node. Thus, make a copy in\npci_match_device(). Also, clarify that the id parameter is only valid\nduring probe."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:34.567Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/74133e74619d108eeaaa787d78906314d7a7b077"
},
{
"url": "https://git.kernel.org/stable/c/d867db0a2602919510f346bc555f7b3093f6b6cc"
},
{
"url": "https://git.kernel.org/stable/c/2cbcb0819c6367e1d5b0792a960594cc19576e23"
},
{
"url": "https://git.kernel.org/stable/c/c36816feff47f676dcc51919777d483f4146c1ee"
},
{
"url": "https://git.kernel.org/stable/c/42a5661ff7e4c7d3c5025d0f8e5079fb5479ea49"
},
{
"url": "https://git.kernel.org/stable/c/3ffc4c9690c33ee28cdb3d0182b12f9c623e3acc"
}
],
"title": "PCI: Fix UAF when probe runs concurrent to dyn ID removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90421",
"datePublished": "2026-09-17T16:09:45.185Z",
"dateReserved": "2026-09-11T19:38:34.814Z",
"dateUpdated": "2026-10-30T12:35:34.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90424 (GCVE-0-2026-90424)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits
it, and preallocates its logical VCMDQs. Two of its error paths leak.
When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the
cmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach
it; free it directly there.
A later VCMDQ preallocation failure instead leaves VINTF0 published, and so
this time the unwind does reach tegra241_cmdqv_remove_vintf(), which then
frees it from vintf->hyp_own. But tegra241_vintf_hw_init() sets that flag
only afterward, from a HW read-back, so the still-uninited VINTF0 reads as
guest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields
it never set up.
Decide ownership from vintf->idx instead, the index assigned when its id is
allocated: idx 0 is the kernel-owned VINTF0, while idx >= 1 marks a guest
VINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and
tegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure
HW-readback state.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05a1405d0cba3d8253261b02eb65e5cd3ca09ab3",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
},
{
"lessThan": "1d2271d7df5230e4ce36bdafd17524bd004f3b3f",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
},
{
"lessThan": "417190bde0fda4ee857999a722ca90163fbec587",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
},
{
"lessThan": "f40f3144477314b489e4bc209c06cb51679fe82b",
"status": "affected",
"version": "918eb5c856f6ce4cf93b4b38e4b5e156905c5943",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path\n\ntegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits\nit, and preallocates its logical VCMDQs. Two of its error paths leak.\n\nWhen tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the\ncmdqv-\u003evintfs[] array, so the devres unwind on probe failure cannot reach\nit; free it directly there.\n\nA later VCMDQ preallocation failure instead leaves VINTF0 published, and so\nthis time the unwind does reach tegra241_cmdqv_remove_vintf(), which then\nfrees it from vintf-\u003ehyp_own. But tegra241_vintf_hw_init() sets that flag\nonly afterward, from a HW read-back, so the still-uninited VINTF0 reads as\nguest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields\nit never set up.\n\nDecide ownership from vintf-\u003eidx instead, the index assigned when its id is\nallocated: idx 0 is the kernel-owned VINTF0, while idx \u003e= 1 marks a guest\nVINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and\ntegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure\nHW-readback state."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:36.906Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05a1405d0cba3d8253261b02eb65e5cd3ca09ab3"
},
{
"url": "https://git.kernel.org/stable/c/1d2271d7df5230e4ce36bdafd17524bd004f3b3f"
},
{
"url": "https://git.kernel.org/stable/c/417190bde0fda4ee857999a722ca90163fbec587"
},
{
"url": "https://git.kernel.org/stable/c/f40f3144477314b489e4bc209c06cb51679fe82b"
}
],
"title": "iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90424",
"datePublished": "2026-09-17T16:09:47.165Z",
"dateReserved": "2026-09-11T19:38:34.814Z",
"dateUpdated": "2026-10-21T12:51:36.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46171 (GCVE-0-2026-46171)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
riscv: kvm: fix vector context allocation leak
When the second kzalloc (host_context.vector.datap) fails in
kvm_riscv_vcpu_alloc_vector_context, the first allocation
(guest_context.vector.datap) is leaked. Free it before returning.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/vcpu_vector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8f3a5dc4055e1001b44ca8ae2bd3eb1d07782049",
"status": "affected",
"version": "0f4b82579716b12bb88257bd7ea80f25c791fb2c",
"versionType": "git"
},
{
"lessThan": "70ecebe7c58ce01f8da3f513eafb51bd147b1e63",
"status": "affected",
"version": "0f4b82579716b12bb88257bd7ea80f25c791fb2c",
"versionType": "git"
},
{
"lessThan": "bd62c0f61bc722a097417401030c596cea8e21aa",
"status": "affected",
"version": "0f4b82579716b12bb88257bd7ea80f25c791fb2c",
"versionType": "git"
},
{
"lessThan": "1d57ab45ec5c0e22789de793bcf2a31ad6fb7d98",
"status": "affected",
"version": "0f4b82579716b12bb88257bd7ea80f25c791fb2c",
"versionType": "git"
},
{
"lessThan": "b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978",
"status": "affected",
"version": "0f4b82579716b12bb88257bd7ea80f25c791fb2c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/vcpu_vector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: kvm: fix vector context allocation leak\n\nWhen the second kzalloc (host_context.vector.datap) fails in\nkvm_riscv_vcpu_alloc_vector_context, the first allocation\n(guest_context.vector.datap) is leaked. Free it before returning."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:22.651Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8f3a5dc4055e1001b44ca8ae2bd3eb1d07782049"
},
{
"url": "https://git.kernel.org/stable/c/70ecebe7c58ce01f8da3f513eafb51bd147b1e63"
},
{
"url": "https://git.kernel.org/stable/c/bd62c0f61bc722a097417401030c596cea8e21aa"
},
{
"url": "https://git.kernel.org/stable/c/1d57ab45ec5c0e22789de793bcf2a31ad6fb7d98"
},
{
"url": "https://git.kernel.org/stable/c/b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978"
}
],
"title": "riscv: kvm: fix vector context allocation leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46171",
"datePublished": "2026-05-28T09:36:25.966Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-10-21T12:41:22.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74374 (GCVE-0-2026-74374)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: fix error-path detection with md_cloned_bio()
Detect the error path using md_cloned_bio() instead of relying
on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be
NULL or -1 after splitting and resubmitting a failed bio.
As a result, the error path may not be recognized and memory
allocations can incorrectly use GFP_NOIO instead of
(GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under
memory pressure.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:54:43.023630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:36.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c",
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "80eaeae0e4b1ed2418fd2b9088238651fb51df69",
"status": "affected",
"version": "689389a06ce79fdced85b5115717f71c71e623e0",
"versionType": "git"
},
{
"lessThan": "8719aa0f57955fd641f952d16e02fc6b4934c6e3",
"status": "affected",
"version": "689389a06ce79fdced85b5115717f71c71e623e0",
"versionType": "git"
},
{
"lessThan": "029b363c9b690613141338436ac91366b1928af2",
"status": "affected",
"version": "689389a06ce79fdced85b5115717f71c71e623e0",
"versionType": "git"
},
{
"lessThan": "20fb582c92fd64e5c8bd83c6176264b2794603b7",
"status": "affected",
"version": "689389a06ce79fdced85b5115717f71c71e623e0",
"versionType": "git"
},
{
"lessThan": "811545e0926d02a6a0b1a1258bb5544777c164d4",
"status": "affected",
"version": "689389a06ce79fdced85b5115717f71c71e623e0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c",
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: fix error-path detection with md_cloned_bio()\n\nDetect the error path using md_cloned_bio() instead of relying\non r1_bio in raid1 or r10_bio-\u003eread_slot in raid10, which may be\nNULL or -1 after splitting and resubmitting a failed bio.\n\nAs a result, the error path may not be recognized and memory\nallocations can incorrectly use GFP_NOIO instead of\n(GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under\nmemory pressure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Linux file/NAS servers commonly export md RAID1/RAID10 volumes via nfsd, ksmbd, or iSCSI; remote client reads reach md_submit_bio()\u2192raid1/raid10_read_request(), and mirror read failures drive handle_read_error() on the blocked raid1d/raid10d thread without local shell access.\nAC:L - An attacker can reliably hit the bug by reading sectors on a degraded mirror that return errors (common on production arrays), issuing large reads that bio_submit_split_bioset() splits on the error-retry path, and concurrently applying memory pressure so GFP_NOIO bio_alloc_clone() blocks reclaim while raid1d/raid10d holds the array frozen.\nPR:N - Triggering the fault path requires only permission to read exported storage or files on an md-backed filesystem; no CAP_SYS_ADMIN, md ioctl, or init-namespace root is needed because read I/O and mirror error recovery run with no extra capability checks beyond normal block-device access.\nUI:N - No victim interaction is required; exploitation uses the attacker\u0027s own read I/O (or scripted NFS/SMB/iSCSI reads) together with memory pressure, without anyone mounting disks, acknowledging bad blocks, or performing other cooperative actions.\nS:U - The circular GFP_NOIO allocation wait while raid1d/raid10d is blocked in handle_read_error() freezes I/O within the same host kernel and md security domain; it does not cross VM, container, or IOMMU boundaries.\nC:N - This is a GFP-flag misclassification causing reclaim/I/O circular wait (deadlock), not memory corruption, out-of-bounds access, use-after-free, or other primitives that could disclose kernel or user data.\nI:N - The flaw does not enable arbitrary writes, code execution, or silent data modification; impact is limited to blocking forward progress in the RAID error-recovery path under memory pressure.\nA:H - Without __GFP_HIGH on the error path, bio_alloc_clone() can stall reclaim while raid1d/raid10d blocks with the array frozen, deadlocking all I/O to the md device and potentially hanging root/data volumes on enterprise RAID1/RAID10 servers."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:31.666Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/80eaeae0e4b1ed2418fd2b9088238651fb51df69"
},
{
"url": "https://git.kernel.org/stable/c/8719aa0f57955fd641f952d16e02fc6b4934c6e3"
},
{
"url": "https://git.kernel.org/stable/c/029b363c9b690613141338436ac91366b1928af2"
},
{
"url": "https://git.kernel.org/stable/c/20fb582c92fd64e5c8bd83c6176264b2794603b7"
},
{
"url": "https://git.kernel.org/stable/c/811545e0926d02a6a0b1a1258bb5544777c164d4"
}
],
"title": "md/raid1,raid10: fix error-path detection with md_cloned_bio()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74374",
"datePublished": "2026-08-15T05:58:53.659Z",
"dateReserved": "2026-08-15T05:44:03.889Z",
"dateUpdated": "2026-10-21T12:45:31.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43213 (GCVE-0-2026-43213)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: validate sequence number of TX release report
Hardware rarely reports abnormal sequence number in TX release report,
which will access out-of-bounds of wd_ring->pages array, causing NULL
pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U
6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)
Call Trace:
<IRQ>
rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]
rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]
net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759
handle_softirqs+0xbe/0x290 kernel/softirq.c:601
? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]
__local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423
</IRQ>
<TASK>
rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]
? irq_thread+0xa7/0x340 kernel/irq/manage.c:0
irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314
? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202
? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220
kthread+0xea/0x110 kernel/kthread.c:376
? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287
? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
To prevent crash, validate rpp_info.seq before using.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd Version: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd Version: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd Version: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd Version: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd Version: e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:15:48.810008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:16:24.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "973392ea942a8a2981724c2c230972c8eb3cb703",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "c0da84e308a0b0b51cd234168a9d84be4a3c5c50",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "0fe36044267c3c70d0471d2109c34f805c975154",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "ef7fa19809b2d892d45da53f90ac698d13c367fd",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "b342dd13aedccb0dd27365f6cc63a262f42394ce",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "957eda596c7665f2966970fd1dcc35fe299b38e8",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate sequence number of TX release report\n\nHardware rarely reports abnormal sequence number in TX release report,\nwhich will access out-of-bounds of wd_ring-\u003epages array, causing NULL\npointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U\n 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n Call Trace:\n \u003cIRQ\u003e\n rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n kthread+0xea/0x110 kernel/kthread.c:376\n ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n \u003c/TASK\u003e\n\nTo prevent crash, validate rpp_info.seq before using."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is the rtw89 PCI WiFi TX release-report path reached from the device RPQ interrupt/NAPI handler after wireless transmissions. In AP or client deployments, an unauthenticated radio-range attacker can plausibly induce repeated TX completions by injecting or eliciting WiFi traffic.\nAC:H - The code path is deterministic once a malformed release report with an out-of-range sequence number is produced. However, the malformed sequence is described as a rare hardware/firmware report and is not directly chosen by the attacker.\nPR:N - In the adjacent WiFi attack scenario, the attacker does not need local accounts, capabilities, or authenticated access to the target host. Radio proximity is sufficient to stimulate the vulnerable TX completion path.\nUI:N - No victim action is required once the affected WiFi interface is active. The vulnerable processing occurs asynchronously in interrupt/NAPI context.\nS:U - The impact remains within the kernel and the affected host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The invalid 15-bit sequence number indexes past the 512-entry wd_ring-\u003epages array and causes adjacent kernel memory to be interpreted as TX descriptor/list/queue state. Conservatively, this out-of-bounds kernel memory access can expose sensitive kernel memory even though the observed failure is a NULL dereference.\nI:H - The out-of-bounds pseudo-TX descriptor can drive list, skb queue, DMA-unmap, status, and enqueue operations using invalid pointer fields. Conservatively, this kernel memory corruption can permit high-integrity impact.\nA:H - The fix commit documents a kernel NULL pointer dereference and oops in rtw89_pci_release_tx from this bug. A kernel crash or panic is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:10.203Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/973392ea942a8a2981724c2c230972c8eb3cb703"
},
{
"url": "https://git.kernel.org/stable/c/c0da84e308a0b0b51cd234168a9d84be4a3c5c50"
},
{
"url": "https://git.kernel.org/stable/c/0fe36044267c3c70d0471d2109c34f805c975154"
},
{
"url": "https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd"
},
{
"url": "https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce"
},
{
"url": "https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8"
}
],
"title": "wifi: rtw89: pci: validate sequence number of TX release report",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43213",
"datePublished": "2026-05-06T11:28:15.998Z",
"dateReserved": "2026-05-01T14:12:55.993Z",
"dateUpdated": "2026-10-30T12:25:10.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72404 (GCVE-0-2026-72404)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
TIPC UDP media bearer teardown calls dst_cache_destroy() on its
replicast caches before calling synchronize_net() to wait for
concurrent RCU readers (transmitters) to finish:
static void cleanup_bearer(struct work_struct *work)
{
...
list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
dst_cache_destroy(&rcast->dst_cache);
list_del_rcu(&rcast->list);
kfree_rcu(rcast, rcu);
}
...
dst_cache_destroy(&ub->rcast.dst_cache);
udp_tunnel_sock_release(ub->sk);
synchronize_net();
...
}
This is highly buggy because dst_cache_destroy() immediately frees the
per-CPU cache memory (free_percpu()) and releases the cached dst
entries without any synchronization.
If a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another
CPU under RCU protection, it can call dst_cache_get() concurrently,
leading to:
1. Use-After-Free on the per-CPU cache pointer itself (crash).
2. "rcuref - imbalanced put()" warning if it attempts to release a
dst that was concurrently released by dst_cache_destroy().
Furthermore, calling kfree(ub) immediately after synchronize_net() without
closing the socket first (or waiting after closing it) leaves a window
where a concurrent receiver (tipc_udp_recv()) could start after
synchronize_net(), access ub, and suffer a UAF when kfree(ub) runs.
To fix this, we must defer dst_cache_destroy() and kfree(ub) until after
we have ensured that no more readers can see the bearer/socket and all
existing readers have finished:
1. Defer rcast entry destruction (both dst_cache_destroy() and kfree())
to an RCU callback using call_rcu_hurry().
Using call_rcu_hurry() ensures the dst entries are released quickly.
2. Release the bearer socket using udp_tunnel_sock_release() (stops
new receive readers).
3. Call synchronize_net() to wait for all outstanding RCU readers
(both transmit and receive) to finish.
4. Now that it is safe, call dst_cache_destroy() on the main bearer
cache, and free ub.
Note: 3) and 4) can be changed later in net-next to also use
call_rcu_hurry() and get rid of the synchronize_net() latency.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9c1a793210f29f32ee4cf048e04d7d9bb3221cc Version: e9c1a793210f29f32ee4cf048e04d7d9bb3221cc Version: e9c1a793210f29f32ee4cf048e04d7d9bb3221cc Version: e9c1a793210f29f32ee4cf048e04d7d9bb3221cc Version: e9c1a793210f29f32ee4cf048e04d7d9bb3221cc Version: e9c1a793210f29f32ee4cf048e04d7d9bb3221cc |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:49:02.601623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:21.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/udp_media.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5a66ca574eee958123ee9d2822683964d42d656a",
"status": "affected",
"version": "e9c1a793210f29f32ee4cf048e04d7d9bb3221cc",
"versionType": "git"
},
{
"lessThan": "6aeb4ba4fb098199e13723cfd04d9a749741f731",
"status": "affected",
"version": "e9c1a793210f29f32ee4cf048e04d7d9bb3221cc",
"versionType": "git"
},
{
"lessThan": "6b0e29f7662c237e717f35dad746efe94715d0da",
"status": "affected",
"version": "e9c1a793210f29f32ee4cf048e04d7d9bb3221cc",
"versionType": "git"
},
{
"lessThan": "3827ff67f9fbecd1086e33d23693ef6a1a9c6c38",
"status": "affected",
"version": "e9c1a793210f29f32ee4cf048e04d7d9bb3221cc",
"versionType": "git"
},
{
"lessThan": "1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c",
"status": "affected",
"version": "e9c1a793210f29f32ee4cf048e04d7d9bb3221cc",
"versionType": "git"
},
{
"lessThan": "7116764ca53ff529335d7ab7c364a69f094b23a5",
"status": "affected",
"version": "e9c1a793210f29f32ee4cf048e04d7d9bb3221cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/udp_media.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()\n\nTIPC UDP media bearer teardown calls dst_cache_destroy() on its\nreplicast caches before calling synchronize_net() to wait for\nconcurrent RCU readers (transmitters) to finish:\n\nstatic void cleanup_bearer(struct work_struct *work)\n{\n...\n\tlist_for_each_entry_safe(rcast, tmp, \u0026ub-\u003ercast.list, list) {\n\t\tdst_cache_destroy(\u0026rcast-\u003edst_cache);\n\t\tlist_del_rcu(\u0026rcast-\u003elist);\n\t\tkfree_rcu(rcast, rcu);\n\t}\n...\n\tdst_cache_destroy(\u0026ub-\u003ercast.dst_cache);\n\tudp_tunnel_sock_release(ub-\u003esk);\n\tsynchronize_net();\n...\n}\n\nThis is highly buggy because dst_cache_destroy() immediately frees the\nper-CPU cache memory (free_percpu()) and releases the cached dst\nentries without any synchronization.\n\nIf a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another\nCPU under RCU protection, it can call dst_cache_get() concurrently,\nleading to:\n1. Use-After-Free on the per-CPU cache pointer itself (crash).\n2. \"rcuref - imbalanced put()\" warning if it attempts to release a\n dst that was concurrently released by dst_cache_destroy().\n\nFurthermore, calling kfree(ub) immediately after synchronize_net() without\nclosing the socket first (or waiting after closing it) leaves a window\nwhere a concurrent receiver (tipc_udp_recv()) could start after\nsynchronize_net(), access ub, and suffer a UAF when kfree(ub) runs.\n\nTo fix this, we must defer dst_cache_destroy() and kfree(ub) until after\nwe have ensured that no more readers can see the bearer/socket and all\nexisting readers have finished:\n\n1. Defer rcast entry destruction (both dst_cache_destroy() and kfree())\n to an RCU callback using call_rcu_hurry().\n Using call_rcu_hurry() ensures the dst entries are released quickly.\n\n2. Release the bearer socket using udp_tunnel_sock_release() (stops\n new receive readers).\n\n3. Call synchronize_net() to wait for all outstanding RCU readers\n (both transmit and receive) to finish.\n\n4. Now that it is safe, call dst_cache_destroy() on the main bearer\n cache, and free ub.\n\nNote: 3) and 4) can be changed later in net-next to also use\ncall_rcu_hurry() and get rid of the synchronize_net() latency."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in cleanup_bearer() during UDP bearer teardown, reached only via TIPC genetlink bearer disable (TIPC_NL_BEARER_DISABLE) or network-namespace exit; remote UDP/TIPC peers cannot initiate teardown, so exploitation requires local netlink/netns access even though concurrent xmit/recv may involve network I/O.\nAC:L - An attacker with namespace CAP_NET_ADMIN can script both teardown and concurrent traffic (enable/disable bearer or destroy netns while sending/receiving TIPC UDP on port 6118), controlling both sides of the RCU race; dst_cache_destroy()\u0027s free_percpu() widens the window and syzbot triggered it reliably.\nPR:L - Bearer disable/enable and netns teardown require CAP_NET_ADMIN; TIPC genetlink ops use GENL_UNS_ADMIN_PERM and tipc_genl_family.netnsok=true, so unprivileged users obtain effective net-admin capability via user/network namespaces (unshare -Urn).\nUI:N - Exploitation needs no victim interaction beyond the attacker\u0027s own namespace/netlink operations and packet generation; no mount, file open, or other user-directed action is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain; impacts are kernel crash or local privilege escalation, not VM escape or cross-security-authority boundary crossing.\nC:H - Premature dst_cache_destroy() frees per-CPU cache memory while concurrent tipc_udp_xmit() may call dst_cache_get() on the freed object, and the post-synchronize_net() recv path dereferences freed udp_bearer, enabling kernel memory disclosure.\nI:H - UAF on dst_cache structures and udp_bearer allows heap shaping and control of freed-object contents, providing primitives for arbitrary kernel writes and potential control-flow hijacking/local privilege escalation.\nA:H - Concurrent use-after-free reliably causes kernel oops/panic (per commit: UAF on per-CPU cache pointer crashes) and can be triggered repeatedly during scripted bearer teardown loops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:17.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5a66ca574eee958123ee9d2822683964d42d656a"
},
{
"url": "https://git.kernel.org/stable/c/6aeb4ba4fb098199e13723cfd04d9a749741f731"
},
{
"url": "https://git.kernel.org/stable/c/6b0e29f7662c237e717f35dad746efe94715d0da"
},
{
"url": "https://git.kernel.org/stable/c/3827ff67f9fbecd1086e33d23693ef6a1a9c6c38"
},
{
"url": "https://git.kernel.org/stable/c/1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c"
},
{
"url": "https://git.kernel.org/stable/c/7116764ca53ff529335d7ab7c364a69f094b23a5"
}
],
"title": "tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72404",
"datePublished": "2026-08-15T05:56:28.124Z",
"dateReserved": "2026-08-09T03:40:39.925Z",
"dateUpdated": "2026-10-30T12:29:17.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89648 (GCVE-0-2026-89648)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: cap delegated inode count in ceph_parse_deleg_inos()
ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers
from an MDS create-with-delegation reply. For each set it reads a 64-bit
start and a 64-bit len with ceph_decode_64_safe(), which only validates
that the eight bytes are present in the message, not the value, and then
loops over len while inserting entries into s_delegated_inos.
len is fully attacker controlled. A malicious or compromised MDS can send
one huge interval, many intervals in one reply, duplicate intervals, or
repeated replies that accumulate delegated inodes on the same session.
The original code bounded none of these and could spin the insert loop or
grow the xarray without limit.
Bound both dimensions with a single enforcement point. Track the number
of delegated inodes held by each MDS session in an atomic counter and
grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless()
to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper
is the only place the counter grows, the per-session population can never
exceed the cap, so no separate per-session pre-check is needed. The
counter is decremented when async create consumes a delegated inode or
when an insert fails, incremented when a delegated inode is restored,
initialized with the session xarray, and reset when reconnect destroys
the xarray.
A per-session cap alone still lets one reply spin the insert loop on
duplicate ranges without growing the counter, so also cap the aggregate
interval length accepted from a single reply. Together these bound both
the loop trip count per reply and the xarray population across replies.
The cap is a fixed, client-chosen constant rather than a value derived
from the MDS. mds_client_prealloc_inos is a userspace MDS configuration
option; it is never sent to the kernel client on the wire, and a
server-supplied bound could not be trusted for a defensive limit in any
case. The constant is set well above that option's documented default of
1000 (a generous multiple), so legitimate refill behavior is unaffected
while the CPU and xarray memory a malformed delegation stream can consume
stays bounded.
Impact: a malicious or compromised Ceph MDS can no longer make a client
spin through an unbounded delegated-inode interval or grow one session's
delegated-inode xarray without limit.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d4846487870897a5a149a3220c95bfd5728f9247 Version: d4846487870897a5a149a3220c95bfd5728f9247 Version: d4846487870897a5a149a3220c95bfd5728f9247 Version: d4846487870897a5a149a3220c95bfd5728f9247 Version: d4846487870897a5a149a3220c95bfd5728f9247 Version: d4846487870897a5a149a3220c95bfd5728f9247 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:25:09.925042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:46.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/mds_client.c",
"fs/ceph/mds_client.h",
"fs/ceph/super.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4606d76748affb378f9d15a5d77c128793f4b996",
"status": "affected",
"version": "d4846487870897a5a149a3220c95bfd5728f9247",
"versionType": "git"
},
{
"lessThan": "8194d8e61ef0b49baddf660c7e88fc1c563a5e55",
"status": "affected",
"version": "d4846487870897a5a149a3220c95bfd5728f9247",
"versionType": "git"
},
{
"lessThan": "7fc55e8e6b6b50f217b1728415578704baf4d0a2",
"status": "affected",
"version": "d4846487870897a5a149a3220c95bfd5728f9247",
"versionType": "git"
},
{
"lessThan": "c040e139f1a629b767f900bbbc3f9892c290ed85",
"status": "affected",
"version": "d4846487870897a5a149a3220c95bfd5728f9247",
"versionType": "git"
},
{
"lessThan": "f341270ac5f5077804d7837ce77b0f0df1cea29d",
"status": "affected",
"version": "d4846487870897a5a149a3220c95bfd5728f9247",
"versionType": "git"
},
{
"lessThan": "4bd3158bd62466d57ed72a3f7bc5f205fedd6919",
"status": "affected",
"version": "d4846487870897a5a149a3220c95bfd5728f9247",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/mds_client.c",
"fs/ceph/mds_client.h",
"fs/ceph/super.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: cap delegated inode count in ceph_parse_deleg_inos()\n\nceph_parse_deleg_inos() decodes interval sets of delegated inode numbers\nfrom an MDS create-with-delegation reply. For each set it reads a 64-bit\nstart and a 64-bit len with ceph_decode_64_safe(), which only validates\nthat the eight bytes are present in the message, not the value, and then\nloops over len while inserting entries into s_delegated_inos.\n\nlen is fully attacker controlled. A malicious or compromised MDS can send\none huge interval, many intervals in one reply, duplicate intervals, or\nrepeated replies that accumulate delegated inodes on the same session.\nThe original code bounded none of these and could spin the insert loop or\ngrow the xarray without limit.\n\nBound both dimensions with a single enforcement point. Track the number\nof delegated inodes held by each MDS session in an atomic counter and\ngrow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless()\nto refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper\nis the only place the counter grows, the per-session population can never\nexceed the cap, so no separate per-session pre-check is needed. The\ncounter is decremented when async create consumes a delegated inode or\nwhen an insert fails, incremented when a delegated inode is restored,\ninitialized with the session xarray, and reset when reconnect destroys\nthe xarray.\n\nA per-session cap alone still lets one reply spin the insert loop on\nduplicate ranges without growing the counter, so also cap the aggregate\ninterval length accepted from a single reply. Together these bound both\nthe loop trip count per reply and the xarray population across replies.\n\nThe cap is a fixed, client-chosen constant rather than a value derived\nfrom the MDS. mds_client_prealloc_inos is a userspace MDS configuration\noption; it is never sent to the kernel client on the wire, and a\nserver-supplied bound could not be trusted for a defensive limit in any\ncase. The constant is set well above that option\u0027s documented default of\n1000 (a generous multiple), so legitimate refill behavior is unaffected\nwhile the CPU and xarray memory a malformed delegation stream can consume\nstays bounded.\n\nImpact: a malicious or compromised Ceph MDS can no longer make a client\nspin through an unbounded delegated-inode interval or grow one session\u0027s\ndelegated-inode xarray without limit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ceph_parse_deleg_inos() runs in the ceph-msgr kworker via mds_dispatch()-\u003ehandle_reply()-\u003eparse_reply_info() while decoding CEPH_MSG_CLIENT_REPLY extra data over TCP; on Ceph/Rook/Kubernetes nodes with CephFS mounted, a malicious or compromised MDS drives this remotely.\nAC:L - The MDS fully controls the 64-bit interval len (ceph_decode_64_safe only checks that 8 bytes exist) and can advertise CEPHFS_FEATURE_DELEG_INO at session open. One crafted create-style reply with a huge or duplicate range deterministically spins xa_insert or grows s_delegated_inos on ordinary 64-bit CephFS clients.\nPR:N - The attacker is the remote MDS peer on an already-connected kernel CephFS client and needs no Linux UID, capability, or init-namespace root on the victim, matching other MDS-reply client CVEs such as CVE-2026-80528.\nUI:N - Once CephFS is mounted, MDS replies are processed automatically in kworker context. parse_reply_info_extra selects the create decoder from the reply\u0027s attacker-controlled op field, so ordinary outstanding MDS traffic is enough; no further interactive victim action is required at exploit time.\nS:U - Impact is CPU and kernel-memory exhaustion inside the local CephFS client; it does not cross a VM, hypervisor, IOMMU, or other security-authority boundary.\nC:N - The loop only inserts the fixed DELEGATED_INO_AVAILABLE marker into s_delegated_inos or retries on -EBUSY; there is no out-of-bounds read, use-after-free, or other kernel-memory disclosure primitive.\nI:N - xa_insert is used as a well-defined API storing a constant tagged value; the bug does not yield an arbitrary write, type confusion, or control-flow hijack, only unbounded legitimate xarray growth and CPU spinning.\nA:H - An attacker-chosen 64-bit len can iterate without cond_resched(), soft-lockup the ceph-msgr worker (especially on duplicate ranges that return -EBUSY), and unbounded GFP_KERNEL xa_insert growth can exhaust kernel memory and hang or OOM the client."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:30.205Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4606d76748affb378f9d15a5d77c128793f4b996"
},
{
"url": "https://git.kernel.org/stable/c/8194d8e61ef0b49baddf660c7e88fc1c563a5e55"
},
{
"url": "https://git.kernel.org/stable/c/7fc55e8e6b6b50f217b1728415578704baf4d0a2"
},
{
"url": "https://git.kernel.org/stable/c/c040e139f1a629b767f900bbbc3f9892c290ed85"
},
{
"url": "https://git.kernel.org/stable/c/f341270ac5f5077804d7837ce77b0f0df1cea29d"
},
{
"url": "https://git.kernel.org/stable/c/4bd3158bd62466d57ed72a3f7bc5f205fedd6919"
}
],
"title": "ceph: cap delegated inode count in ceph_parse_deleg_inos()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89648",
"datePublished": "2026-09-11T19:45:39.375Z",
"dateReserved": "2026-09-11T19:38:34.742Z",
"dateUpdated": "2026-10-30T12:32:30.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98073 (GCVE-0-2026-98073)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
syzbot reported the warning in cfg80211_pernet_exit(). [0]
The repro does the following:
1. create two device in root netns and non-root netns
2. assign the same altname for the two devices
3. remove the non-root netns
Since commit 7663d522099e ("net: check for altname conflicts
when changing netdev's netns"), cfg80211_switch_netns() and
cfg802154_switch_netns() fail if init_net has a device with the
conflicting altname.
default_device_exit_net() had the same issue and commit d09486a04f5d
("net: fix removing a namespace with conflicting altnames") fixed it.
cfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.
Let's generalise the fix by removing conflicting altnames for dying
netns in __dev_change_net_namespace().
[0]:
cfg80211_switch_netns(rdev, &init_net)
WARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160
Modules linked in:
CPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
RIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871
Code: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 <0f> 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e
RSP: 0018:ffffc900057a78f0 EFLAGS: 00010293
RAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000
RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000
RBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000
R10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000
R13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20
FS: 0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0
Call Trace:
<TASK>
ops_exit_list net/core/net_namespace.c:200 [inline]
ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253
cleanup_net+0x572/0x810 net/core/net_namespace.c:706
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54772bf503dd0e81e8b8db537fee6946de81e717",
"status": "affected",
"version": "36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc",
"versionType": "git"
},
{
"lessThan": "119ac1716705af17fb74b3e33058a938a87eecd4",
"status": "affected",
"version": "36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc",
"versionType": "git"
},
{
"lessThan": "a29ea5b5034654aaaa4aadd771f48c01abfd2dfa",
"status": "affected",
"version": "36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc",
"versionType": "git"
},
{
"lessThan": "ac6631843269e6a9b2164e393b7f729328711d78",
"status": "affected",
"version": "36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc",
"versionType": "git"
},
{
"lessThan": "debac3a20dec524a59625cf10fa2f18571127824",
"status": "affected",
"version": "36fbf1e52bd3ff8a5cb604955eedfc9350c2e6cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n\nsyzbot reported the warning in cfg80211_pernet_exit(). [0]\n\nThe repro does the following:\n\n 1. create two device in root netns and non-root netns\n 2. assign the same altname for the two devices\n 3. remove the non-root netns\n\nSince commit 7663d522099e (\"net: check for altname conflicts\nwhen changing netdev\u0027s netns\"), cfg80211_switch_netns() and\ncfg802154_switch_netns() fail if init_net has a device with the\nconflicting altname.\n\ndefault_device_exit_net() had the same issue and commit d09486a04f5d\n(\"net: fix removing a namespace with conflicting altnames\") fixed it.\n\ncfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.\n\nLet\u0027s generalise the fix by removing conflicting altnames for dying\nnetns in __dev_change_net_namespace().\n\n[0]:\ncfg80211_switch_netns(rdev, \u0026init_net)\nWARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160\nModules linked in:\nCPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871\nCode: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 \u003c0f\u003e 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e\nRSP: 0018:ffffc900057a78f0 EFLAGS: 00010293\nRAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000\nRDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000\nRBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000\nR10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000\nR13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20\nFS: 0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ops_exit_list net/core/net_namespace.c:200 [inline]\n ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253\n cleanup_net+0x572/0x810 net/core/net_namespace.c:706\n process_one_work kernel/workqueue.c:3387 [inline]\n process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551\n kthread+0x38b/0x480 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered locally. A user sets an altname on a wlan netdev with RTM_NEWLINKPROP, then lets its netns die. cleanup_net runs cfg80211_pernet_exit -\u003e cfg80211_switch_netns -\u003e dev_change_net_namespace, and __dev_change_net_namespace returns -EEXIST on the altname conflict. No remote peer supplies any data.\nAC:L - Wait\nPR:L - Wait\nUI:N - Wait\nS:U - Wait\nC:H - Wait\nI:H - Wait\nA:H - Wait"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:22.672Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54772bf503dd0e81e8b8db537fee6946de81e717"
},
{
"url": "https://git.kernel.org/stable/c/119ac1716705af17fb74b3e33058a938a87eecd4"
},
{
"url": "https://git.kernel.org/stable/c/a29ea5b5034654aaaa4aadd771f48c01abfd2dfa"
},
{
"url": "https://git.kernel.org/stable/c/ac6631843269e6a9b2164e393b7f729328711d78"
},
{
"url": "https://git.kernel.org/stable/c/debac3a20dec524a59625cf10fa2f18571127824"
}
],
"title": "net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98073",
"datePublished": "2026-09-25T10:24:13.277Z",
"dateReserved": "2026-09-25T10:19:56.074Z",
"dateUpdated": "2026-10-21T12:54:22.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74558 (GCVE-0-2026-74558)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: reclaim invalid Tx descriptors in ZC batch path
The zero-copy Tx batch parser stops when it encounters an invalid
descriptor. If this happens after one or more continuation descriptors,
the Tx consumer can be advanced past fragments that are neither submitted
to the driver nor returned to userspace through the completion ring.
A similar problem occurs when a packet exceeds xdp_zc_max_segs. The
descriptors consumed up to the limit are released without completion, and
the remaining continuation descriptors can subsequently be interpreted
as the beginning of another packet.
Parse Tx batches in packet units and distinguish descriptors belonging to
complete valid packets from descriptors consumed while draining an
invalid or oversized packet. Return the former to the driver and append
the latter to the CQ address area so userspace can reclaim their UMEM
frames.
Treat a standalone invalid descriptor as a one-descriptor reclaim-only
packet. Advancing the Tx-ring consumer releases the ring slot, but does
not by itself return ownership of the referenced UMEM frame to userspace.
Once draining starts, continue until the packet's end-of-packet
descriptor is consumed. Preserve the drain state on the socket when EOP
has not yet been supplied, so draining can continue during a later call.
Leave incomplete but otherwise valid packets on the Tx ring.
Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing.
Walk their Tx sockets one packet at a time, preserving the existing
per-socket fairness scheme, instead of using the legacy one-descriptor
fallback. Keep that fallback for shared pools that do not use
multi-buffer Tx. Since the drain state is maintained per socket and both
the singular and shared paths can resume an interrupted drain, changing
the socket list from singular to shared requires no special bind-time
transition.
CQ entries are positional, and drivers may complete only part of the Tx
work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only
entries cannot be published immediately when earlier driver-visible
descriptors are still outstanding.
Track the number of driver-visible CQ entries preceding the reclaim
entries. Let xsk_tx_completed() publish partial hardware Tx completions,
and publish the reclaim entries only after every earlier Tx descriptor
has completed. Complete a reclaim-only batch immediately when there is no
driver-visible work in front of it, and prevent another Tx batch from
being appended while reclaim entries remain pending.
Also cap batch processing by the size of the pool's temporary descriptor
array, as Tx rings belonging to sockets sharing a UMEM may have different
sizes.
This ensures that every invalid Tx descriptor consumed by the ZC batch
path is either submitted to the driver as part of a valid packet or
returned to userspace without violating CQ completion ordering.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/networking/af_xdp.rst",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk.c",
"net/xdp/xsk_buff_pool.c",
"net/xdp/xsk_queue.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56036bdc445c468b1defd1780ed2af4a3fc7ddb2",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "2c0a8cc97a9d970a252f17aa0bbf4588768f7aad",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "e7ce2bad0c33471c8da4dd73dff2119a68f96f3a",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "72f2b4516faf55d4dfac2414649d3cffa5fd2c5e",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/networking/af_xdp.rst",
"include/net/xsk_buff_pool.h",
"net/xdp/xsk.c",
"net/xdp/xsk_buff_pool.c",
"net/xdp/xsk_queue.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: reclaim invalid Tx descriptors in ZC batch path\n\nThe zero-copy Tx batch parser stops when it encounters an invalid\ndescriptor. If this happens after one or more continuation descriptors,\nthe Tx consumer can be advanced past fragments that are neither submitted\nto the driver nor returned to userspace through the completion ring.\n\nA similar problem occurs when a packet exceeds xdp_zc_max_segs. The\ndescriptors consumed up to the limit are released without completion, and\nthe remaining continuation descriptors can subsequently be interpreted\nas the beginning of another packet.\n\nParse Tx batches in packet units and distinguish descriptors belonging to\ncomplete valid packets from descriptors consumed while draining an\ninvalid or oversized packet. Return the former to the driver and append\nthe latter to the CQ address area so userspace can reclaim their UMEM\nframes.\n\nTreat a standalone invalid descriptor as a one-descriptor reclaim-only\npacket. Advancing the Tx-ring consumer releases the ring slot, but does\nnot by itself return ownership of the referenced UMEM frame to userspace.\n\nOnce draining starts, continue until the packet\u0027s end-of-packet\ndescriptor is consumed. Preserve the drain state on the socket when EOP\nhas not yet been supplied, so draining can continue during a later call.\nLeave incomplete but otherwise valid packets on the Tx ring.\n\nShared-UMEM pools using multi-buffer Tx also need packet-framed parsing.\nWalk their Tx sockets one packet at a time, preserving the existing\nper-socket fairness scheme, instead of using the legacy one-descriptor\nfallback. Keep that fallback for shared pools that do not use\nmulti-buffer Tx. Since the drain state is maintained per socket and both\nthe singular and shared paths can resume an interrupted drain, changing\nthe socket list from singular to shared requires no special bind-time\ntransition.\n\nCQ entries are positional, and drivers may complete only part of the Tx\nwork returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only\nentries cannot be published immediately when earlier driver-visible\ndescriptors are still outstanding.\n\nTrack the number of driver-visible CQ entries preceding the reclaim\nentries. Let xsk_tx_completed() publish partial hardware Tx completions,\nand publish the reclaim entries only after every earlier Tx descriptor\nhas completed. Complete a reclaim-only batch immediately when there is no\ndriver-visible work in front of it, and prevent another Tx batch from\nbeing appended while reclaim entries remain pending.\n\nAlso cap batch processing by the size of the pool\u0027s temporary descriptor\narray, as Tx rings belonging to sockets sharing a UMEM may have different\nsizes.\n\nThis ensures that every invalid Tx descriptor consumed by the ZC batch\npath is either submitted to the driver as part of a valid packet or\nreturned to userspace without violating CQ completion ordering."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:56.189Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56036bdc445c468b1defd1780ed2af4a3fc7ddb2"
},
{
"url": "https://git.kernel.org/stable/c/2c0a8cc97a9d970a252f17aa0bbf4588768f7aad"
},
{
"url": "https://git.kernel.org/stable/c/e7ce2bad0c33471c8da4dd73dff2119a68f96f3a"
},
{
"url": "https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e"
}
],
"title": "xsk: reclaim invalid Tx descriptors in ZC batch path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74558",
"datePublished": "2026-08-15T12:28:02.628Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-10-21T12:45:56.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53018 (GCVE-0-2026-53018)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: avoid reading already updated pages during GC
We found the following issue during fuzz testing:
page: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9
memcg:f8ffff800e269c00
aops:f2fs_meta_aops ino:2
flags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=1|kasantag=0x4a)
raw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618
raw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00
page dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio))
page_owner tracks the page as allocated
post_alloc_hook+0x58c/0x5ec
prep_new_page+0x34/0x284
get_page_from_freelist+0x2dcc/0x2e8c
__alloc_pages_noprof+0x280/0x76c
__folio_alloc_noprof+0x18/0xac
__filemap_get_folio+0x6bc/0xdc4
pagecache_get_page+0x3c/0x104
do_garbage_collect+0x5c78/0x77a4
f2fs_gc+0xd74/0x25f0
gc_thread_func+0xb28/0x2930
kthread+0x464/0x5d8
ret_from_fork+0x10/0x20
------------[ cut here ]------------
kernel BUG at mm/filemap.c:1563!
folio_end_read+0x140/0x168
f2fs_finish_read_bio+0x5c4/0xb80
f2fs_read_end_io+0x64c/0x708
bio_endio+0x85c/0x8c0
blk_update_request+0x690/0x127c
scsi_end_request+0x9c/0xb8c
scsi_io_completion+0xf0/0x250
scsi_finish_command+0x430/0x45c
scsi_complete+0x178/0x6d4
blk_mq_complete_request+0xcc/0x104
scsi_done_internal+0x214/0x454
scsi_done+0x24/0x34
which is similar to the problem reported by syzbot:
https://syzkaller.appspot.com/bug?extid=3686758660f980b402dc
This case is consistent with the description in commit 9bf1a3f
("f2fs: avoid GC causing encrypted file corrupted"):
Page 1 is moved from blkaddr A to blkaddr B by move_data_block, and after
being written it is marked as uptodate. Then, Page 1 is moved from blkaddr
B to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by
ra_data_block.
There is no need to read Page 1 again from blkaddr B, since it has already
been updated. Therefore, avoid initiating I/O in this case.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6aa58d8ad20a3323f42274c25820a6f54192422d Version: 6aa58d8ad20a3323f42274c25820a6f54192422d Version: 6aa58d8ad20a3323f42274c25820a6f54192422d Version: 6aa58d8ad20a3323f42274c25820a6f54192422d Version: 6aa58d8ad20a3323f42274c25820a6f54192422d Version: 6aa58d8ad20a3323f42274c25820a6f54192422d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558",
"status": "affected",
"version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
"versionType": "git"
},
{
"lessThan": "c260c874a6d578a45105f98089b1f0db5c6ff0a3",
"status": "affected",
"version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
"versionType": "git"
},
{
"lessThan": "08423a9564d92e51505763b6b2f47b3da8b0a355",
"status": "affected",
"version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
"versionType": "git"
},
{
"lessThan": "4623c251496b99c530ce225c05334f4eac8b933a",
"status": "affected",
"version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
"versionType": "git"
},
{
"lessThan": "b663ebb8a340eae5442e605b6acd2cff5677f016",
"status": "affected",
"version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
"versionType": "git"
},
{
"lessThan": "570e2ccc7cb35fe720106964e65060602d3d2ac4",
"status": "affected",
"version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: avoid reading already updated pages during GC\n\nWe found the following issue during fuzz testing:\n\npage: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9\nmemcg:f8ffff800e269c00\naops:f2fs_meta_aops ino:2\nflags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=1|kasantag=0x4a)\nraw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618\nraw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00\npage dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio))\npage_owner tracks the page as allocated\n post_alloc_hook+0x58c/0x5ec\n prep_new_page+0x34/0x284\n get_page_from_freelist+0x2dcc/0x2e8c\n __alloc_pages_noprof+0x280/0x76c\n __folio_alloc_noprof+0x18/0xac\n __filemap_get_folio+0x6bc/0xdc4\n pagecache_get_page+0x3c/0x104\n do_garbage_collect+0x5c78/0x77a4\n f2fs_gc+0xd74/0x25f0\n gc_thread_func+0xb28/0x2930\n kthread+0x464/0x5d8\n ret_from_fork+0x10/0x20\n------------[ cut here ]------------\nkernel BUG at mm/filemap.c:1563!\n folio_end_read+0x140/0x168\n f2fs_finish_read_bio+0x5c4/0xb80\n f2fs_read_end_io+0x64c/0x708\n bio_endio+0x85c/0x8c0\n blk_update_request+0x690/0x127c\n scsi_end_request+0x9c/0xb8c\n scsi_io_completion+0xf0/0x250\n scsi_finish_command+0x430/0x45c\n scsi_complete+0x178/0x6d4\n blk_mq_complete_request+0xcc/0x104\n scsi_done_internal+0x214/0x454\n scsi_done+0x24/0x34\n\nwhich is similar to the problem reported by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=3686758660f980b402dc\n\nThis case is consistent with the description in commit 9bf1a3f\n(\"f2fs: avoid GC causing encrypted file corrupted\"):\nPage 1 is moved from blkaddr A to blkaddr B by move_data_block, and after\nbeing written it is marked as uptodate. Then, Page 1 is moved from blkaddr\nB to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by\nra_data_block.\n\nThere is no need to read Page 1 again from blkaddr B, since it has already\nbeen updated. Therefore, avoid initiating I/O in this case."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:30.098Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558"
},
{
"url": "https://git.kernel.org/stable/c/c260c874a6d578a45105f98089b1f0db5c6ff0a3"
},
{
"url": "https://git.kernel.org/stable/c/08423a9564d92e51505763b6b2f47b3da8b0a355"
},
{
"url": "https://git.kernel.org/stable/c/4623c251496b99c530ce225c05334f4eac8b933a"
},
{
"url": "https://git.kernel.org/stable/c/b663ebb8a340eae5442e605b6acd2cff5677f016"
},
{
"url": "https://git.kernel.org/stable/c/570e2ccc7cb35fe720106964e65060602d3d2ac4"
}
],
"title": "f2fs: avoid reading already updated pages during GC",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53018",
"datePublished": "2026-06-24T16:29:28.051Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-10-30T12:26:30.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89631 (GCVE-0-2026-89631)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject a tree connect response whose byte count is too small
CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.
Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cc20c031bb067eb3280a1c4b5c42295093e24863 Version: cc20c031bb067eb3280a1c4b5c42295093e24863 Version: cc20c031bb067eb3280a1c4b5c42295093e24863 Version: cc20c031bb067eb3280a1c4b5c42295093e24863 Version: cc20c031bb067eb3280a1c4b5c42295093e24863 Version: cc20c031bb067eb3280a1c4b5c42295093e24863 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89631",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:24:39.378892Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:45.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifssmb.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb99866cb1d3d5e8201200a8692fd8da3106a8fd",
"status": "affected",
"version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
"versionType": "git"
},
{
"lessThan": "d837645a719151ed392d4d9cab4571c2753dab12",
"status": "affected",
"version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
"versionType": "git"
},
{
"lessThan": "2ae219762ebac929bf6ab3473681f10ed566af08",
"status": "affected",
"version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
"versionType": "git"
},
{
"lessThan": "3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d",
"status": "affected",
"version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
"versionType": "git"
},
{
"lessThan": "411e484fe71a7f1028de617447edad9cb6d9d68a",
"status": "affected",
"version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
"versionType": "git"
},
{
"lessThan": "65deb18359341141d37dc86fc7853511be3c87a7",
"status": "affected",
"version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifssmb.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject a tree connect response whose byte count is too small\n\nCIFSTCon() bounds its strnlen() over the byte area with the server\u0027s\nByteCount minus two, which for ByteCount 0 or 1 goes negative as an int\nand converts to a huge size_t. The later subtraction wraps the __u16\nbytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of\nup to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the\nslab object, and the bytes reach userspace through tcon-\u003enativeFileSystem\nin /proc/fs/cifs/DebugData.\n\nReject a byte area too small for what the parser consumes. Two bytes is\nthe least it can consume, and no conformant response carries fewer. The\nnew trace point is the 129th smb_eio_trace entry, which __mode(byte)\ncannot represent, so the attribute goes with it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - CIFSTCon() parses a TREE_CONNECT_ANDX response received over TCP (typically port 445) from the SMB peer, so a malicious or compromised CIFS server supplies the undersized ByteCount remotely.\nAC:L - A server that returns success with ByteCount 0 or 1 triggers the integer underflow and wrapped 65535-byte bound deterministically; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults to y, and no race or uncontrolled memory layout is required.\nPR:N - The attacker is the remote SMB server (or a MITM on unsigned SMB1); the client authenticates to that peer, so no account, capability, or privilege on the victim host is required.\nUI:N - Existing SMB1 mounts, IPC tcons, automounts, fstab, and cifsroot reconnect via cifs_tree_connect() after a server-induced TCP drop, so the crafted TREE_CONNECT response is processed without contemporaneous user action.\nS:U - The out-of-bounds slab read, kernel-memory leak, and possible oops remain inside the client kernel\u0027s security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - ByteCount underflow wraps the __u16 bound to up to 65535 bytes against a ~16KB cifs_request slab, so cifs_strndup_from_utf16() copies adjacent kernel heap into tcon-\u003enativeFileSystem, which is then exposed through /proc/fs/cifs/DebugData.\nI:N - The defect is an out-of-bounds read copied into a newly allocated, correctly sized string; it does not write outside that allocation or provide an arbitrary-write or control-flow primitive.\nA:H - strnlen(), kstrndup(), and cifs_utf16_bytes() walk tens of kilobytes past the cifs_request object into unmapped or guarded pages, causing a kernel oops or panic that a malicious peer can retrigger on reconnect."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:21.680Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb99866cb1d3d5e8201200a8692fd8da3106a8fd"
},
{
"url": "https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12"
},
{
"url": "https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08"
},
{
"url": "https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d"
},
{
"url": "https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a"
},
{
"url": "https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7"
}
],
"title": "smb: client: reject a tree connect response whose byte count is too small",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89631",
"datePublished": "2026-09-11T19:45:26.444Z",
"dateReserved": "2026-09-11T19:38:34.738Z",
"dateUpdated": "2026-10-30T12:32:21.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90099 (GCVE-0-2026-90099)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: account classifier filter allocations to memcg
Allocations in the tc classifier *_change() paths (filter objects,
per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without
__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside
memcg charging. The shared tcf_exts_init_ex() action array allocation in
cls_api.c was also uncharged; this patch closes it along with the
per-classifier filter-object/percpu/aux allocations that remain
unaccounted.
Add GFP_KERNEL_ACCOUNT to:
- the shared tcf_exts_init_ex() action array (cls_api.c), common to every
filter of every classifier (32 pointers, 256 bytes);
- the filter-object, per-CPU-counter, and per-filter aux allocations in
cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,
cls_matchall, cls_route and cls_u32;
- the u32_init_knode() replace-path knode allocation (cls_u32.c), which
allocates the same struct tc_u_knode + sel.keys on every replace of an
existing knode and was missed by the create-path-only conversion.
Also fix the cls_basic error path: basic_change() inserts fnew into the
IDR before allocating the per-CPU counter. If alloc_percpu() fails the
errout path kfree'd fnew without idr_remove, leaving a dangling pointer
in the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable
on demand (memcg at memory.max), making the dead path attacker-reachable
and burning the handle permanently. Add the idr_remove on the percpu
failure path, matching the basic_set_parms failure-path pattern.
Note: vega@nebusec.ai provided a poc for basic_cls, but it was easy to
extend to the other classifiers.
Conditions to recreate the bug:
- CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),
CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.
- Unprivileged user in a fresh user+network namespace (unshare -Urn),
or root with CAP_NET_ADMIN.
- Create a large number of tc filters (e.g. tc filter add dev lo
ingress ... <classifier> ...) while watching a memcg-limited cgroup:
system slab grows far faster than memory.current, pinning kernel
memory outside memcg charging.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0da974f4f303a6842516b764507e3c0a03f41e5a Version: 0da974f4f303a6842516b764507e3c0a03f41e5a Version: 0da974f4f303a6842516b764507e3c0a03f41e5a Version: 0da974f4f303a6842516b764507e3c0a03f41e5a Version: 0da974f4f303a6842516b764507e3c0a03f41e5a Version: 0da974f4f303a6842516b764507e3c0a03f41e5a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c",
"net/sched/cls_basic.c",
"net/sched/cls_bpf.c",
"net/sched/cls_cgroup.c",
"net/sched/cls_flow.c",
"net/sched/cls_flower.c",
"net/sched/cls_fw.c",
"net/sched/cls_matchall.c",
"net/sched/cls_route.c",
"net/sched/cls_u32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a622d5b4d81c1572f42bbf3fb823b6e63d44dae",
"status": "affected",
"version": "0da974f4f303a6842516b764507e3c0a03f41e5a",
"versionType": "git"
},
{
"lessThan": "5fbb06d4f3d4c509ffe95572384a498bf319e5bf",
"status": "affected",
"version": "0da974f4f303a6842516b764507e3c0a03f41e5a",
"versionType": "git"
},
{
"lessThan": "bf6006cea193cf065f7a64fc7974247f8112af33",
"status": "affected",
"version": "0da974f4f303a6842516b764507e3c0a03f41e5a",
"versionType": "git"
},
{
"lessThan": "68fb30607169c92de57c5c82b6af8a733af1cc09",
"status": "affected",
"version": "0da974f4f303a6842516b764507e3c0a03f41e5a",
"versionType": "git"
},
{
"lessThan": "18c68c8f3d3ff0a4def1391021b439c4333a6c71",
"status": "affected",
"version": "0da974f4f303a6842516b764507e3c0a03f41e5a",
"versionType": "git"
},
{
"lessThan": "1beb81947eb486716af80db7a584f9e9fef7e003",
"status": "affected",
"version": "0da974f4f303a6842516b764507e3c0a03f41e5a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c",
"net/sched/cls_basic.c",
"net/sched/cls_bpf.c",
"net/sched/cls_cgroup.c",
"net/sched/cls_flow.c",
"net/sched/cls_flower.c",
"net/sched/cls_fw.c",
"net/sched/cls_matchall.c",
"net/sched/cls_route.c",
"net/sched/cls_u32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: account classifier filter allocations to memcg\n\nAllocations in the tc classifier *_change() paths (filter objects,\nper-CPU counters, and per-filter aux data) use plain GFP_KERNEL without\n__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside\nmemcg charging. The shared tcf_exts_init_ex() action array allocation in\ncls_api.c was also uncharged; this patch closes it along with the\nper-classifier filter-object/percpu/aux allocations that remain\nunaccounted.\n\nAdd GFP_KERNEL_ACCOUNT to:\n- the shared tcf_exts_init_ex() action array (cls_api.c), common to every\n filter of every classifier (32 pointers, 256 bytes);\n- the filter-object, per-CPU-counter, and per-filter aux allocations in\n cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,\n cls_matchall, cls_route and cls_u32;\n- the u32_init_knode() replace-path knode allocation (cls_u32.c), which\n allocates the same struct tc_u_knode + sel.keys on every replace of an\n existing knode and was missed by the create-path-only conversion.\n\nAlso fix the cls_basic error path: basic_change() inserts fnew into the\nIDR before allocating the per-CPU counter. If alloc_percpu() fails the\nerrout path kfree\u0027d fnew without idr_remove, leaving a dangling pointer\nin the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable\non demand (memcg at memory.max), making the dead path attacker-reachable\nand burning the handle permanently. Add the idr_remove on the percpu\nfailure path, matching the basic_set_parms failure-path pattern.\n\nNote: vega@nebusec.ai provided a poc for basic_cls, but it was easy to\nextend to the other classifiers.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),\n CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.\n- Unprivileged user in a fresh user+network namespace (unshare -Urn),\n or root with CAP_NET_ADMIN.\n- Create a large number of tc filters (e.g. tc filter add dev lo\n ingress ... \u003cclassifier\u003e ...) while watching a memcg-limited cgroup:\n system slab grows far faster than memory.current, pinning kernel\n memory outside memcg charging."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:07.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a622d5b4d81c1572f42bbf3fb823b6e63d44dae"
},
{
"url": "https://git.kernel.org/stable/c/5fbb06d4f3d4c509ffe95572384a498bf319e5bf"
},
{
"url": "https://git.kernel.org/stable/c/bf6006cea193cf065f7a64fc7974247f8112af33"
},
{
"url": "https://git.kernel.org/stable/c/68fb30607169c92de57c5c82b6af8a733af1cc09"
},
{
"url": "https://git.kernel.org/stable/c/18c68c8f3d3ff0a4def1391021b439c4333a6c71"
},
{
"url": "https://git.kernel.org/stable/c/1beb81947eb486716af80db7a584f9e9fef7e003"
}
],
"title": "net/sched: account classifier filter allocations to memcg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90099",
"datePublished": "2026-09-17T16:06:10.858Z",
"dateReserved": "2026-09-11T19:38:34.786Z",
"dateUpdated": "2026-10-30T12:34:07.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98084 (GCVE-0-2026-98084)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
When processing calls to bpf_loop() verifier marks R1 (and R4) as
precise. R1 tracks loop iterations number and because of the
'callback_depth < R1' mechanics in check_helper_call() must be marked
precise. However, precision propagation for R1 was broken,
when bpf_loop() call was verified on a second iteration.
Consider the following verification trace:
- main: bpf_loop(nr_loops, callback ...)
- callback: BPF_EXIT
- main: bpf_loop(nr_loops, callback ...)
- ...
While the first visit of the call to bpf_loop() propagated R1
precision as expected, the second call to mark_chain_precision() in
the check_helper_call() set R1, but it was immediately reset when
backtrack_insn() processed preceding BPF_EXIT in the loop deleted in
this patch.
Because of that, the second visit of the call to bpf_loop() injected
checkpoint with R1 not marked as precise. Which could trick the
verifier into accepting unsafe programs. See the next patch for an
example of such program.
Commit is structured in a way to minimize conflicts when
'bpf' would be eventually merged with 'bpf-next'.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b43550d7d58e7ae6618aaab18c1e912fa4d6e3dd Version: ab5cfac139ab8576fb54630d4cca23c3e690ee90 Version: ab5cfac139ab8576fb54630d4cca23c3e690ee90 Version: ab5cfac139ab8576fb54630d4cca23c3e690ee90 Version: ab5cfac139ab8576fb54630d4cca23c3e690ee90 Version: 6.6.15 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/backtrack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1ac58dab0a83d2c64e3b807a3a0b399f17a74110",
"status": "affected",
"version": "b43550d7d58e7ae6618aaab18c1e912fa4d6e3dd",
"versionType": "git"
},
{
"lessThan": "cdc93c6370f792d0649df2a145ac0cdcd430e411",
"status": "affected",
"version": "ab5cfac139ab8576fb54630d4cca23c3e690ee90",
"versionType": "git"
},
{
"lessThan": "3a39bc9707fbd1bef4df7318a9d02222741dda5b",
"status": "affected",
"version": "ab5cfac139ab8576fb54630d4cca23c3e690ee90",
"versionType": "git"
},
{
"lessThan": "f83890dfed9efc5e19df1dbc1ad707a142936923",
"status": "affected",
"version": "ab5cfac139ab8576fb54630d4cca23c3e690ee90",
"versionType": "git"
},
{
"lessThan": "e3e4f66cc4b72333d0886ae2673c360248987889",
"status": "affected",
"version": "ab5cfac139ab8576fb54630d4cca23c3e690ee90",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/backtrack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: backtracking shouldn\u0027t clear outer frame R1-R5 for callbacks\n\nWhen processing calls to bpf_loop() verifier marks R1 (and R4) as\nprecise. R1 tracks loop iterations number and because of the\n\u0027callback_depth \u003c R1\u0027 mechanics in check_helper_call() must be marked\nprecise. However, precision propagation for R1 was broken,\nwhen bpf_loop() call was verified on a second iteration.\n\nConsider the following verification trace:\n- main: bpf_loop(nr_loops, callback ...)\n- callback: BPF_EXIT\n- main: bpf_loop(nr_loops, callback ...)\n- ...\n\nWhile the first visit of the call to bpf_loop() propagated R1\nprecision as expected, the second call to mark_chain_precision() in\nthe check_helper_call() set R1, but it was immediately reset when\nbacktrack_insn() processed preceding BPF_EXIT in the loop deleted in\nthis patch.\n\nBecause of that, the second visit of the call to bpf_loop() injected\ncheckpoint with R1 not marked as precise. Which could trick the\nverifier into accepting unsafe programs. See the next patch for an\nexample of such program.\n\nCommit is structured in a way to minimize conflicts when\n\u0027bpf\u0027 would be eventually merged with \u0027bpf-next\u0027."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:25.939Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ac58dab0a83d2c64e3b807a3a0b399f17a74110"
},
{
"url": "https://git.kernel.org/stable/c/cdc93c6370f792d0649df2a145ac0cdcd430e411"
},
{
"url": "https://git.kernel.org/stable/c/3a39bc9707fbd1bef4df7318a9d02222741dda5b"
},
{
"url": "https://git.kernel.org/stable/c/f83890dfed9efc5e19df1dbc1ad707a142936923"
},
{
"url": "https://git.kernel.org/stable/c/e3e4f66cc4b72333d0886ae2673c360248987889"
}
],
"title": "bpf: backtracking shouldn\u0027t clear outer frame R1-R5 for callbacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98084",
"datePublished": "2026-09-25T10:24:19.881Z",
"dateReserved": "2026-09-25T10:19:56.075Z",
"dateUpdated": "2026-10-21T12:54:25.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98058 (GCVE-0-2026-98058)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark syscall helpers as sleepable
bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes,
allocate with GFP_KERNEL, and wait for an RCU grace period.
bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as
well.
Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is
sleepable. That does not make every callback sleepable: a syscall program
can register a bpf_timer callback, and the verifier checks that callback
in a non-sleepable context while retaining the syscall helper set.
Without .might_sleep on the prototypes, such a callback can invoke
bpf_sys_bpf() from hrtimer softirq context and trigger a
scheduling-while-atomic failure. bpf_sys_close() is exposed through the
same missing context check.
Set .might_sleep on both prototypes so the existing helper-context check
rejects them from timer callbacks and other atomic regions. Calls from the
sleepable main body remain valid.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9496d857205e60241034b798d7745ff8830ba599",
"status": "affected",
"version": "79a7f8bdb159d9914b58740f3d31d602a6e4aca8",
"versionType": "git"
},
{
"lessThan": "d8cfe9f71d302970ae393616960f2b3021d2b3b0",
"status": "affected",
"version": "79a7f8bdb159d9914b58740f3d31d602a6e4aca8",
"versionType": "git"
},
{
"lessThan": "65f636322ac402add6046c68e9ece77b9ffd71c9",
"status": "affected",
"version": "79a7f8bdb159d9914b58740f3d31d602a6e4aca8",
"versionType": "git"
},
{
"lessThan": "3408e98f06ce06ea6a58ca6c39da9c23f0029c06",
"status": "affected",
"version": "79a7f8bdb159d9914b58740f3d31d602a6e4aca8",
"versionType": "git"
},
{
"lessThan": "d05524794240b52fdc3b6c1220dd05505715824d",
"status": "affected",
"version": "79a7f8bdb159d9914b58740f3d31d602a6e4aca8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark syscall helpers as sleepable\n\nbpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes,\nallocate with GFP_KERNEL, and wait for an RCU grace period.\nbpf_sys_close() reaches close_fd() and filp_close(), which can sleep as\nwell.\n\nBoth helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is\nsleepable. That does not make every callback sleepable: a syscall program\ncan register a bpf_timer callback, and the verifier checks that callback\nin a non-sleepable context while retaining the syscall helper set.\n\nWithout .might_sleep on the prototypes, such a callback can invoke\nbpf_sys_bpf() from hrtimer softirq context and trigger a\nscheduling-while-atomic failure. bpf_sys_close() is exposed through the\nsame missing context check.\n\nSet .might_sleep on both prototypes so the existing helper-context check\nrejects them from timer callbacks and other atomic regions. Calls from the\nsleepable main body remain valid."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:19.435Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9496d857205e60241034b798d7745ff8830ba599"
},
{
"url": "https://git.kernel.org/stable/c/d8cfe9f71d302970ae393616960f2b3021d2b3b0"
},
{
"url": "https://git.kernel.org/stable/c/65f636322ac402add6046c68e9ece77b9ffd71c9"
},
{
"url": "https://git.kernel.org/stable/c/3408e98f06ce06ea6a58ca6c39da9c23f0029c06"
},
{
"url": "https://git.kernel.org/stable/c/d05524794240b52fdc3b6c1220dd05505715824d"
}
],
"title": "bpf: Mark syscall helpers as sleepable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98058",
"datePublished": "2026-09-25T10:24:04.190Z",
"dateReserved": "2026-09-25T10:19:56.072Z",
"dateUpdated": "2026-10-21T12:54:19.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-23132 (GCVE-0-2025-23132)
Vulnerability from cvelistv5
Published
2025-04-16 14:13
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: quota: fix to avoid warning in dquot_writeback_dquots()
F2FS-fs (dm-59): checkpoint=enable has some unwritten data.
------------[ cut here ]------------
WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308
pc : dquot_writeback_dquots+0x2fc/0x308
lr : f2fs_quota_sync+0xcc/0x1c4
Call trace:
dquot_writeback_dquots+0x2fc/0x308
f2fs_quota_sync+0xcc/0x1c4
f2fs_write_checkpoint+0x3d4/0x9b0
f2fs_issue_checkpoint+0x1bc/0x2c0
f2fs_sync_fs+0x54/0x150
f2fs_do_sync_file+0x2f8/0x814
__f2fs_ioctl+0x1960/0x3244
f2fs_ioctl+0x54/0xe0
__arm64_sys_ioctl+0xa8/0xe4
invoke_syscall+0x58/0x114
checkpoint and f2fs_remount may race as below, resulting triggering warning
in dquot_writeback_dquots().
atomic write remount
- do_remount
- down_write(&sb->s_umount);
- f2fs_remount
- ioctl
- f2fs_do_sync_file
- f2fs_sync_fs
- f2fs_write_checkpoint
- block_operations
- locked = down_read_trylock(&sbi->sb->s_umount)
: fail to lock due to the write lock was held by remount
- up_write(&sb->s_umount);
- f2fs_quota_sync
- dquot_writeback_dquots
- WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount))
: trigger warning because s_umount lock was unlocked by remount
If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of
checkpoint has already held s_umount lock, calling dquot_writeback_dquots()
in the context should be safe.
So let's record task to sbi->umount_lock_holder, so that checkpoint can
know whether the lock has held in the context or not by checking current
w/ it.
In addition, in order to not misrepresent caller of checkpoint, we should
not allow to trigger async checkpoint for those callers: mount/umount/remount/
freeze/quotactl.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:44:37.526409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:51:58.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/checkpoint.c",
"fs/f2fs/f2fs.h",
"fs/f2fs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ec535db9da76dafa05c89f8b58a0b1d7dddba1c",
"status": "affected",
"version": "af033b2aa8a874fd5737fafe90d159136527b5b4",
"versionType": "git"
},
{
"lessThan": "d7acf0a6c87aa282c86a36dbaa2f92fda88c5884",
"status": "affected",
"version": "af033b2aa8a874fd5737fafe90d159136527b5b4",
"versionType": "git"
},
{
"lessThan": "eb85c2410d6f581e957cd03a644ff6ddbe592af9",
"status": "affected",
"version": "af033b2aa8a874fd5737fafe90d159136527b5b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/checkpoint.c",
"fs/f2fs/f2fs.h",
"fs/f2fs/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.2",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: quota: fix to avoid warning in dquot_writeback_dquots()\n\nF2FS-fs (dm-59): checkpoint=enable has some unwritten data.\n\n------------[ cut here ]------------\nWARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308\npc : dquot_writeback_dquots+0x2fc/0x308\nlr : f2fs_quota_sync+0xcc/0x1c4\nCall trace:\ndquot_writeback_dquots+0x2fc/0x308\nf2fs_quota_sync+0xcc/0x1c4\nf2fs_write_checkpoint+0x3d4/0x9b0\nf2fs_issue_checkpoint+0x1bc/0x2c0\nf2fs_sync_fs+0x54/0x150\nf2fs_do_sync_file+0x2f8/0x814\n__f2fs_ioctl+0x1960/0x3244\nf2fs_ioctl+0x54/0xe0\n__arm64_sys_ioctl+0xa8/0xe4\ninvoke_syscall+0x58/0x114\n\ncheckpoint and f2fs_remount may race as below, resulting triggering warning\nin dquot_writeback_dquots().\n\natomic write remount\n - do_remount\n - down_write(\u0026sb-\u003es_umount);\n - f2fs_remount\n- ioctl\n - f2fs_do_sync_file\n - f2fs_sync_fs\n - f2fs_write_checkpoint\n - block_operations\n - locked = down_read_trylock(\u0026sbi-\u003esb-\u003es_umount)\n : fail to lock due to the write lock was held by remount\n - up_write(\u0026sb-\u003es_umount);\n - f2fs_quota_sync\n - dquot_writeback_dquots\n - WARN_ON_ONCE(!rwsem_is_locked(\u0026sb-\u003es_umount))\n : trigger warning because s_umount lock was unlocked by remount\n\nIf checkpoint comes from mount/umount/remount/freeze/quotactl, caller of\ncheckpoint has already held s_umount lock, calling dquot_writeback_dquots()\nin the context should be safe.\n\nSo let\u0027s record task to sbi-\u003eumount_lock_holder, so that checkpoint can\nknow whether the lock has held in the context or not by checking current\nw/ it.\n\nIn addition, in order to not misrepresent caller of checkpoint, we should\nnot allow to trigger async checkpoint for those callers: mount/umount/remount/\nfreeze/quotactl."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is entered purely through local syscalls against a mounted f2fs volume \u2014 `syncfs()`, `fsync()` or `__f2fs_ioctl()` reaching `f2fs_sync_fs` \u2192 `f2fs_issue_checkpoint` \u2192 `block_operations`. There is no remote or network-facing route into f2fs checkpointing.\nAC:H - The attacker can spam the checkpoint side at will, but `down_read_trylock(\u0026sb-\u003es_umount)` only fails while a *writer* holds the lock, and every writer (mount/remount/umount/freeze/quotaon-off/shutdown ioctl) is a CAP_SYS_ADMIN operation the unprivileged attacker cannot initiate; the lock must additionally be released or be tearing down quota within the narrow window before `dquot_writeback_dquots()`. That timing dependency on an administrative mount-state change is beyond the attacker\u0027s control.\nPR:L - The attacker-facing half needs no privilege at all \u2014 any local user with a file or fd on the f2fs mount can loop on `syncfs()`/`fsync()` to drive checkpoints, which is the case on every Android device where `/data` is f2fs with the `quota_ino` feature enabled by default. No capability, and no user namespace, is required on the triggering path.\nUI:N - The attacker issues the triggering syscall themselves and nothing must be opened, mounted or clicked on their behalf. The concurrent administrative remount is a timing precondition already accounted for in Attack Complexity, not victim participation in the attack.\nS:U - The damage is confined to kernel memory and kernel-managed quota/filesystem state within the same security authority. No hypervisor, IOMMU or sandbox boundary is crossed.\nC:H - Running `dquot_writeback_dquots()`/`f2fs_quota_sync_file()` without `s_umount` removes exactly the protection that keeps quota state alive \u2014 `dqopt-\u003efiles[type]-\u003ei_mapping` is dereferenced after only a lockless `sb_has_quota_active()` check, and `dqopt-\u003einfo[cnt].dqi_dirty_list` is walked while `invalidate_dquots()` frees its entries. A use-after-free read of `struct inode`/`struct dquot` in a general-purpose slab is leverageable for disclosure of adjacent kernel objects.\nI:H - The same unsynchronized window lets `filemap_fdatawrite()` and `dquot_write_dquot()` write through a quota inode that `vfs_cleanup_quota_inode()` has already `iput()`ed and NULLed, giving a write into freed slab memory alongside corruption of on-disk quota accounting (f2fs flags `SBI_QUOTA_NEED_REPAIR`, requiring fsck). A use-after-free write is a classic route to control-flow hijack.\nA:H - The immediate, reported effect is a `WARNING` splat that taints the kernel and is an outright panic on the many hardened Android, cloud and embedded builds that set `panic_on_warn=1`. Beyond that, the lost lock readily oopses the kernel via NULL dereference of a cleared `dqopt-\u003efiles[type]` or a use-after-free on the quota inode."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:19.341Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ec535db9da76dafa05c89f8b58a0b1d7dddba1c"
},
{
"url": "https://git.kernel.org/stable/c/d7acf0a6c87aa282c86a36dbaa2f92fda88c5884"
},
{
"url": "https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9"
}
],
"title": "f2fs: quota: fix to avoid warning in dquot_writeback_dquots()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-23132",
"datePublished": "2025-04-16T14:13:13.697Z",
"dateReserved": "2025-01-11T14:28:41.511Z",
"dateUpdated": "2026-10-21T12:36:19.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43009 (GCVE-0-2026-43009)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix incorrect pruning due to atomic fetch precision tracking
When backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC
and BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as
a destination, thus receiving the old value from the memory location.
The current backtracking logic does not account for this. It treats
atomic fetch operations the same as regular stores where the src
register is only an input. This leads the backtrack_insn to fail to
propagate precision to the stack location, which is then not marked
as precise!
Later, the verifier's path pruning can incorrectly consider two states
equivalent when they differ in terms of stack state. Meaning, two
branches can be treated as equivalent and thus get pruned when they
should not be seen as such.
Fix it as follows: Extend the BPF_LDX handling in backtrack_insn to
also cover atomic fetch operations via is_atomic_fetch_insn() helper.
When the fetch dst register is being tracked for precision, clear it,
and propagate precision over to the stack slot. For non-stack memory,
the precision walk stops at the atomic instruction, same as regular
BPF_LDX. This covers all fetch variants.
Before:
0: (b7) r1 = 8 ; R1=8
1: (7b) *(u64 *)(r10 -8) = r1 ; R1=8 R10=fp0 fp-8=8
2: (b7) r2 = 0 ; R2=0
3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2=8 R10=fp0 fp-8=mmmmmmmm
4: (bf) r3 = r10 ; R3=fp0 R10=fp0
5: (0f) r3 += r2
mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r2 stack= before 4: (bf) r3 = r10
mark_precise: frame0: regs=r2 stack= before 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2)
mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0
6: R2=8 R3=fp8
6: (b7) r0 = 0 ; R0=0
7: (95) exit
After:
0: (b7) r1 = 8 ; R1=8
1: (7b) *(u64 *)(r10 -8) = r1 ; R1=8 R10=fp0 fp-8=8
2: (b7) r2 = 0 ; R2=0
3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2=8 R10=fp0 fp-8=mmmmmmmm
4: (bf) r3 = r10 ; R3=fp0 R10=fp0
5: (0f) r3 += r2
mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r2 stack= before 4: (bf) r3 = r10
mark_precise: frame0: regs=r2 stack= before 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2)
mark_precise: frame0: regs= stack=-8 before 2: (b7) r2 = 0
mark_precise: frame0: regs= stack=-8 before 1: (7b) *(u64 *)(r10 -8) = r1
mark_precise: frame0: regs=r1 stack= before 0: (b7) r1 = 8
6: R2=8 R3=fp8
6: (b7) r0 = 0 ; R0=0
7: (95) exit
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5ca419f2864a2c60940dcf4bbaeb69546200e36f Version: 5ca419f2864a2c60940dcf4bbaeb69546200e36f Version: 5ca419f2864a2c60940dcf4bbaeb69546200e36f Version: 5ca419f2864a2c60940dcf4bbaeb69546200e36f Version: 5ca419f2864a2c60940dcf4bbaeb69546200e36f Version: 5ca419f2864a2c60940dcf4bbaeb69546200e36f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:13:24.466028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-682",
"description": "CWE-682 Incorrect Calculation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:09.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06999c8a2c52b13977771ab093b8e179821b532d",
"status": "affected",
"version": "5ca419f2864a2c60940dcf4bbaeb69546200e36f",
"versionType": "git"
},
{
"lessThan": "1aac6b271e0a80b91c2f6a8f75ab0c0b1fc8ffe8",
"status": "affected",
"version": "5ca419f2864a2c60940dcf4bbaeb69546200e36f",
"versionType": "git"
},
{
"lessThan": "7c72e5f3741d1c5cc53439137162f0e09254e6e9",
"status": "affected",
"version": "5ca419f2864a2c60940dcf4bbaeb69546200e36f",
"versionType": "git"
},
{
"lessThan": "ea150ffa9fc9f78c5cf22e1f7b06b6d016b1017c",
"status": "affected",
"version": "5ca419f2864a2c60940dcf4bbaeb69546200e36f",
"versionType": "git"
},
{
"lessThan": "7ffbe45b1d227e24659998a91cfd4c27af457e71",
"status": "affected",
"version": "5ca419f2864a2c60940dcf4bbaeb69546200e36f",
"versionType": "git"
},
{
"lessThan": "179ee84a89114b854ac2dd1d293633a7f6c8dac1",
"status": "affected",
"version": "5ca419f2864a2c60940dcf4bbaeb69546200e36f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix incorrect pruning due to atomic fetch precision tracking\n\nWhen backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC\nand BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as\na destination, thus receiving the old value from the memory location.\n\nThe current backtracking logic does not account for this. It treats\natomic fetch operations the same as regular stores where the src\nregister is only an input. This leads the backtrack_insn to fail to\npropagate precision to the stack location, which is then not marked\nas precise!\n\nLater, the verifier\u0027s path pruning can incorrectly consider two states\nequivalent when they differ in terms of stack state. Meaning, two\nbranches can be treated as equivalent and thus get pruned when they\nshould not be seen as such.\n\nFix it as follows: Extend the BPF_LDX handling in backtrack_insn to\nalso cover atomic fetch operations via is_atomic_fetch_insn() helper.\nWhen the fetch dst register is being tracked for precision, clear it,\nand propagate precision over to the stack slot. For non-stack memory,\nthe precision walk stops at the atomic instruction, same as regular\nBPF_LDX. This covers all fetch variants.\n\nBefore:\n\n 0: (b7) r1 = 8 ; R1=8\n 1: (7b) *(u64 *)(r10 -8) = r1 ; R1=8 R10=fp0 fp-8=8\n 2: (b7) r2 = 0 ; R2=0\n 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2=8 R10=fp0 fp-8=mmmmmmmm\n 4: (bf) r3 = r10 ; R3=fp0 R10=fp0\n 5: (0f) r3 += r2\n mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1\n mark_precise: frame0: regs=r2 stack= before 4: (bf) r3 = r10\n mark_precise: frame0: regs=r2 stack= before 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2)\n mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0\n 6: R2=8 R3=fp8\n 6: (b7) r0 = 0 ; R0=0\n 7: (95) exit\n\nAfter:\n\n 0: (b7) r1 = 8 ; R1=8\n 1: (7b) *(u64 *)(r10 -8) = r1 ; R1=8 R10=fp0 fp-8=8\n 2: (b7) r2 = 0 ; R2=0\n 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2=8 R10=fp0 fp-8=mmmmmmmm\n 4: (bf) r3 = r10 ; R3=fp0 R10=fp0\n 5: (0f) r3 += r2\n mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1\n mark_precise: frame0: regs=r2 stack= before 4: (bf) r3 = r10\n mark_precise: frame0: regs=r2 stack= before 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2)\n mark_precise: frame0: regs= stack=-8 before 2: (b7) r2 = 0\n mark_precise: frame0: regs= stack=-8 before 1: (7b) *(u64 *)(r10 -8) = r1\n mark_precise: frame0: regs=r1 stack= before 0: (b7) r1 = 8\n 6: R2=8 R3=fp8\n 6: (b7) r0 = 0 ; R0=0\n 7: (95) exit"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable verifier logic is reached through the local bpf() syscall during BPF_PROG_LOAD, not by remote packets or adjacent/physical input.\nAC:L - An attacker controls the submitted BPF bytecode and can deterministically exercise atomic fetch precision tracking and verifier pruning; no race or external victim state is required.\nPR:L - The affected privileged verifier mode requires CAP_BPF/CAP_SYS_ADMIN or an equivalent BPF token, and this kernel supports BPF tokens/capability checks in user namespaces, making this reachable by a basic local user in plausible deployments.\nUI:N - Exploitation only requires the attacker to invoke bpf() with a crafted program; no separate victim action is needed.\nS:U - The impact is a standard kernel verifier bypass leading to kernel compromise within the same host security authority, not a VM/container boundary escape as a separate scope.\nC:H - Incorrect verifier pruning can allow unsafe pointer arithmetic and out-of-bounds BPF memory access; by analogy with similar verifier/runtime divergence bugs, this can provide kernel memory disclosure primitives.\nI:H - The verifier may accept a program whose unsafe path should have been rejected, enabling out-of-bounds writes or arbitrary kernel memory modification in the highest defensible exploitation scenario.\nA:H - Even without full read/write exploitation, accepted unsafe BPF memory accesses can crash or corrupt the kernel, causing a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:43.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06999c8a2c52b13977771ab093b8e179821b532d"
},
{
"url": "https://git.kernel.org/stable/c/1aac6b271e0a80b91c2f6a8f75ab0c0b1fc8ffe8"
},
{
"url": "https://git.kernel.org/stable/c/7c72e5f3741d1c5cc53439137162f0e09254e6e9"
},
{
"url": "https://git.kernel.org/stable/c/ea150ffa9fc9f78c5cf22e1f7b06b6d016b1017c"
},
{
"url": "https://git.kernel.org/stable/c/7ffbe45b1d227e24659998a91cfd4c27af457e71"
},
{
"url": "https://git.kernel.org/stable/c/179ee84a89114b854ac2dd1d293633a7f6c8dac1"
}
],
"title": "bpf: Fix incorrect pruning due to atomic fetch precision tracking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43009",
"datePublished": "2026-05-01T14:15:16.271Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-10-30T12:24:43.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80623 (GCVE-0-2026-80623)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
coresight: ete: Always save state on power down
System register ETMs and ETE are unlikely to be preserved on CPU power
down. The ETE DT binding also never documented
"arm,coresight-loses-context-with-cpu" so nobody would have legitimately
been able to use that binding to fix it and ACPI has no such binding at
all.
Fix it by hard coding the setting for sysreg ETMs (ETE is always sysreg)
or ACPI boots. Use a local variable when setting up save_state so that
it's immune to concurrent probing when devices have different
configurations which is an issue with modifying the global.
This fixes the following error when using Coresight with ACPI on the FVP
which supports CPU PM:
coresight ete0: External agent took claim tag
WARNING: drivers/hwtracing/coresight/coresight-core.c:248 at coresight_disclaim_device_unlocked+0xe0/0xe8, CPU#0: perf/117
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 35e1c9163e025855f23a68f2470c471509e5d779 Version: 35e1c9163e025855f23a68f2470c471509e5d779 Version: 35e1c9163e025855f23a68f2470c471509e5d779 Version: 35e1c9163e025855f23a68f2470c471509e5d779 Version: 35e1c9163e025855f23a68f2470c471509e5d779 Version: 35e1c9163e025855f23a68f2470c471509e5d779 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-etm4x-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f8396271d7026583bcaa71ffe2e7f6025244705",
"status": "affected",
"version": "35e1c9163e025855f23a68f2470c471509e5d779",
"versionType": "git"
},
{
"lessThan": "31633ba13cc49017015f606d5c66eaf5052e99a8",
"status": "affected",
"version": "35e1c9163e025855f23a68f2470c471509e5d779",
"versionType": "git"
},
{
"lessThan": "f58d17798882a3aa3323f9d80fe85e25a38f4b93",
"status": "affected",
"version": "35e1c9163e025855f23a68f2470c471509e5d779",
"versionType": "git"
},
{
"lessThan": "65d87f28daec31903fc39fee0744f7a0059c19f2",
"status": "affected",
"version": "35e1c9163e025855f23a68f2470c471509e5d779",
"versionType": "git"
},
{
"lessThan": "293dacd5b6a9f1275d92ca6c4fd874e54b2c8319",
"status": "affected",
"version": "35e1c9163e025855f23a68f2470c471509e5d779",
"versionType": "git"
},
{
"lessThan": "2ab4645fe4206c142a5f1491e191c906279686cf",
"status": "affected",
"version": "35e1c9163e025855f23a68f2470c471509e5d779",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-etm4x-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ete: Always save state on power down\n\nSystem register ETMs and ETE are unlikely to be preserved on CPU power\ndown. The ETE DT binding also never documented\n\"arm,coresight-loses-context-with-cpu\" so nobody would have legitimately\nbeen able to use that binding to fix it and ACPI has no such binding at\nall.\n\nFix it by hard coding the setting for sysreg ETMs (ETE is always sysreg)\nor ACPI boots. Use a local variable when setting up save_state so that\nit\u0027s immune to concurrent probing when devices have different\nconfigurations which is an issue with modifying the global.\n\nThis fixes the following error when using Coresight with ACPI on the FVP\nwhich supports CPU PM:\n\n coresight ete0: External agent took claim tag\n WARNING: drivers/hwtracing/coresight/coresight-core.c:248 at coresight_disclaim_device_unlocked+0xe0/0xe8, CPU#0: perf/117"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:44.623Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f8396271d7026583bcaa71ffe2e7f6025244705"
},
{
"url": "https://git.kernel.org/stable/c/31633ba13cc49017015f606d5c66eaf5052e99a8"
},
{
"url": "https://git.kernel.org/stable/c/f58d17798882a3aa3323f9d80fe85e25a38f4b93"
},
{
"url": "https://git.kernel.org/stable/c/65d87f28daec31903fc39fee0744f7a0059c19f2"
},
{
"url": "https://git.kernel.org/stable/c/293dacd5b6a9f1275d92ca6c4fd874e54b2c8319"
},
{
"url": "https://git.kernel.org/stable/c/2ab4645fe4206c142a5f1491e191c906279686cf"
}
],
"title": "coresight: ete: Always save state on power down",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80623",
"datePublished": "2026-08-28T06:48:42.371Z",
"dateReserved": "2026-08-26T14:34:25.775Z",
"dateUpdated": "2026-10-30T12:30:44.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72380 (GCVE-0-2026-72380)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/pvcalls: bound backend response req_id before indexing rsp[]
pvcalls_front_event_handler() takes req_id directly from the
backend-supplied ring response and uses it to index the fixed-size
bedata->rsp[] array for a memcpy() and a store, with no range check. A
malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING
and drive an out-of-bounds write past the bedata allocation.
req_id was also declared int while the wire field rsp->req_id is u32, so
a range check on the signed value alone is insufficient: a backend
req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING
test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single
bound covers both ends.
A backend that sends an out-of-range req_id has violated the wire
protocol, so rather than silently dropping the response, log once and
stop trusting the backend: set bedata->disabled. The event handler then
ignores further responses, and the request paths that wait for a
response return -EIO instead of blocking forever. This mirrors the
fatal-error handling xen-netback uses (xenvif_fatal_tx_err()).
The pvcalls frontend currently trusts its backend, so this is not a
classic-Xen security issue, but it matters for hardening PV frontends
against malicious backends (confidential and disaggregated deployments).
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2195046bfd69e487d9a76dc47840f15c8412840c Version: 2195046bfd69e487d9a76dc47840f15c8412840c Version: 2195046bfd69e487d9a76dc47840f15c8412840c Version: 2195046bfd69e487d9a76dc47840f15c8412840c Version: 2195046bfd69e487d9a76dc47840f15c8412840c Version: 2195046bfd69e487d9a76dc47840f15c8412840c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/xen/pvcalls-front.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4aaf7f32f1569e2c0475e073b8d7ec63b231d4c6",
"status": "affected",
"version": "2195046bfd69e487d9a76dc47840f15c8412840c",
"versionType": "git"
},
{
"lessThan": "72e27ef70a20298e60a1de438f3628c515dea895",
"status": "affected",
"version": "2195046bfd69e487d9a76dc47840f15c8412840c",
"versionType": "git"
},
{
"lessThan": "ede7a60b046d8b7288651c55198574ed7c259da7",
"status": "affected",
"version": "2195046bfd69e487d9a76dc47840f15c8412840c",
"versionType": "git"
},
{
"lessThan": "bc8f2d1c6f7cf6e6551c00eb582baf4b52a04794",
"status": "affected",
"version": "2195046bfd69e487d9a76dc47840f15c8412840c",
"versionType": "git"
},
{
"lessThan": "d1297a9e2fd6ce08678b370d41bc980ca798f809",
"status": "affected",
"version": "2195046bfd69e487d9a76dc47840f15c8412840c",
"versionType": "git"
},
{
"lessThan": "d33846c8dcc06b83b7acdeac1e8bfbb5c0c26cb2",
"status": "affected",
"version": "2195046bfd69e487d9a76dc47840f15c8412840c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/xen/pvcalls-front.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/pvcalls: bound backend response req_id before indexing rsp[]\n\npvcalls_front_event_handler() takes req_id directly from the\nbackend-supplied ring response and uses it to index the fixed-size\nbedata-\u003ersp[] array for a memcpy() and a store, with no range check. A\nmalicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING\nand drive an out-of-bounds write past the bedata allocation.\n\nreq_id was also declared int while the wire field rsp-\u003ereq_id is u32, so\na range check on the signed value alone is insufficient: a backend\nreq_id of 0xffffffff becomes -1, passes a \u003e= PVCALLS_NR_RSP_PER_RING\ntest and indexes bedata-\u003ersp[-1]. Declare req_id as u32 so a single\nbound covers both ends.\n\nA backend that sends an out-of-range req_id has violated the wire\nprotocol, so rather than silently dropping the response, log once and\nstop trusting the backend: set bedata-\u003edisabled. The event handler then\nignores further responses, and the request paths that wait for a\nresponse return -EIO instead of blocking forever. This mirrors the\nfatal-error handling xen-netback uses (xenvif_fatal_tx_err()).\n\nThe pvcalls frontend currently trusts its backend, so this is not a\nclassic-Xen security issue, but it matters for hardening PV frontends\nagainst malicious backends (confidential and disaggregated deployments)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when a malicious Xen PVCalls backend writes crafted responses into the shared grant-table ring and notifies the guest frontend via an inter-domain event channel; this is an adjacent on-host backend-to-guest path, not remote IP delivery to the guest.\nAC:L - A compromised backend fully controls ring response contents and can set any req_id (including 0xffffffff for rsp[-1]) and re-notify the frontend IRQ at will; no races or attacker-uncontrollable heap layout are required to trigger the out-of-bounds write.\nPR:N - No credentials inside the vulnerable guest are needed; once the pvcalls frontend is xenbus-connected to a backend, that backend alone can inject the malformed response. Backend/domain control is the attack position, not privileges obtainable in the guest via user namespaces.\nUI:N - No victim user or application action is required after xenbus binds the pvcalls frontend to its backend; backend-driven ring writes and event-channel interrupts alone reach pvcalls_front_event_handler() without mounts, socket use, or other interactive steps.\nS:U - The out-of-bounds write corrupts kmalloc heap memory and kernel objects within the guest running the pvcalls frontend. This is backend-to-guest hardening, not a demonstrated guest-to-host or hypervisor escape across the VM security boundary.\nC:H - Backend-chosen req_id indexes bedata-\u003ersp[] out of bounds for a ~20-byte memcpy plus req_id store, corrupting adjacent kernel heap memory (including rsp[-1] via the signed req_id bug) and enabling plausible arbitrary kernel memory disclosure if shaped further.\nI:H - The heap out-of-bounds write can overwrite adjacent kmalloc objects or allocator metadata, providing a credible path to arbitrary guest-kernel memory modification and control-flow hijack rather than being limited to a bounded or non-security integrity effect.\nA:H - Corrupting kernel heap structures via the unbounded rsp[] indexing can immediately panic or oops the guest kernel; even unexploited attempts are likely to crash or disable the frontend, causing total loss of guest availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:12.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4aaf7f32f1569e2c0475e073b8d7ec63b231d4c6"
},
{
"url": "https://git.kernel.org/stable/c/72e27ef70a20298e60a1de438f3628c515dea895"
},
{
"url": "https://git.kernel.org/stable/c/ede7a60b046d8b7288651c55198574ed7c259da7"
},
{
"url": "https://git.kernel.org/stable/c/bc8f2d1c6f7cf6e6551c00eb582baf4b52a04794"
},
{
"url": "https://git.kernel.org/stable/c/d1297a9e2fd6ce08678b370d41bc980ca798f809"
},
{
"url": "https://git.kernel.org/stable/c/d33846c8dcc06b83b7acdeac1e8bfbb5c0c26cb2"
}
],
"title": "xen/pvcalls: bound backend response req_id before indexing rsp[]",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72380",
"datePublished": "2026-08-15T05:56:12.866Z",
"dateReserved": "2026-08-09T03:40:39.922Z",
"dateUpdated": "2026-10-30T12:29:12.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68209 (GCVE-0-2025-68209)
Vulnerability from cvelistv5
Published
2025-12-16 13:48
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mlx5: Fix default values in create CQ
Currently, CQs without a completion function are assigned the
mlx5_add_cq_to_tasklet function by default. This is problematic since
only user CQs created through the mlx5_ib driver are intended to use
this function.
Additionally, all CQs that will use doorbells instead of polling for
completions must call mlx5_cq_arm. However, the default CQ creation flow
leaves a valid value in the CQ's arm_db field, allowing FW to send
interrupts to polling-only CQs in certain corner cases.
These two factors would allow a polling-only kernel CQ to be triggered
by an EQ interrupt and call a completion function intended only for user
CQs, causing a null pointer exception.
Some areas in the driver have prevented this issue with one-off fixes
but did not address the root cause.
This patch fixes the described issue by adding defaults to the create CQ
flow. It adds a default dummy completion function to protect against
null pointer exceptions, and it sets an invalid command sequence number
by default in kernel CQs to prevent the FW from sending an interrupt to
the CQ until it is armed. User CQs are responsible for their own
initialization values.
Callers of mlx5_core_create_cq are responsible for changing the
completion function and arming the CQ per their needs.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/cq.c",
"drivers/net/ethernet/mellanox/mlx5/core/cq.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c",
"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c",
"drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c",
"drivers/vdpa/mlx5/net/mlx5_vnet.c",
"include/linux/mlx5/cq.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c08079c3e5a3c1573afcb5643b5d296865d1170",
"status": "affected",
"version": "cdd04f4d4d71cbf93d0d9abe63bc838f47c467fa",
"versionType": "git"
},
{
"lessThan": "1a7865e3e4de2830d8a9fe8c273dc10b248b7338",
"status": "affected",
"version": "cdd04f4d4d71cbf93d0d9abe63bc838f47c467fa",
"versionType": "git"
},
{
"lessThan": "a39d334c9840705af69f0466f8f0129c366004ca",
"status": "affected",
"version": "cdd04f4d4d71cbf93d0d9abe63bc838f47c467fa",
"versionType": "git"
},
{
"lessThan": "08469f5393a1a39f26a6e2eb2e8c33187665c1f4",
"status": "affected",
"version": "cdd04f4d4d71cbf93d0d9abe63bc838f47c467fa",
"versionType": "git"
},
{
"lessThan": "e5eba42f01340f73888dfe560be2806057c25913",
"status": "affected",
"version": "cdd04f4d4d71cbf93d0d9abe63bc838f47c467fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/cq.c",
"drivers/net/ethernet/mellanox/mlx5/core/cq.c",
"drivers/net/ethernet/mellanox/mlx5/core/en_main.c",
"drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c",
"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c",
"drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c",
"drivers/vdpa/mlx5/net/mlx5_vnet.c",
"include/linux/mlx5/cq.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: Fix default values in create CQ\n\nCurrently, CQs without a completion function are assigned the\nmlx5_add_cq_to_tasklet function by default. This is problematic since\nonly user CQs created through the mlx5_ib driver are intended to use\nthis function.\n\nAdditionally, all CQs that will use doorbells instead of polling for\ncompletions must call mlx5_cq_arm. However, the default CQ creation flow\nleaves a valid value in the CQ\u0027s arm_db field, allowing FW to send\ninterrupts to polling-only CQs in certain corner cases.\n\nThese two factors would allow a polling-only kernel CQ to be triggered\nby an EQ interrupt and call a completion function intended only for user\nCQs, causing a null pointer exception.\n\nSome areas in the driver have prevented this issue with one-off fixes\nbut did not address the root cause.\n\nThis patch fixes the described issue by adding defaults to the create CQ\nflow. It adds a default dummy completion function to protect against\nnull pointer exceptions, and it sets an invalid command sequence number\nby default in kernel CQs to prevent the FW from sending an interrupt to\nthe CQ until it is armed. User CQs are responsible for their own\ninitialization values.\n\nCallers of mlx5_core_create_cq are responsible for changing the\ncompletion function and arming the CQ per their needs."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:08.429Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c08079c3e5a3c1573afcb5643b5d296865d1170"
},
{
"url": "https://git.kernel.org/stable/c/1a7865e3e4de2830d8a9fe8c273dc10b248b7338"
},
{
"url": "https://git.kernel.org/stable/c/a39d334c9840705af69f0466f8f0129c366004ca"
},
{
"url": "https://git.kernel.org/stable/c/08469f5393a1a39f26a6e2eb2e8c33187665c1f4"
},
{
"url": "https://git.kernel.org/stable/c/e5eba42f01340f73888dfe560be2806057c25913"
}
],
"title": "mlx5: Fix default values in create CQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68209",
"datePublished": "2025-12-16T13:48:36.098Z",
"dateReserved": "2025-12-16T13:41:40.255Z",
"dateUpdated": "2026-10-30T12:23:08.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68441 (GCVE-0-2026-68441)
Vulnerability from cvelistv5
Published
2026-08-12 00:07
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
When a TC filter attached to a qdisc filter chain returns
TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an
act_bpf action), the redirect was silently lost i.e no qdisc classify
function handled TC_ACT_REDIRECT, so the packet fell through the
switch and was enqueued normally instead of being redirected.
This has been broken since bpf_redirect() was introduced for TC in
commit 27b29f63058d ("bpf: add bpf_redirect() helper"). We got lucky
for a long time because bpf_net_context was a per-CPU variable that
was always available.
commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct
on PREEMPT_RT.") turned bpf_net_context into a task_struct member that
is only set up by explicit callers. Without a caller setting it up,
bpf_redirect() itself crashes with a NULL pointer dereference in
bpf_net_ctx_get_ri(). However, even with bpf_net_context available,
TC_ACT_REDIRECT from qdisc filter chains cannot be honored without
adding skb_do_redirect() calls to every qdisc classify function, which
would require changes across net/sched/. Isolate it to ebpf core where
it belongs.
Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a
wrapper around tcf_classify() for use by qdisc classify functions and
tcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT,
the wrapper converts it to TC_ACT_SHOT, dropping the packet rather
than letting it continue silently. Dropping is preferred over
letting the packet through because the user immediately sees packet
loss. Silently passing the packet through would hide the problem and
leave the user wondering why their redirect is not working.
The clsact fast path, tc_run() continues to call tcf_classify() directly
and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by
sch_handle_egress/ingress() calling skb_do_redirect() as before.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 27b29f63058d26c6c1742f1993338280d5a41dc6 Version: 27b29f63058d26c6c1742f1993338280d5a41dc6 Version: 27b29f63058d26c6c1742f1993338280d5a41dc6 Version: 27b29f63058d26c6c1742f1993338280d5a41dc6 Version: 27b29f63058d26c6c1742f1993338280d5a41dc6 Version: 27b29f63058d26c6c1742f1993338280d5a41dc6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/pkt_cls.h",
"net/sched/cls_api.c",
"net/sched/sch_cake.c",
"net/sched/sch_drr.c",
"net/sched/sch_dualpi2.c",
"net/sched/sch_ets.c",
"net/sched/sch_fq_codel.c",
"net/sched/sch_fq_pie.c",
"net/sched/sch_hfsc.c",
"net/sched/sch_htb.c",
"net/sched/sch_multiq.c",
"net/sched/sch_prio.c",
"net/sched/sch_qfq.c",
"net/sched/sch_sfb.c",
"net/sched/sch_sfq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06629ed4d0ecba55bc425eaea79974484fe0b414",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
},
{
"lessThan": "98ca831065c4d20baf97dc9e232777dc47a2b923",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
},
{
"lessThan": "636658e50b5c6a2c93413a9fa6d9da768dbfdaf2",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
},
{
"lessThan": "9cbad9c8125f5fe377c0800ab08f7196eab44456",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
},
{
"lessThan": "c8fd74445e86f88096d2f6cf0f9e4d54d8ed1781",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
},
{
"lessThan": "ec48b3be2c8595dd290be883dbd4fb8b2f9f5d5e",
"status": "affected",
"version": "27b29f63058d26c6c1742f1993338280d5a41dc6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/pkt_cls.h",
"net/sched/cls_api.c",
"net/sched/sch_cake.c",
"net/sched/sch_drr.c",
"net/sched/sch_dualpi2.c",
"net/sched/sch_ets.c",
"net/sched/sch_fq_codel.c",
"net/sched/sch_fq_pie.c",
"net/sched/sch_hfsc.c",
"net/sched/sch_htb.c",
"net/sched/sch_multiq.c",
"net/sched/sch_prio.c",
"net/sched/sch_qfq.c",
"net/sched/sch_sfb.c",
"net/sched/sch_sfq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Handle TC_ACT_REDIRECT from qdisc filter chains\n\nWhen a TC filter attached to a qdisc filter chain returns\nTC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an\nact_bpf action), the redirect was silently lost i.e no qdisc classify\nfunction handled TC_ACT_REDIRECT, so the packet fell through the\nswitch and was enqueued normally instead of being redirected.\n\nThis has been broken since bpf_redirect() was introduced for TC in\ncommit 27b29f63058d (\"bpf: add bpf_redirect() helper\"). We got lucky\nfor a long time because bpf_net_context was a per-CPU variable that\nwas always available.\n\ncommit 401cb7dae813 (\"net: Reference bpf_redirect_info via task_struct\non PREEMPT_RT.\") turned bpf_net_context into a task_struct member that\nis only set up by explicit callers. Without a caller setting it up,\nbpf_redirect() itself crashes with a NULL pointer dereference in\nbpf_net_ctx_get_ri(). However, even with bpf_net_context available,\nTC_ACT_REDIRECT from qdisc filter chains cannot be honored without\nadding skb_do_redirect() calls to every qdisc classify function, which\nwould require changes across net/sched/. Isolate it to ebpf core where\nit belongs.\n\nInstead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a\nwrapper around tcf_classify() for use by qdisc classify functions and\ntcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT,\nthe wrapper converts it to TC_ACT_SHOT, dropping the packet rather\nthan letting it continue silently. Dropping is preferred over\nletting the packet through because the user immediately sees packet\nloss. Silently passing the packet through would hide the problem and\nleave the user wondering why their redirect is not working.\n\nThe clsact fast path, tc_run() continues to call tcf_classify() directly\nand is unaffected: TC_ACT_REDIRECT is returned as-is and handled by\nsch_handle_egress/ingress() calling skb_do_redirect() as before."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:37.360Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06629ed4d0ecba55bc425eaea79974484fe0b414"
},
{
"url": "https://git.kernel.org/stable/c/98ca831065c4d20baf97dc9e232777dc47a2b923"
},
{
"url": "https://git.kernel.org/stable/c/636658e50b5c6a2c93413a9fa6d9da768dbfdaf2"
},
{
"url": "https://git.kernel.org/stable/c/9cbad9c8125f5fe377c0800ab08f7196eab44456"
},
{
"url": "https://git.kernel.org/stable/c/c8fd74445e86f88096d2f6cf0f9e4d54d8ed1781"
},
{
"url": "https://git.kernel.org/stable/c/ec48b3be2c8595dd290be883dbd4fb8b2f9f5d5e"
}
],
"title": "net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68441",
"datePublished": "2026-08-12T00:07:30.669Z",
"dateReserved": "2026-07-30T09:28:09.394Z",
"dateUpdated": "2026-10-30T12:28:37.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52991 (GCVE-0-2026-52991)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/psi: fix race between file release and pressure write
A potential race condition exists between pressure write and cgroup file
release regarding the priv member of struct kernfs_open_file, which
triggers the uaf reported in [1].
Consider the following scenario involving execution on two separate CPUs:
CPU0 CPU1
==== ====
vfs_rmdir()
kernfs_iop_rmdir()
cgroup_rmdir()
cgroup_kn_lock_live()
cgroup_destroy_locked()
cgroup_addrm_files()
cgroup_rm_file()
kernfs_remove_by_name()
kernfs_remove_by_name_ns()
vfs_write() __kernfs_remove()
new_sync_write() kernfs_drain()
kernfs_fop_write_iter() kernfs_drain_open_files()
cgroup_file_write() kernfs_release_file()
pressure_write() cgroup_file_release()
ctx = of->priv;
kfree(ctx);
of->priv = NULL;
cgroup_kn_unlock()
cgroup_kn_lock_live()
cgroup_get(cgrp)
cgroup_kn_unlock()
if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv
The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards
the memory deallocation of of->priv performed within cgroup_file_release().
However, the operations involving of->priv executed within pressure_write()
are not entirely covered by the protection of cgroup_mutex. Consequently,
if the code in pressure_write(), specifically the section handling the
ctx variable executes after cgroup_file_release() has completed, a uaf
vulnerability involving of->priv is triggered.
Therefore, the issue can be resolved by extending the scope of the
cgroup_mutex lock within pressure_write() to encompass all code paths
involving of->priv, thereby properly synchronizing the race condition
occurring between cgroup_file_release() and pressure_write().
And, if an live kn lock can be successfully acquired while executing
the pressure write operation, it indicates that the cgroup deletion
process has not yet reached its final stage; consequently, the priv
pointer within open_file cannot be NULL. Therefore, the operation to
retrieve the ctx value must be moved to a point *after* the live kn
lock has been successfully acquired.
In another situation, specifically after entering cgroup_kn_lock_live()
but before acquiring cgroup_mutex, there exists a different class of
race condition:
CPU0: write memory.pressure CPU1: write cgroup.pressure=0
=========================== =============================
kernfs_fop_write_iter()
kernfs_get_active_of(of)
pressure_write()
cgroup_kn_lock_live(memory.pressure)
cgroup_tryget(cgrp)
kernfs_break_active_protection(kn)
... blocks on cgroup_mutex
cgroup_pressure_write()
cgroup_kn_lock_live(cgroup.pressure)
cgroup_file_show(memory.pressure, false)
kernfs_show(false)
kernfs_drain_open_files()
cgroup_file_release(of)
kfree(ctx)
of->priv = NULL
cgroup_kn_unlock()
... acquires cgroup_mutex
ctx = of->priv; // may now be NULL
if (ctx->psi.trigger) // NULL dereference
Consequently, there is a possibility that of->priv is NULL, the pressure
write needs to check for this.
Now that the scope of the cgroup_mutex has been expanded, the original
explicit cgroup_get/put operations are no longer necessary, this is
because acquiring/releasing the live kn lock inherently executes a
cgroup get/put operation.
[1]
BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011
Call Trace:
pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011
cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 Version: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 Version: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 Version: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 Version: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 Version: 0e94682b73bfa6c44c98af7a26771c9c08c055d5 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Pressure Stall Information (PSI) subsystem. A race condition exists between the file release and pressure write operations, specifically concerning the `priv` member of `struct kernfs_open_file`. This can lead to a use-after-free vulnerability or a NULL dereference, potentially causing system instability or a denial of service. The issue arises when the `priv` member is deallocated during a cgroup file release while a pressure write operation attempts to access it, or when it becomes NULL before being accessed."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:31:57.785Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52991"
},
{
"name": "RHBZ#2492403",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52991.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57253"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57254"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:57251: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:57252: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:57253: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:57254: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: sched/psi: fix race between file release and pressure write",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52991",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:15.317006Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:12.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58e6ca11e45c9d6e52255d1135e7dbff0a360334",
"status": "affected",
"version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
"versionType": "git"
},
{
"lessThan": "d8ddbc3330fa6851c56b046e630a8fc64830a0ce",
"status": "affected",
"version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
"versionType": "git"
},
{
"lessThan": "af0638534bfae7980582c6482531a0872f8ee341",
"status": "affected",
"version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
"versionType": "git"
},
{
"lessThan": "03dc070fa0fc3cb4068693f468ccd5f8a7e58282",
"status": "affected",
"version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
"versionType": "git"
},
{
"lessThan": "d4352c0709bfd38c752fccbde7fd72a82ac78f23",
"status": "affected",
"version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
"versionType": "git"
},
{
"lessThan": "a5b98009f16d8a5fb4a8ff9a193f5735515c38fa",
"status": "affected",
"version": "0e94682b73bfa6c44c98af7a26771c9c08c055d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: fix race between file release and pressure write\n\nA potential race condition exists between pressure write and cgroup file\nrelease regarding the priv member of struct kernfs_open_file, which\ntriggers the uaf reported in [1].\n\nConsider the following scenario involving execution on two separate CPUs:\n\n CPU0\t\t\t\t\tCPU1\n ====\t\t\t\t\t====\n\t\t\t\t\tvfs_rmdir()\n\t\t\t\t\tkernfs_iop_rmdir()\n\t\t\t\t\tcgroup_rmdir()\n\t\t\t\t\tcgroup_kn_lock_live()\n\t\t\t\t\tcgroup_destroy_locked()\n\t\t\t\t\tcgroup_addrm_files()\n\t\t\t\t\tcgroup_rm_file()\n\t\t\t\t\tkernfs_remove_by_name()\n\t\t\t\t\tkernfs_remove_by_name_ns()\n vfs_write()\t\t\t\t__kernfs_remove()\n new_sync_write()\t\t\tkernfs_drain()\n kernfs_fop_write_iter()\t\tkernfs_drain_open_files()\n cgroup_file_write()\t\t\tkernfs_release_file()\n pressure_write()\t\t\tcgroup_file_release()\n ctx = of-\u003epriv;\n\t\t\t\t\tkfree(ctx);\n \t\t\t\t\tof-\u003epriv = NULL;\n\t\t\t\t\tcgroup_kn_unlock()\n cgroup_kn_lock_live()\n cgroup_get(cgrp)\n cgroup_kn_unlock()\n if (ctx-\u003epsi.trigger) // here, trigger uaf for ctx, that is of-\u003epriv\n\nThe cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards\nthe memory deallocation of of-\u003epriv performed within cgroup_file_release().\nHowever, the operations involving of-\u003epriv executed within pressure_write()\nare not entirely covered by the protection of cgroup_mutex. Consequently,\nif the code in pressure_write(), specifically the section handling the\nctx variable executes after cgroup_file_release() has completed, a uaf\nvulnerability involving of-\u003epriv is triggered.\n\nTherefore, the issue can be resolved by extending the scope of the\ncgroup_mutex lock within pressure_write() to encompass all code paths\ninvolving of-\u003epriv, thereby properly synchronizing the race condition\noccurring between cgroup_file_release() and pressure_write().\n\nAnd, if an live kn lock can be successfully acquired while executing\nthe pressure write operation, it indicates that the cgroup deletion\nprocess has not yet reached its final stage; consequently, the priv\npointer within open_file cannot be NULL. Therefore, the operation to\nretrieve the ctx value must be moved to a point *after* the live kn\nlock has been successfully acquired.\n\nIn another situation, specifically after entering cgroup_kn_lock_live()\nbut before acquiring cgroup_mutex, there exists a different class of\nrace condition:\n\nCPU0: write memory.pressure CPU1: write cgroup.pressure=0\n===========================\t\t =============================\n\nkernfs_fop_write_iter()\n kernfs_get_active_of(of)\n pressure_write()\n cgroup_kn_lock_live(memory.pressure)\n cgroup_tryget(cgrp)\n kernfs_break_active_protection(kn)\n ... blocks on cgroup_mutex\n\n \t cgroup_pressure_write()\n \t cgroup_kn_lock_live(cgroup.pressure)\n \t cgroup_file_show(memory.pressure, false)\n \t kernfs_show(false)\n \t kernfs_drain_open_files()\n \t cgroup_file_release(of)\n \t kfree(ctx)\n \t of-\u003epriv = NULL\n \t cgroup_kn_unlock()\n\n ... acquires cgroup_mutex\n ctx = of-\u003epriv; // may now be NULL\n if (ctx-\u003epsi.trigger) // NULL dereference\n\nConsequently, there is a possibility that of-\u003epriv is NULL, the pressure\nwrite needs to check for this.\n\nNow that the scope of the cgroup_mutex has been expanded, the original\nexplicit cgroup_get/put operations are no longer necessary, this is\nbecause acquiring/releasing the live kn lock inherently executes a\ncgroup get/put operation.\n\n[1]\nBUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\nCall Trace:\n pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011\n cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local syscalls writing to cgroup v2 PSI control files such as cpu.pressure, memory.pressure, io.pressure, or irq.pressure. There is no network or physical packet-processing path involved.\nAC:L - The attacker can control both sides of the race by concurrently writing a pressure trigger and removing the cgroup or disabling cgroup.pressure to drain open files. No unusual victim state or externally uncontrolled timing condition is required beyond a repeatable local race.\nPR:L - The pressure files are local cgroupfs files; root can always reach them, and unprivileged users can reach equivalent files in delegated cgroup sub-hierarchies they can create and manage. This is therefore low local privilege rather than init-namespace administrator-only.\nUI:N - Exploitation only requires attacker-controlled syscalls against cgroupfs file descriptors. No victim user action is needed.\nS:U - The vulnerability corrupts kernel memory from a kernel cgroup/PSI file operation and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a slab use-after-free of struct cgroup_file_ctx, and the stale object can be raced with attacker-influenced heap reuse. Following kernel UAF scoring guidance, this can plausibly support kernel memory disclosure primitives.\nI:H - The pre-fix path can read and later store through the freed ctx-\u003epsi.trigger field after the object has been freed, giving a plausible write/corruption primitive with heap grooming. Following kernel UAF scoring guidance, integrity impact is high.\nA:H - The reported bug is a KASAN slab-use-after-free in pressure_write and can crash or oops the kernel. Repeated local triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:24.799Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58e6ca11e45c9d6e52255d1135e7dbff0a360334"
},
{
"url": "https://git.kernel.org/stable/c/d8ddbc3330fa6851c56b046e630a8fc64830a0ce"
},
{
"url": "https://git.kernel.org/stable/c/af0638534bfae7980582c6482531a0872f8ee341"
},
{
"url": "https://git.kernel.org/stable/c/03dc070fa0fc3cb4068693f468ccd5f8a7e58282"
},
{
"url": "https://git.kernel.org/stable/c/d4352c0709bfd38c752fccbde7fd72a82ac78f23"
},
{
"url": "https://git.kernel.org/stable/c/a5b98009f16d8a5fb4a8ff9a193f5735515c38fa"
}
],
"title": "sched/psi: fix race between file release and pressure write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52991",
"datePublished": "2026-06-24T16:29:04.810Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-10-30T12:26:24.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99214 (GCVE-0-2026-99214)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-30 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: hdmi: Move packet RAM enable to PM runtime
Audio can be triggered by the HPD handler and start up before video has
been restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.
vc4_hdmi_write_infoframe() needs Packet RAM to be on to store the
infoframe, however, if the video hasn't been enabled,
vc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the
Packet RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,
causing the following splat:
[ 201.570266] ------------[ cut here ]------------
[ 201.570293] Packet RAM has to be on to store the packet.
[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606
[...]
[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[...]
[ 201.758499] Call trace:
[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)
[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]
[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]
[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]
[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]
[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]
[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]
[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]
[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]
[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]
[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]
[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]
[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]
[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]
[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]
[ 201.846802] __arm64_sys_ioctl+0x88/0xd8
[ 201.850769] invoke_syscall+0x48/0xf4
[ 201.854470] el0_svc_common+0x80/0xd8
[ 201.858171] do_el0_svc+0x1c/0x28
[ 201.861520] el0_svc+0x3c/0xb0
[ 201.864605] el0t_64_sync_handler+0x68/0xdc
[ 201.868834] el0t_64_sync+0x198/0x19c
[ 201.872536] ---[ end trace 0000000000000000 ]---
Considering that Packet RAM enable is essentially a power management
configuration, move its enabling/disabling to the Runtime PM hooks.
Note that post_crtc_disable() still stops all infoframes, but keeps Packet
RAM enabled, leaving it to be disabled by runtime suspend.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_hdmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "03cf08ed84fd43cd7d90696736dcde15f5eefca6",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
},
{
"lessThan": "6b03e354526f6bad60ed3a7f08fec8b7d29d2f27",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
},
{
"lessThan": "6a987992c78e2e04f71e685d1c589f8ea2151fa2",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
},
{
"lessThan": "3f57b34485dc01e5a2db60a89a6ae5439a897e53",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_hdmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn\u0027t been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn\u0027t been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[ 201.570266] ------------[ cut here ]------------\n[ 201.570293] Packet RAM has to be on to store the packet.\n[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606\n[...]\n[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[...]\n[ 201.758499] Call trace:\n[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)\n[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]\n[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]\n[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]\n[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]\n[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]\n[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]\n[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]\n[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]\n[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]\n[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]\n[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]\n[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]\n[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]\n[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]\n[ 201.846802] __arm64_sys_ioctl+0x88/0xd8\n[ 201.850769] invoke_syscall+0x48/0xf4\n[ 201.854470] el0_svc_common+0x80/0xd8\n[ 201.858171] do_el0_svc+0x1c/0x28\n[ 201.861520] el0_svc+0x3c/0xb0\n[ 201.864605] el0t_64_sync_handler+0x68/0xdc\n[ 201.868834] el0t_64_sync+0x198/0x19c\n[ 201.872536] ---[ end trace 0000000000000000 ]---\n\nConsidering that Packet RAM enable is essentially a power management\nconfiguration, move its enabling/disabling to the Runtime PM hooks.\n\nNote that post_crtc_disable() still stops all infoframes, but keeps Packet\nRAM enabled, leaving it to be disabled by runtime suspend."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:43:00.909Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/03cf08ed84fd43cd7d90696736dcde15f5eefca6"
},
{
"url": "https://git.kernel.org/stable/c/6b03e354526f6bad60ed3a7f08fec8b7d29d2f27"
},
{
"url": "https://git.kernel.org/stable/c/6a987992c78e2e04f71e685d1c589f8ea2151fa2"
},
{
"url": "https://git.kernel.org/stable/c/3f57b34485dc01e5a2db60a89a6ae5439a897e53"
}
],
"title": "drm/vc4: hdmi: Move packet RAM enable to PM runtime",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99214",
"datePublished": "2026-10-28T10:36:07.867Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-30T12:43:00.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90311 (GCVE-0-2026-90311)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thermal: hwmon: Remove hwmon class device along with its parent
The current code creates one hwmon device per thermal zone type and that
device is registered under the first thermal zone of the given type.
That turns out to be problematic when the thermal zone holding the
hwmon device is removed.
For example, say that there are two ACPI thermal zones on a system
/sys/devices/virtual/thermal/thermal_zone0/
/sys/devices/virtual/thermal/thermal_zone1/
The current code registers a hwmon class device for thermal_zone0 only:
/sys/devices/virtual/thermal/thermal_zone0/hwmon0/
because the type is "acpitz" for both of them, but it adds a sysfs
attribute that belongs to thermal_zone1 under it:
/sys/devices/virtual/thermal/thermal_zone0/hwmon0/temp2_input
There is also
/sys/devices/virtual/thermal/thermal_zone0/hwmon0/temp1_input
which belongs to thermal_zone0.
When thermal_zone0 is removed, say because the ACPI thermal driver is
unbound from the underlying platform device, thermal_remove_hwmon_sysfs()
skips the removal of hwmon0 because of the temp2_input attribute
belonging to thermal_zone1 which effectively prevents thermal_zone0
removal from making progress.
Address this by making thermal_remove_hwmon_sysfs() remove the entire
hwmon class device interface for the given thermal zone type when the
thermal zone device holding it is removed.
To prevent races with thermal_add_hwmon_sysfs() that may interfere
with this, carry out the entire addition and removal of hwmon sysfs
interfaces for thermal zones under thermal_hwmon_list_lock.
Also adjust the layout of the labels in thermal_add_hwmon_sysfs() to
the current kernel coding style to align with the new "unlock" label.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5 Version: f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5 Version: f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5 Version: f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5 Version: f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5 Version: f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_hwmon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e67dad2cff9e4fedce69e752d515ef651d745a90",
"status": "affected",
"version": "f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5",
"versionType": "git"
},
{
"lessThan": "df002834cfd880b800fa607135e4bb2e403ce187",
"status": "affected",
"version": "f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5",
"versionType": "git"
},
{
"lessThan": "23094544b8e8c43909fd61ca8866ecfe38093ae8",
"status": "affected",
"version": "f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5",
"versionType": "git"
},
{
"lessThan": "9b405b3e7e131ee85dd78b9cc951b41f0828a333",
"status": "affected",
"version": "f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5",
"versionType": "git"
},
{
"lessThan": "4fa8915f40f744c6db2a3c25b2ae7d2dd64c77b4",
"status": "affected",
"version": "f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5",
"versionType": "git"
},
{
"lessThan": "2b57e24d34b2dfc43c81942bb359d6315bf302fb",
"status": "affected",
"version": "f6b6b52ef7a54160c0a4d2b56a58f84a2e5b33c5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_hwmon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: hwmon: Remove hwmon class device along with its parent\n\nThe current code creates one hwmon device per thermal zone type and that\ndevice is registered under the first thermal zone of the given type.\n\nThat turns out to be problematic when the thermal zone holding the\nhwmon device is removed.\n\nFor example, say that there are two ACPI thermal zones on a system\n\n /sys/devices/virtual/thermal/thermal_zone0/\n /sys/devices/virtual/thermal/thermal_zone1/\n\nThe current code registers a hwmon class device for thermal_zone0 only:\n\n /sys/devices/virtual/thermal/thermal_zone0/hwmon0/\n\nbecause the type is \"acpitz\" for both of them, but it adds a sysfs\nattribute that belongs to thermal_zone1 under it:\n\n /sys/devices/virtual/thermal/thermal_zone0/hwmon0/temp2_input\n\nThere is also\n\n /sys/devices/virtual/thermal/thermal_zone0/hwmon0/temp1_input\n\nwhich belongs to thermal_zone0.\n\nWhen thermal_zone0 is removed, say because the ACPI thermal driver is\nunbound from the underlying platform device, thermal_remove_hwmon_sysfs()\nskips the removal of hwmon0 because of the temp2_input attribute\nbelonging to thermal_zone1 which effectively prevents thermal_zone0\nremoval from making progress.\n\nAddress this by making thermal_remove_hwmon_sysfs() remove the entire\nhwmon class device interface for the given thermal zone type when the\nthermal zone device holding it is removed.\n\nTo prevent races with thermal_add_hwmon_sysfs() that may interfere\nwith this, carry out the entire addition and removal of hwmon sysfs\ninterfaces for thermal zones under thermal_hwmon_list_lock.\n\nAlso adjust the layout of the labels in thermal_add_hwmon_sysfs() to\nthe current kernel coding style to align with the new \"unlock\" label."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:07.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e67dad2cff9e4fedce69e752d515ef651d745a90"
},
{
"url": "https://git.kernel.org/stable/c/df002834cfd880b800fa607135e4bb2e403ce187"
},
{
"url": "https://git.kernel.org/stable/c/23094544b8e8c43909fd61ca8866ecfe38093ae8"
},
{
"url": "https://git.kernel.org/stable/c/9b405b3e7e131ee85dd78b9cc951b41f0828a333"
},
{
"url": "https://git.kernel.org/stable/c/4fa8915f40f744c6db2a3c25b2ae7d2dd64c77b4"
},
{
"url": "https://git.kernel.org/stable/c/2b57e24d34b2dfc43c81942bb359d6315bf302fb"
}
],
"title": "thermal: hwmon: Remove hwmon class device along with its parent",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90311",
"datePublished": "2026-09-17T16:08:31.645Z",
"dateReserved": "2026-09-11T19:38:34.800Z",
"dateUpdated": "2026-10-30T12:35:07.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39910 (GCVE-0-2025-39910)
Vulnerability from cvelistv5
Published
2025-10-01 07:44
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and
always allocate memory using the hardcoded GFP_KERNEL flag. This makes
them inconsistent with vmalloc(), which was recently extended to support
GFP_NOFS and GFP_NOIO allocations.
Page table allocations performed during shadow population also ignore the
external gfp_mask. To preserve the intended semantics of GFP_NOFS and
GFP_NOIO, wrap the apply_to_page_range() calls into the appropriate
memalloc scope.
xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock.
There was a report here
https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com
This patch:
- Extends kasan_populate_vmalloc() and helpers to take gfp_mask;
- Passes gfp_mask down to alloc_pages_bulk() and __get_free_page();
- Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restore()
around apply_to_page_range();
- Updates vmalloc.c and percpu allocator call sites accordingly.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-39910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T17:42:43.252504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-667",
"description": "CWE-667 Improper Locking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T17:42:47.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/kasan.h",
"mm/kasan/shadow.c",
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c136f2e4f2edd58a62a3425d4dd373d82834d1f9",
"status": "affected",
"version": "451769ebb7e792c3404db53b3c2a422990de654e",
"versionType": "git"
},
{
"lessThan": "9598c83a50a5f9d57fd0c12fc08d9425c1ce9537",
"status": "affected",
"version": "451769ebb7e792c3404db53b3c2a422990de654e",
"versionType": "git"
},
{
"lessThan": "aa1b4b7a1b92743297f9da741424df4703a8e11b",
"status": "affected",
"version": "451769ebb7e792c3404db53b3c2a422990de654e",
"versionType": "git"
},
{
"lessThan": "33b95d90427cb4babf32059e323a6d0c027610fe",
"status": "affected",
"version": "451769ebb7e792c3404db53b3c2a422990de654e",
"versionType": "git"
},
{
"lessThan": "79357cd06d41d0f5a11b17d7c86176e395d10ef2",
"status": "affected",
"version": "451769ebb7e792c3404db53b3c2a422990de654e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/kasan.h",
"mm/kasan/shadow.c",
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.8",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()\n\nkasan_populate_vmalloc() and its helpers ignore the caller\u0027s gfp_mask and\nalways allocate memory using the hardcoded GFP_KERNEL flag. This makes\nthem inconsistent with vmalloc(), which was recently extended to support\nGFP_NOFS and GFP_NOIO allocations.\n\nPage table allocations performed during shadow population also ignore the\nexternal gfp_mask. To preserve the intended semantics of GFP_NOFS and\nGFP_NOIO, wrap the apply_to_page_range() calls into the appropriate\nmemalloc scope.\n\nxfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock.\n\nThere was a report here\nhttps://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com\n\nThis patch:\n - Extends kasan_populate_vmalloc() and helpers to take gfp_mask;\n - Passes gfp_mask down to alloc_pages_bulk() and __get_free_page();\n - Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restore()\n around apply_to_page_range();\n - Updates vmalloc.c and percpu allocator call sites accordingly."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:36.341Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c136f2e4f2edd58a62a3425d4dd373d82834d1f9"
},
{
"url": "https://git.kernel.org/stable/c/9598c83a50a5f9d57fd0c12fc08d9425c1ce9537"
},
{
"url": "https://git.kernel.org/stable/c/aa1b4b7a1b92743297f9da741424df4703a8e11b"
},
{
"url": "https://git.kernel.org/stable/c/33b95d90427cb4babf32059e323a6d0c027610fe"
},
{
"url": "https://git.kernel.org/stable/c/79357cd06d41d0f5a11b17d7c86176e395d10ef2"
}
],
"title": "mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39910",
"datePublished": "2025-10-01T07:44:33.759Z",
"dateReserved": "2025-04-16T07:20:57.147Z",
"dateUpdated": "2026-10-30T12:22:36.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74375 (GCVE-0-2026-74375)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid1,raid10: fix deadlock in read error recovery path
raid1d and raid10d may resubmit a split md cloned bio while handling
a read error. In this case, resubmitting the bio can lead to a deadlock
if the array is suspended before md_handle_request() acquires an
active_io reference via percpu_ref_tryget_live().
Since the cloned bio already holds an active_io reference,
trying to acquire another reference via percpu_ref_tryget_live()
can lead to a deadlock while the array is suspended.
Fix this by using percpu_ref_get() for md cloned bios.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/md.c",
"drivers/md/md.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "923a6f3172a362d6b2ff12386e376e0e47188f78",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "0889242775340e2c5b69b1590bd71335dd4fdeda",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "ea2d1d2ebf60b70b602a92261a567d5fc4575eab",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "38777f014c37972868f1733a651c85288bb8a757",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
},
{
"lessThan": "7b15c24f805339a585cfe7d72f446b7e88b9bcc0",
"status": "affected",
"version": "bb2a9acefaf9ce5bbc1e70f407e34599233d0243",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/md.c",
"drivers/md/md.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: fix deadlock in read error recovery path\n\nraid1d and raid10d may resubmit a split md cloned bio while handling\na read error. In this case, resubmitting the bio can lead to a deadlock\nif the array is suspended before md_handle_request() acquires an\nactive_io reference via percpu_ref_tryget_live().\n\nSince the cloned bio already holds an active_io reference,\ntrying to acquire another reference via percpu_ref_tryget_live()\ncan lead to a deadlock while the array is suspended.\n\nFix this by using percpu_ref_get() for md cloned bios."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:32.765Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/923a6f3172a362d6b2ff12386e376e0e47188f78"
},
{
"url": "https://git.kernel.org/stable/c/0889242775340e2c5b69b1590bd71335dd4fdeda"
},
{
"url": "https://git.kernel.org/stable/c/ea2d1d2ebf60b70b602a92261a567d5fc4575eab"
},
{
"url": "https://git.kernel.org/stable/c/38777f014c37972868f1733a651c85288bb8a757"
},
{
"url": "https://git.kernel.org/stable/c/7b15c24f805339a585cfe7d72f446b7e88b9bcc0"
}
],
"title": "md/raid1,raid10: fix deadlock in read error recovery path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74375",
"datePublished": "2026-08-15T05:58:54.335Z",
"dateReserved": "2026-08-15T05:44:03.889Z",
"dateUpdated": "2026-10-21T12:45:32.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90183 (GCVE-0-2026-90183)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-iolatency: clear delay state when freeing policy data
io.latency can throttle a group which has no latency target of its own.
When a sibling misses its target, check_scale_change() scales down its
peers, and a peer that reaches queue depth one gets blkcg_use_delay()
called on it on every further scale-down, even with min_lat_nsec == 0.
iolatency_pd_offline() resets the target through
iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero
to zero transition, so it never clears such a peer. Freeing the policy
data then leaves blkg->use_delay set and blkcg->congestion_count
elevated with nothing left that can drop it.
blk_cgroup_congested() then returns true for every task in that cgroup
and its descendants for as long as the cgroup lives: page_cache_sync_ra()
cuts readahead to a single page, page_cache_async_ra() skips it
altogether, and __folio_throttle_swaprate() takes swap_avail_lock and
schedules a throttle on anonymous folio allocation.
Clear the delay in iolatency_pd_free(). By then bio-held blkg
references have drained, or the queue is frozen for policy
deactivation, so check_scale_change() cannot re-arm it. The free
callback can also see policy data which was never attached to a blkg,
hence the pd->blkg check.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d70675121546c35feaceebf7ed9caed8716640f3 Version: d70675121546c35feaceebf7ed9caed8716640f3 Version: d70675121546c35feaceebf7ed9caed8716640f3 Version: d70675121546c35feaceebf7ed9caed8716640f3 Version: d70675121546c35feaceebf7ed9caed8716640f3 Version: d70675121546c35feaceebf7ed9caed8716640f3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-iolatency.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "27573278b1cbc2313ebd31309ac18ac6179b828a",
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"versionType": "git"
},
{
"lessThan": "53ccb4b967edc5f82ff6f9c066fb96c31aa7561a",
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"versionType": "git"
},
{
"lessThan": "b6449a915d1826e1450f6368fc379fe44caa06ca",
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"versionType": "git"
},
{
"lessThan": "5c6593422eb3c3a21505436ccf74599a433584c8",
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"versionType": "git"
},
{
"lessThan": "02f1b90ab33ef99c89dd96a385b432ff57abc64d",
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"versionType": "git"
},
{
"lessThan": "8935bf22c0a0db517a7f72f7097300e05dd852f5",
"status": "affected",
"version": "d70675121546c35feaceebf7ed9caed8716640f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-iolatency.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iolatency: clear delay state when freeing policy data\n\nio.latency can throttle a group which has no latency target of its own.\nWhen a sibling misses its target, check_scale_change() scales down its\npeers, and a peer that reaches queue depth one gets blkcg_use_delay()\ncalled on it on every further scale-down, even with min_lat_nsec == 0.\n\niolatency_pd_offline() resets the target through\niolatency_set_min_lat_nsec(), which clears the delay only on a nonzero\nto zero transition, so it never clears such a peer. Freeing the policy\ndata then leaves blkg-\u003euse_delay set and blkcg-\u003econgestion_count\nelevated with nothing left that can drop it.\n\nblk_cgroup_congested() then returns true for every task in that cgroup\nand its descendants for as long as the cgroup lives: page_cache_sync_ra()\ncuts readahead to a single page, page_cache_async_ra() skips it\naltogether, and __folio_throttle_swaprate() takes swap_avail_lock and\nschedules a throttle on anonymous folio allocation.\n\nClear the delay in iolatency_pd_free(). By then bio-held blkg\nreferences have drained, or the queue is frozen for policy\ndeactivation, so check_scale_change() cannot re-arm it. The free\ncallback can also see policy data which was never attached to a blkg,\nhence the pd-\u003eblkg check."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:39.908Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/27573278b1cbc2313ebd31309ac18ac6179b828a"
},
{
"url": "https://git.kernel.org/stable/c/53ccb4b967edc5f82ff6f9c066fb96c31aa7561a"
},
{
"url": "https://git.kernel.org/stable/c/b6449a915d1826e1450f6368fc379fe44caa06ca"
},
{
"url": "https://git.kernel.org/stable/c/5c6593422eb3c3a21505436ccf74599a433584c8"
},
{
"url": "https://git.kernel.org/stable/c/02f1b90ab33ef99c89dd96a385b432ff57abc64d"
},
{
"url": "https://git.kernel.org/stable/c/8935bf22c0a0db517a7f72f7097300e05dd852f5"
}
],
"title": "blk-iolatency: clear delay state when freeing policy data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90183",
"datePublished": "2026-09-17T16:07:07.045Z",
"dateReserved": "2026-09-11T19:38:34.791Z",
"dateUpdated": "2026-10-30T12:34:39.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90217 (GCVE-0-2026-90217)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Compare iterator types during state pruning
An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states
must not be equal, or the verifier can prune an unsafe path.
Compare the pointer type for STACK_ITER slots.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/states.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86bbaf9e6e4fa6c0dfb352e9e11fae328069233a",
"status": "affected",
"version": "dfab99df147b0d364f0c199f832ff2aedfb2265a",
"versionType": "git"
},
{
"lessThan": "e4ab436d5ba61e4910fd49d24bb64ddb34d493d6",
"status": "affected",
"version": "dfab99df147b0d364f0c199f832ff2aedfb2265a",
"versionType": "git"
},
{
"lessThan": "6424b9cde9edc7f2098115bbfd1ee3d84a958380",
"status": "affected",
"version": "dfab99df147b0d364f0c199f832ff2aedfb2265a",
"versionType": "git"
},
{
"lessThan": "83608e303b95d07afba1c15da0b5d9e513c2f15a",
"status": "affected",
"version": "dfab99df147b0d364f0c199f832ff2aedfb2265a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/states.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Compare iterator types during state pruning\n\nAn iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states\nmust not be equal, or the verifier can prune an unsafe path.\n\nCompare the pointer type for STACK_ITER slots."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled input is the BPF instruction stream copied in bpf_prog_load() from bpf(2) BPF_PROG_LOAD (__sys_bpf). bpf_check() then stacksafe() treats STACK_ITER slots with MEM_RCU and PTR_UNTRUSTED as equal; that bytecode is local syscall input, not a remote protocol payload.\nAC:L - The attacker authors both verifier paths as in iter_tasks_rcu_state_pruning: bpf_iter_task_new under bpf_rcu_read_lock, then a bpf_get_prandom_u32 branch that nested-lock/unlock (MEM_RCU) or unlock/relock (PTR_UNTRUSTED) before bpf_iter_task_next. Both sides and the branch are attacker-controlled; no victim timing is required.\nPR:L - add_subprog_and_kfunc() rejects kfunc calls unless env-\u003ebpf_capable. bpf_iter_task_new and bpf_iter_css_new are kfuncs; BPF_PROG_TYPE_SYSCALL (always sleepable) needs only bpf_token_capable(CAP_BPF). bpf_token_capable() uses ns_capable() on a delegated token userns, so this is not init-namespace root.\nUI:N - The attacker loads the crafted sleepable program with BPF_PROG_LOAD and executes it via BPF_PROG_TEST_RUN (bpf_prog_test_run_syscall) or by attaching their own fentry.s; no other user must mount a filesystem, open a file, or cooperate.\nS:U - A pruned bpf_iter_task_next() walks host task_struct lists in the same kernel that loaded the program. That is in-kernel use-after-free and privilege escalation, not a KVM/Xen guest-to-host escape or IOMMU bypass.\nC:H - After the pruned unlock/relock gap, bpf_iter_task_next() returns kit-\u003epos from bpf_iter_task_kern, a task_struct * that may already have been RCU-freed. The program can read BTF fields of that dangling pointer, so the UAF is an arbitrary kernel disclosure.\nI:H - bpf_iter_task_next() then calls next_task()/__next_thread() (list_entry_rcu on tasks.next and thread_node) using the dangling kit-\u003epos. Walking attacker-reclaimed task_struct list nodes is a kernel write primitive; UAF and iterator type confusion are Integrity High.\nA:H - Using the untrusted STACK_ITER after the RCU gap makes next_task() or css_next_descendant_*() dereference a freed task_struct or cgroup_subsys_state, causing a kernel oops or panic even when the UAF is not fully exploited."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:30.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86bbaf9e6e4fa6c0dfb352e9e11fae328069233a"
},
{
"url": "https://git.kernel.org/stable/c/e4ab436d5ba61e4910fd49d24bb64ddb34d493d6"
},
{
"url": "https://git.kernel.org/stable/c/6424b9cde9edc7f2098115bbfd1ee3d84a958380"
},
{
"url": "https://git.kernel.org/stable/c/83608e303b95d07afba1c15da0b5d9e513c2f15a"
}
],
"title": "bpf: Compare iterator types during state pruning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90217",
"datePublished": "2026-09-17T16:07:29.409Z",
"dateReserved": "2026-09-11T19:38:34.793Z",
"dateUpdated": "2026-10-21T12:50:30.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99202 (GCVE-0-2026-99202)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libsas: Fix SMP IO deadlock during HA resume
smp_execute_task_sg() calls pm_runtime_get_sync() on the host before
issuing an SMP command. When that command is itself issued from the HA
resume path, the get_sync() deadlocks: it waits for the ongoing resume
(the device is RPM_RESUMING), while the resume is blocked in
sas_drain_work() waiting for that same SMP IO to complete.
The deadlock needs an expander-attached SATA disk. During
sas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata()
-> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for
such a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() ->
sas_phy_reset() -> sas_smp_phy_control() ->
smp_execute_task_sg()). Direct-attached SATA resets through
lldd_control_phy() and SSP devices use TMFs, so neither hits this.
Replace the get_sync()/put_sync() pair with
pm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only
needs to hold off autosuspend while the SMP is in flight, and it must
not try to resume the host: a sync resume issued from the HA resume path
itself is what deadlocks, and by the time sas_resume_ha() runs, hw_init
has already reinitialized the hardware, so the device is accessible
without one.
The usage reference is still required. Discovery work normally runs
inside an event worker's PM reference, taken at sas_notify_port_event()
notify time and held until the handler has flushed the disco
queue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN
from within the revalidation worker itself, and flush_workqueue() does
not wait for work items queued during execution, so that chained
revalidation runs with no outer PM reference - without the
get_noresume(), its SMP could race autosuspend.
For the BSG path, sas_smp_handler() is the only caller which may find
the host autosuspended: expander SMP requests do not go through any SCSI
device request queue, so nothing else in that path holds the host
awake. Resume it there with pm_runtime_resume_and_get() and check the
result.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 09357f067122e2e28ec52e27013a1660a1571618 Version: e50a6523a603594a6d92cdecfe11997d639410a3 Version: c391b5899dd46485a5893696c12ae3e95a3a7325 Version: 9e24b47ef81d43b3fb1b14294f09991640c79fcc Version: 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 Version: 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 Version: b9c44a14062093e9fc2d6bddc696cfceadb482d7 Version: 6.1.183 ≤ Version: 6.6.151 ≤ Version: 6.12.103 ≤ Version: 6.18.44 ≤ Version: 7.1.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libsas/sas_expander.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ab91a558084fdb8cca4919ffb769ca4328e91bbd",
"status": "affected",
"version": "09357f067122e2e28ec52e27013a1660a1571618",
"versionType": "git"
},
{
"lessThan": "6078a5369f9e8d22bb03b8890cb0bb47c91a5017",
"status": "affected",
"version": "e50a6523a603594a6d92cdecfe11997d639410a3",
"versionType": "git"
},
{
"lessThan": "7004c18c38aaa2b87164b54dd77c320b4c63b89b",
"status": "affected",
"version": "c391b5899dd46485a5893696c12ae3e95a3a7325",
"versionType": "git"
},
{
"lessThan": "c9fb89246d9922ac0a45d504adb03e0bb971310c",
"status": "affected",
"version": "9e24b47ef81d43b3fb1b14294f09991640c79fcc",
"versionType": "git"
},
{
"lessThan": "08b95ef36a64c3ae4490794bed3c35d0c3354e85",
"status": "affected",
"version": "3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845",
"versionType": "git"
},
{
"lessThan": "81e097a064b28b4a1f6ca1a8b433e659c1bd64c0",
"status": "affected",
"version": "3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845",
"versionType": "git"
},
{
"status": "affected",
"version": "b9c44a14062093e9fc2d6bddc696cfceadb482d7",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThan": "6.6.161",
"status": "affected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThan": "6.12.115",
"status": "affected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThan": "6.18.59",
"status": "affected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libsas/sas_expander.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6.151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.12.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.18.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -\u003e sas_drain_work(), DISCE_RESUME -\u003e sas_resume_sata()\n-\u003e ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for\nsuch a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -\u003e\nsas_phy_reset() -\u003e sas_smp_phy_control() -\u003e\nsmp_execute_task_sg()). Direct-attached SATA resets through\nlldd_control_phy() and SSP devices use TMFs, so neither hits this.\n\nReplace the get_sync()/put_sync() pair with\npm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only\nneeds to hold off autosuspend while the SMP is in flight, and it must\nnot try to resume the host: a sync resume issued from the HA resume path\nitself is what deadlocks, and by the time sas_resume_ha() runs, hw_init\nhas already reinitialized the hardware, so the device is accessible\nwithout one.\n\nThe usage reference is still required. Discovery work normally runs\ninside an event worker\u0027s PM reference, taken at sas_notify_port_event()\nnotify time and held until the handler has flushed the disco\nqueue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN\nfrom within the revalidation worker itself, and flush_workqueue() does\nnot wait for work items queued during execution, so that chained\nrevalidation runs with no outer PM reference - without the\nget_noresume(), its SMP could race autosuspend.\n\nFor the BSG path, sas_smp_handler() is the only caller which may find\nthe host autosuspended: expander SMP requests do not go through any SCSI\ndevice request queue, so nothing else in that path holds the host\nawake. Resume it there with pm_runtime_resume_and_get() and check the\nresult."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:52.198Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ab91a558084fdb8cca4919ffb769ca4328e91bbd"
},
{
"url": "https://git.kernel.org/stable/c/6078a5369f9e8d22bb03b8890cb0bb47c91a5017"
},
{
"url": "https://git.kernel.org/stable/c/7004c18c38aaa2b87164b54dd77c320b4c63b89b"
},
{
"url": "https://git.kernel.org/stable/c/c9fb89246d9922ac0a45d504adb03e0bb971310c"
},
{
"url": "https://git.kernel.org/stable/c/08b95ef36a64c3ae4490794bed3c35d0c3354e85"
},
{
"url": "https://git.kernel.org/stable/c/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0"
}
],
"title": "scsi: libsas: Fix SMP IO deadlock during HA resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99202",
"datePublished": "2026-10-28T10:35:56.827Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-30T12:42:52.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99027 (GCVE-0-2026-99027)
Vulnerability from cvelistv5
Published
2026-10-23 12:21
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: team: stop reusing skb after queue override
A nonzero dev_queue_xmit() result does not return ownership of the skb.
When an override port's qdisc drops it, the queue override helper used to
try another port or the mode transmit op with the freed skb.
Return the handoff decision separately from transmit success. Select only
the first override port under RCU and stop after handing it the skb,
regardless of the lower transmit result. Keep the existing success and
drop accounting.
BUG: KASAN: slab-use-after-free in sk_skb_reason_drop
Write of size 4 by task poc/5040
sk_skb_reason_drop (net/core/skbuff.c:1240)
dev_kfree_skb_any_reason (net/core/dev.c:3470)
ab_transmit (drivers/net/team/team_mode_activebackup.c:49)
team_xmit (drivers/net/team/team_core.c:1849)
__dev_direct_xmit (net/core/dev.c:4934)
Freed by task 5040:
__tcf_kfree_skb_list (net/sched/sch_generic.c:43)
__dev_queue_xmit (net/core/dev.c:4831)
team_xmit (drivers/net/team/team_core.c:1846)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13be794844e368b4f8e8d33e97efa23c0a1ebaf8",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "e40846f661075c4c653988363f38e6868bd0a240",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "eaf49fba9cd054e84906d2416e8662194f763c9e",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "b21f20320fa2f3c683e3334d70de6bfd172e544a",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "07a48cfceb3d0555710a9acb87c949500a7b4523",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "bed63353341d2d44cbad034001dd382cfe3a3892",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "b7454f1940c5e6d92e753853c476a769e452f30a",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: stop reusing skb after queue override\n\nA nonzero dev_queue_xmit() result does not return ownership of the skb.\nWhen an override port\u0027s qdisc drops it, the queue override helper used to\ntry another port or the mode transmit op with the freed skb.\n\nReturn the handoff decision separately from transmit success. Select only\nthe first override port under RCU and stop after handing it the skb,\nregardless of the lower transmit result. Keep the existing success and\ndrop accounting.\n\n BUG: KASAN: slab-use-after-free in sk_skb_reason_drop\n Write of size 4 by task poc/5040\n sk_skb_reason_drop (net/core/skbuff.c:1240)\n dev_kfree_skb_any_reason (net/core/dev.c:3470)\n ab_transmit (drivers/net/team/team_mode_activebackup.c:49)\n team_xmit (drivers/net/team/team_core.c:1849)\n __dev_direct_xmit (net/core/dev.c:4934)\n Freed by task 5040:\n __tcf_kfree_skb_list (net/sched/sch_generic.c:43)\n __dev_queue_xmit (net/core/dev.c:4831)\n team_xmit (drivers/net/team/team_core.c:1846)\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:02.988Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13be794844e368b4f8e8d33e97efa23c0a1ebaf8"
},
{
"url": "https://git.kernel.org/stable/c/e40846f661075c4c653988363f38e6868bd0a240"
},
{
"url": "https://git.kernel.org/stable/c/eaf49fba9cd054e84906d2416e8662194f763c9e"
},
{
"url": "https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a"
},
{
"url": "https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523"
},
{
"url": "https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e"
},
{
"url": "https://git.kernel.org/stable/c/bed63353341d2d44cbad034001dd382cfe3a3892"
},
{
"url": "https://git.kernel.org/stable/c/b7454f1940c5e6d92e753853c476a769e452f30a"
}
],
"title": "net: team: stop reusing skb after queue override",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99027",
"datePublished": "2026-10-23T12:21:14.896Z",
"dateReserved": "2026-09-25T10:25:14.386Z",
"dateUpdated": "2026-10-30T12:41:02.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46014 (GCVE-0-2026-46014)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Add missing save/restore handling of LBR MSRs
MSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by
KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So
save/restore is completely broken.
Fix it by adding the MSRs to msrs_to_save_base, and allowing writes to
LBR MSRs from userspace only (as they are read-only MSRs) if LBR
virtualization is enabled. Additionally, to correctly restore L1's LBRs
while L2 is running, make sure the LBRs are copied from the captured
VMCB01 save area in svm_copy_vmrun_state().
Note, for VMX, this also fixes a flaw where MSR_IA32_DEBUGCTLMSR isn't
reported as an MSR to save/restore.
Note #2, over-reporting MSR_IA32_LASTxxx on Intel is ok, as KVM already
handles unsupported reads and writes thanks to commit b5e2fec0ebc3 ("KVM:
Ignore DEBUGCTL MSRs with no effect") (kvm_do_msr_access() will morph the
unsupported userspace write into a nop).
[sean: guard with lbrv checks, massage changelog]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:05:06.638679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:31.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bca0597272f9712b1f8ebd38b184db1dc2902ff7",
"status": "affected",
"version": "24e09cbf480a72f9c952af4ca77b159503dca44b",
"versionType": "git"
},
{
"lessThan": "4428a0a8643b0acf4ed7b8ea3e5975023bf4aafb",
"status": "affected",
"version": "24e09cbf480a72f9c952af4ca77b159503dca44b",
"versionType": "git"
},
{
"lessThan": "2b922a42b531a82d7881add14a7698dcdc5e1f0a",
"status": "affected",
"version": "24e09cbf480a72f9c952af4ca77b159503dca44b",
"versionType": "git"
},
{
"lessThan": "13a89ada5dcfc2539514c83ba5a2c61157f1ec6c",
"status": "affected",
"version": "24e09cbf480a72f9c952af4ca77b159503dca44b",
"versionType": "git"
},
{
"lessThan": "3700f0788da6acf73b2df56690f4b201aa4aefd2",
"status": "affected",
"version": "24e09cbf480a72f9c952af4ca77b159503dca44b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Add missing save/restore handling of LBR MSRs\n\nMSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by\nKVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So\nsave/restore is completely broken.\n\nFix it by adding the MSRs to msrs_to_save_base, and allowing writes to\nLBR MSRs from userspace only (as they are read-only MSRs) if LBR\nvirtualization is enabled. Additionally, to correctly restore L1\u0027s LBRs\nwhile L2 is running, make sure the LBRs are copied from the captured\nVMCB01 save area in svm_copy_vmrun_state().\n\nNote, for VMX, this also fixes a flaw where MSR_IA32_DEBUGCTLMSR isn\u0027t\nreported as an MSR to save/restore.\n\nNote #2, over-reporting MSR_IA32_LASTxxx on Intel is ok, as KVM already\nhandles unsupported reads and writes thanks to commit b5e2fec0ebc3 (\"KVM:\nIgnore DEBUGCTL MSRs with no effect\") (kvm_do_msr_access() will morph the\nunsupported userspace write into a nop).\n\n[sean: guard with lbrv checks, massage changelog]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:11.773Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bca0597272f9712b1f8ebd38b184db1dc2902ff7"
},
{
"url": "https://git.kernel.org/stable/c/4428a0a8643b0acf4ed7b8ea3e5975023bf4aafb"
},
{
"url": "https://git.kernel.org/stable/c/2b922a42b531a82d7881add14a7698dcdc5e1f0a"
},
{
"url": "https://git.kernel.org/stable/c/13a89ada5dcfc2539514c83ba5a2c61157f1ec6c"
},
{
"url": "https://git.kernel.org/stable/c/3700f0788da6acf73b2df56690f4b201aa4aefd2"
}
],
"title": "KVM: SVM: Add missing save/restore handling of LBR MSRs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46014",
"datePublished": "2026-05-27T12:56:16.052Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-11-06T16:13:31.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99100 (GCVE-0-2026-99100)
Vulnerability from cvelistv5
Published
2026-10-28 03:55
Modified
2026-11-01 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: validate firmware record lengths
The p54 firmware parser accesses component ID and component version
records without checking that their lengths cover the fields being read.
A malformed record can therefore make the parser read past the record.
Validate the component ID and component version record lengths before
accessing their data. The descriptor record is also checked against the
shortest descriptor length found in the supported firmware images.
Reject descriptor values that underflow the RX offset or produce an empty
RX range before updating the driver state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intersil/p54/fwio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87a9aba92485889d510052e474999a6ec00b888c",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "d5c28994b2c1440480fccd0b6c2ce72c23bb9fff",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "9af312d3607c8f9b5166a19cbf40cee351cc3a1d",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "dda5245afc3470d70406764e3d9f5508e534920a",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "f641066b0ddcd1b0cf007c0d04f9c966f6e888ae",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "8c4f962f368d5e17481f3c2c5a43028953e137a5",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "db7b86bd97b380ece8fa39cfdd7502a9fd35e56f",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intersil/p54/fwio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate firmware record lengths\n\nThe p54 firmware parser accesses component ID and component version\nrecords without checking that their lengths cover the fields being read.\nA malformed record can therefore make the parser read past the record.\n\nValidate the component ID and component version record lengths before\naccessing their data. The descriptor record is also checked against the\nshortest descriptor length found in the supported firmware images.\n\nReject descriptor values that underflow the RX offset or produce an empty\nRX range before updating the driver state."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T12:42:04.550Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87a9aba92485889d510052e474999a6ec00b888c"
},
{
"url": "https://git.kernel.org/stable/c/d5c28994b2c1440480fccd0b6c2ce72c23bb9fff"
},
{
"url": "https://git.kernel.org/stable/c/9af312d3607c8f9b5166a19cbf40cee351cc3a1d"
},
{
"url": "https://git.kernel.org/stable/c/dda5245afc3470d70406764e3d9f5508e534920a"
},
{
"url": "https://git.kernel.org/stable/c/f4c6fcc2ad462ffd76d6e6f909bcd6ae0391f5b7"
},
{
"url": "https://git.kernel.org/stable/c/f641066b0ddcd1b0cf007c0d04f9c966f6e888ae"
},
{
"url": "https://git.kernel.org/stable/c/8c4f962f368d5e17481f3c2c5a43028953e137a5"
},
{
"url": "https://git.kernel.org/stable/c/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f"
}
],
"title": "wifi: p54: validate firmware record lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99100",
"datePublished": "2026-10-28T03:55:38.898Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-11-01T12:42:04.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90179 (GCVE-0-2026-90179)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix deadlock in complain-mode change_hat
The use of change_hat when in complain mode can cause a deadlock
when the hat doesn't exist and a new learning profile is created
for the missing profile. This is because change_hat() has taken
the lock to search the hat list and creating the new learning
profile needs to take the lock to add it to the list.
From the bug report:
Originally found in 7.0.0 in LTS ubuntu 26.04 with pam_apparmor + su
in complain mode set to change hats. Then verified in newest
available vanilla kernel I've compiled to see if still present:
7.2-rc7 vanilla -> affected
checked also some other kernels:
6.18.44 vanilla -> affected
6.12.95 with debian patches -> unaffected
On systems without bug (for example 6.12.95 debian) it just prints:
aa_change_hat rc=0
On systems with bug, the executable always hangs, prints nothing and
becomes unkillable. (And once stuck this way, it will cause any
further hat changes to also cause the changing process to get stuck)
Then in syslog you can find hint about cause:
kernel: INFO: task hat:3409 blocked for more than 483 seconds.
kernel: Not tainted 7.2.0-rc7 #1
kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kernel: task:hat state:D stack:0 pid:3409 tgid:3409 ppid:2605 task_flags:0x400000 flags:0x00080800
kernel: Call Trace:
kernel: <TASK>
kernel: __schedule+0x48f/0xfe0
kernel: schedule+0x27/0xa0
kernel: schedule_preempt_disabled+0x15/0x30
kernel: __mutex_lock.constprop.0+0x569/0xa10
kernel: aa_new_learning_profile+0x15f/0x210
kernel: build_change_hat+0x19f/0x3b0
kernel: change_hat.isra.0+0x5dd/0xd60
kernel: aa_change_hat+0x2f3/0x710
kernel: aa_setprocattr_changehat+0x121/0x1f0
kernel: do_setattr+0x28c/0x340
kernel: apparmor_setselfattr+0x20/0x50
kernel: security_setselfattr+0xf6/0x110
kernel: __x64_sys_lsm_set_self_attr+0x53/0x90
kernel: do_syscall_64+0xdd/0x5e0
kernel: ? __mod_memcg_lruvec_state+0xfd/0x260
kernel: ? lruvec_stat_mod_folio+0x8d/0xd0
kernel: ? __folio_mod_stat+0x2d/0x90
kernel: ? map_anon_folio_pte_nopf+0xd1/0x1f0
kernel: ? do_anonymous_page+0x184/0xa10
kernel: ? __handle_mm_fault+0x805/0x870
kernel: ? count_memcg_events+0xef/0x230
kernel: ? handle_mm_fault+0x1f0/0x2f0
kernel: ? do_user_addr_fault+0x2bb/0x7b0
kernel: ? do_syscall_64+0x94/0x5e0
kernel: ? exc_page_fault+0x75/0x160
kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
kernel: RIP: 0033:0x7f815e134c8d
kernel: RSP: 002b:00007fff6df94ea8 EFLAGS: 00000246 ORIG_RAX: 00000000000001cc
kernel: RAX: ffffffffffffffda RBX: 0000556d8c81d040 RCX: 00007f815e134c8d
kernel: RDX: 0000000000000046 RSI: 0000556d8c81d040 RDI: 0000000000000064
kernel: RBP: 00007fff6df94ef0 R08: 00007f815e212ac8 R09: 000000000000000c
kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000556d8c81d010
kernel: R13: 0000000000000026 R14: 0000000000000046 R15: 0000000000000064
kernel: </TASK>
kernel: INFO: task hat:3409 is blocked on a mutex likely owned by task hat:3409.
To fix the issue, lift the locking out of the core of
aa_new_learning_profile(), introduce a wrapper function that takes the
lock where needed, and have build_change_hat() call the core function
that no longer takes the lock.
In addition fix 4 other issues introduced by commit
32e92764d6f8d ("apparmor: grab ns lock and refresh when looking up changehat child profiles")
- aa_get_profile_rcu() was replaced-by: aa_get_profile without the
accompanying rcu_dereference_protected()
- an extra aa_get_label(label) was introduced at the start of
change_hat() without an accompanying aa_put_label() causing a
reference count leak.
- a reference count leak was introduced in the label_is_stale(label)
case, where the newest profile would be leaked instead of the
label passed to the function.
- a potential UAF when the lookup walks up the tree with new_ns != ns
the new label refere
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9735e300a1c9259bfe4dc5ecdba472bb25574e8a Version: 5acb878db41328dae4d3249bc87b9ee4f290a663 Version: 6446dbe02f4a3592bf062b4d12105927993086af Version: b427061ca498309bf581bb6f8df4ffcfe4c772cd Version: 32e92764d6f8d251c1bca62be33793287b453a81 Version: 32e92764d6f8d251c1bca62be33793287b453a81 Version: 862ae1fcc78aea9acab2ac87cccf6431f4682b8e Version: 65f95c1e7ce70bf339504e22473879e02026cfc4 Version: 67ee65ec1a3eebdde76ccaa664d20dcf5b125a2f Version: 6.1.178 ≤ Version: 6.6.145 ≤ Version: 6.12.97 ≤ Version: 6.18.40 ≤ Version: 5.10.261 ≤ Version: 5.15.212 ≤ Version: 7.1.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/domain.c",
"security/apparmor/include/policy.h",
"security/apparmor/policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb8ac089815dc192d891294cf0ffeeafd910136a",
"status": "affected",
"version": "9735e300a1c9259bfe4dc5ecdba472bb25574e8a",
"versionType": "git"
},
{
"lessThan": "5f1fedccf3f7add5e2a1205ac4938fa3893c5874",
"status": "affected",
"version": "5acb878db41328dae4d3249bc87b9ee4f290a663",
"versionType": "git"
},
{
"lessThan": "91fce09d89b2d397996226216820f0e8b8149e22",
"status": "affected",
"version": "6446dbe02f4a3592bf062b4d12105927993086af",
"versionType": "git"
},
{
"lessThan": "00cce5e457cb690a3b3b3d334e76e71049ec8ae5",
"status": "affected",
"version": "b427061ca498309bf581bb6f8df4ffcfe4c772cd",
"versionType": "git"
},
{
"lessThan": "072fb5aeec2eac7d445bf28c7119a1d6f6a2e333",
"status": "affected",
"version": "32e92764d6f8d251c1bca62be33793287b453a81",
"versionType": "git"
},
{
"lessThan": "4ec11f14d1d6fdda787d991b142537be7841d395",
"status": "affected",
"version": "32e92764d6f8d251c1bca62be33793287b453a81",
"versionType": "git"
},
{
"status": "affected",
"version": "862ae1fcc78aea9acab2ac87cccf6431f4682b8e",
"versionType": "git"
},
{
"status": "affected",
"version": "65f95c1e7ce70bf339504e22473879e02026cfc4",
"versionType": "git"
},
{
"status": "affected",
"version": "67ee65ec1a3eebdde76ccaa664d20dcf5b125a2f",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThan": "6.18.52",
"status": "affected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/domain.c",
"security/apparmor/include/policy.h",
"security/apparmor/policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.178",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.18.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.212",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix deadlock in complain-mode change_hat\n\nThe use of change_hat when in complain mode can cause a deadlock\nwhen the hat doesn\u0027t exist and a new learning profile is created\nfor the missing profile. This is because change_hat() has taken\nthe lock to search the hat list and creating the new learning\nprofile needs to take the lock to add it to the list.\n\nFrom the bug report:\n\nOriginally found in 7.0.0 in LTS ubuntu 26.04 with pam_apparmor + su\nin complain mode set to change hats. Then verified in newest\navailable vanilla kernel I\u0027ve compiled to see if still present:\n\n7.2-rc7 vanilla -\u003e affected\n\nchecked also some other kernels:\n6.18.44 vanilla -\u003e affected\n6.12.95 with debian patches -\u003e unaffected\n\nOn systems without bug (for example 6.12.95 debian) it just prints:\n\naa_change_hat rc=0\n\nOn systems with bug, the executable always hangs, prints nothing and\nbecomes unkillable. (And once stuck this way, it will cause any\nfurther hat changes to also cause the changing process to get stuck)\n\nThen in syslog you can find hint about cause:\n\nkernel: INFO: task hat:3409 blocked for more than 483 seconds.\nkernel: Not tainted 7.2.0-rc7 #1\nkernel: \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nkernel: task:hat state:D stack:0 pid:3409 tgid:3409 ppid:2605 task_flags:0x400000 flags:0x00080800\nkernel: Call Trace:\nkernel: \u003cTASK\u003e\nkernel: __schedule+0x48f/0xfe0\nkernel: schedule+0x27/0xa0\nkernel: schedule_preempt_disabled+0x15/0x30\nkernel: __mutex_lock.constprop.0+0x569/0xa10\nkernel: aa_new_learning_profile+0x15f/0x210\nkernel: build_change_hat+0x19f/0x3b0\nkernel: change_hat.isra.0+0x5dd/0xd60\nkernel: aa_change_hat+0x2f3/0x710\nkernel: aa_setprocattr_changehat+0x121/0x1f0\nkernel: do_setattr+0x28c/0x340\nkernel: apparmor_setselfattr+0x20/0x50\nkernel: security_setselfattr+0xf6/0x110\nkernel: __x64_sys_lsm_set_self_attr+0x53/0x90\nkernel: do_syscall_64+0xdd/0x5e0\nkernel: ? __mod_memcg_lruvec_state+0xfd/0x260\nkernel: ? lruvec_stat_mod_folio+0x8d/0xd0\nkernel: ? __folio_mod_stat+0x2d/0x90\nkernel: ? map_anon_folio_pte_nopf+0xd1/0x1f0\nkernel: ? do_anonymous_page+0x184/0xa10\nkernel: ? __handle_mm_fault+0x805/0x870\nkernel: ? count_memcg_events+0xef/0x230\nkernel: ? handle_mm_fault+0x1f0/0x2f0\nkernel: ? do_user_addr_fault+0x2bb/0x7b0\nkernel: ? do_syscall_64+0x94/0x5e0\nkernel: ? exc_page_fault+0x75/0x160\nkernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e\nkernel: RIP: 0033:0x7f815e134c8d\nkernel: RSP: 002b:00007fff6df94ea8 EFLAGS: 00000246 ORIG_RAX: 00000000000001cc\nkernel: RAX: ffffffffffffffda RBX: 0000556d8c81d040 RCX: 00007f815e134c8d\nkernel: RDX: 0000000000000046 RSI: 0000556d8c81d040 RDI: 0000000000000064\nkernel: RBP: 00007fff6df94ef0 R08: 00007f815e212ac8 R09: 000000000000000c\nkernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000556d8c81d010\nkernel: R13: 0000000000000026 R14: 0000000000000046 R15: 0000000000000064\nkernel: \u003c/TASK\u003e\nkernel: INFO: task hat:3409 is blocked on a mutex likely owned by task hat:3409.\n\nTo fix the issue, lift the locking out of the core of\naa_new_learning_profile(), introduce a wrapper function that takes the\nlock where needed, and have build_change_hat() call the core function\nthat no longer takes the lock.\n\nIn addition fix 4 other issues introduced by commit\n32e92764d6f8d (\"apparmor: grab ns lock and refresh when looking up changehat child profiles\")\n- aa_get_profile_rcu() was replaced-by: aa_get_profile without the\n accompanying rcu_dereference_protected()\n- an extra aa_get_label(label) was introduced at the start of\n change_hat() without an accompanying aa_put_label() causing a\n reference count leak.\n- a reference count leak was introduced in the label_is_stale(label)\n case, where the newest profile would be leaked instead of the\n label passed to the function.\n- a potential UAF when the lookup walks up the tree with new_ns != ns\n the new label refere\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:37.762Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb8ac089815dc192d891294cf0ffeeafd910136a"
},
{
"url": "https://git.kernel.org/stable/c/5f1fedccf3f7add5e2a1205ac4938fa3893c5874"
},
{
"url": "https://git.kernel.org/stable/c/91fce09d89b2d397996226216820f0e8b8149e22"
},
{
"url": "https://git.kernel.org/stable/c/00cce5e457cb690a3b3b3d334e76e71049ec8ae5"
},
{
"url": "https://git.kernel.org/stable/c/072fb5aeec2eac7d445bf28c7119a1d6f6a2e333"
},
{
"url": "https://git.kernel.org/stable/c/4ec11f14d1d6fdda787d991b142537be7841d395"
}
],
"title": "apparmor: fix deadlock in complain-mode change_hat",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90179",
"datePublished": "2026-09-17T16:07:04.413Z",
"dateReserved": "2026-09-11T19:38:34.791Z",
"dateUpdated": "2026-10-30T12:34:37.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68174 (GCVE-0-2025-68174)
Vulnerability from cvelistv5
Published
2025-12-16 13:42
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
amd/amdkfd: enhance kfd process check in switch partition
current switch partition only check if kfd_processes_table is empty.
kfd_prcesses_table entry is deleted in kfd_process_notifier_release, but
kfd_process tear down is in kfd_process_wq_release.
consider two processes:
Process A (workqueue) -> kfd_process_wq_release -> Access kfd_node member
Process B switch partition -> amdgpu_xcp_pre_partition_switch -> amdgpu_amdkfd_device_fini_sw
-> kfd_node tear down.
Process A and B may trigger a race as shown in dmesg log.
This patch is to resolve the race by adding an atomic kfd_process counter
kfd_processes_count, it increment as create kfd process, decrement as
finish kfd_process_wq_release.
v2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds
and bug fix. (Philip Yang)
[3966658.307702] divide error: 0000 [#1] SMP NOPTI
[3966658.350818] i10nm_edac
[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted
[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]
[3966658.362839] nfit
[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]
[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 <f7> be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00
[3966658.380967] x86_pkg_temp_thermal
[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246
[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000
[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00
[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4
[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000
[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800
[3966658.391533] FS: 0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000
[3966658.391534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0
[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[3966658.391536] PKRU: 55555554
[3966658.391536] Call Trace:
[3966658.391674] deallocate_sdma_queue+0x38/0xa0 [amdgpu]
[3966658.391762] process_termination_cpsch+0x1ed/0x480 [amdgpu]
[3966658.399754] intel_powerclamp
[3966658.402831] kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]
[3966658.402908] kfd_process_wq_release+0x1a/0x1a0 [amdgpu]
[3966658.410516] coretemp
[3966658.434016] process_one_work+0x1ad/0x380
[3966658.434021] worker_thread+0x49/0x310
[3966658.438963] kvm_intel
[3966658.446041] ? process_one_work+0x380/0x380
[3966658.446045] kthread+0x118/0x140
[3966658.446047] ? __kthread_bind_mask+0x60/0x60
[3966658.446050] ret_from_fork+0x1f/0x30
[3966658.446053] Modules linked in: kpatch_20765354(OEK)
[3966658.455310] kvm
[3966658.464534] mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)
[3966658.473462] idxd_mdev
[3966658.482306] kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqo
---truncated---
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device.c",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h",
"drivers/gpu/drm/amd/amdkfd/kfd_process.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3385a1def2df45ac04a70532dfcd20d9eeac9fbb",
"status": "affected",
"version": "0c7315e7d5ef9b36ca4db32ffeb34a187cbaf231",
"versionType": "git"
},
{
"lessThan": "536d80f660ec12058e461f4db387ea42bee9250d",
"status": "affected",
"version": "0c7315e7d5ef9b36ca4db32ffeb34a187cbaf231",
"versionType": "git"
},
{
"lessThan": "45da20e00d5da842e17dfc633072b127504f0d0e",
"status": "affected",
"version": "0c7315e7d5ef9b36ca4db32ffeb34a187cbaf231",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device.c",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h",
"drivers/gpu/drm/amd/amdkfd/kfd_process.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: enhance kfd process check in switch partition\n\ncurrent switch partition only check if kfd_processes_table is empty.\nkfd_prcesses_table entry is deleted in kfd_process_notifier_release, but\nkfd_process tear down is in kfd_process_wq_release.\n\nconsider two processes:\n\nProcess A (workqueue) -\u003e kfd_process_wq_release -\u003e Access kfd_node member\nProcess B switch partition -\u003e amdgpu_xcp_pre_partition_switch -\u003e amdgpu_amdkfd_device_fini_sw\n-\u003e kfd_node tear down.\n\nProcess A and B may trigger a race as shown in dmesg log.\n\nThis patch is to resolve the race by adding an atomic kfd_process counter\nkfd_processes_count, it increment as create kfd process, decrement as\nfinish kfd_process_wq_release.\n\nv2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds\nand bug fix. (Philip Yang)\n\n[3966658.307702] divide error: 0000 [#1] SMP NOPTI\n[3966658.350818] i10nm_edac\n[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted\n[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]\n[3966658.362839] nfit\n[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]\n[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 \u003cf7\u003e be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00\n[3966658.380967] x86_pkg_temp_thermal\n[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246\n[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000\n[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00\n[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4\n[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000\n[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800\n[3966658.391533] FS: 0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000\n[3966658.391534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0\n[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[3966658.391536] PKRU: 55555554\n[3966658.391536] Call Trace:\n[3966658.391674] deallocate_sdma_queue+0x38/0xa0 [amdgpu]\n[3966658.391762] process_termination_cpsch+0x1ed/0x480 [amdgpu]\n[3966658.399754] intel_powerclamp\n[3966658.402831] kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]\n[3966658.402908] kfd_process_wq_release+0x1a/0x1a0 [amdgpu]\n[3966658.410516] coretemp\n[3966658.434016] process_one_work+0x1ad/0x380\n[3966658.434021] worker_thread+0x49/0x310\n[3966658.438963] kvm_intel\n[3966658.446041] ? process_one_work+0x380/0x380\n[3966658.446045] kthread+0x118/0x140\n[3966658.446047] ? __kthread_bind_mask+0x60/0x60\n[3966658.446050] ret_from_fork+0x1f/0x30\n[3966658.446053] Modules linked in: kpatch_20765354(OEK)\n[3966658.455310] kvm\n[3966658.464534] mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)\n[3966658.473462] idxd_mdev\n[3966658.482306] kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqo\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access to the `/dev/kfd` character device to create the KFD process whose deferred teardown races the partition switch, and the free side is driven through a local sysfs attribute. There is no network-reachable path into `kfd_process_wq_release()` or `amdgpu_xcp_switch_partition_mode()`.\nAC:L - The attacker controls the UAF side directly and can widen the window from milliseconds to seconds (`flush_workqueue` + `synchronize_rcu` + bulk BO/SVM teardown in `kfd_process_wq_release()`), and on MI300-class multi-tenant hosts the partition switch is an automated orchestrator action performed at job boundaries \u2014 precisely when the attacker\u0027s process teardown is still in flight \u2014 so the collision is reliably reproducible rather than dependent on chance memory layout.\nPR:L - `kfd_open()` performs no capability check, so any unprivileged local user or container tenant with `/dev/kfd` (mode 0666 or the `render` group under standard ROCm udev rules) can create the KFD process and pdd that leave stale `kfd_node` references in the pending workqueue item. No root or capability is needed on the attacker\u0027s side of the race.\nUI:N - The vulnerable window opens automatically at process exit via the mmu_notifier release callback, with no victim action required. In the datacenter deployments where XCP repartitioning exists, the partition switch is issued by an automated scheduler/orchestrator with no human in the loop.\nS:U - The corrupted objects (`kfd_node`, `kfd_dev`, `device_queue_manager`) and the resulting code execution all live in host kernel memory, within the same security authority as the vulnerable component. No hypervisor, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - This is a use-after-free where freed slab contents are read back and used as pointers (`pdd-\u003edev-\u003ekfd`, `pdd-\u003edev-\u003eadev`, `dqm-\u003eops`), so an attacker who reclaims the freed `kfd_node`/`dqm` allocations gains a controlled kernel read primitive that can be escalated to arbitrary memory disclosure.\nI:H - The stale references yield both an arbitrary-ish write \u2014 `set_bit(q-\u003esdma_id, dqm-\u003esdma_bitmap)` whose target and bound are both read from freed memory \u2014 and a direct indirect call through a function pointer in the freed `dqm` (`dev-\u003edqm-\u003eops.process_termination`), which is a textbook control-flow hijack primitive once the slab is sprayed.\nA:H - The commit\u0027s own dmesg shows a fatal kernel oops (`divide error` in `kfd_get_num_sdma_engines` from the `kfd_process_wq` kworker) caused by reading `num_nodes == 0` out of the freed `kfd_dev`. Any unhandled UAF here panics the machine, taking down a shared GPU compute node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:59.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3385a1def2df45ac04a70532dfcd20d9eeac9fbb"
},
{
"url": "https://git.kernel.org/stable/c/536d80f660ec12058e461f4db387ea42bee9250d"
},
{
"url": "https://git.kernel.org/stable/c/45da20e00d5da842e17dfc633072b127504f0d0e"
}
],
"title": "amd/amdkfd: enhance kfd process check in switch partition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68174",
"datePublished": "2025-12-16T13:42:53.891Z",
"dateReserved": "2025-12-16T13:41:40.251Z",
"dateUpdated": "2026-10-21T12:37:59.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64036 (GCVE-0-2026-64036)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup/rstat: validate cpu before css_rstat_cpu() access
css_rstat_updated() is exposed as a BPF kfunc and accepts a
caller-provided cpu argument. The function uses cpu for per-cpu rstat
lookups without checking whether it refers to a valid possible CPU.
A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an
invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==
0x7fffffff triggers:
UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9
index 2147483647 is out of range for type 'long unsigned int [64]'
Call Trace:
css_rstat_updated
bpf_iter_run_prog
cgroup_iter_seq_show
bpf_seq_read
Add cpu validation to the BPF-facing css_rstat_updated() kfunc and
move the common implementation to __css_rstat_updated() for in-kernel
callers.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a319185be9f5ad13c2a296d448ac52ffe45d194c Version: a319185be9f5ad13c2a296d448ac52ffe45d194c Version: a319185be9f5ad13c2a296d448ac52ffe45d194c Version: a319185be9f5ad13c2a296d448ac52ffe45d194c Version: a319185be9f5ad13c2a296d448ac52ffe45d194c Version: a319185be9f5ad13c2a296d448ac52ffe45d194c |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64036",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:47.371867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:10.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c",
"include/linux/cgroup.h",
"kernel/cgroup/rstat.c",
"mm/memcontrol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee5afb74688aa6f1f16d8c7e7b6bfaf803fb62fc",
"status": "affected",
"version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
"versionType": "git"
},
{
"lessThan": "b28b862b07257219755d0b0a7fbe5d23b7c9ea91",
"status": "affected",
"version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
"versionType": "git"
},
{
"lessThan": "3d595affbe00a2e8bf43b9f2947a8efcdc1c059e",
"status": "affected",
"version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
"versionType": "git"
},
{
"lessThan": "6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6",
"status": "affected",
"version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
"versionType": "git"
},
{
"lessThan": "fd2bd9fa7700ddf28296486b2598cff2f80cc819",
"status": "affected",
"version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
"versionType": "git"
},
{
"lessThan": "8817005efbdfdf5d4e4814cb5dc52b53d12917d7",
"status": "affected",
"version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c",
"include/linux/cgroup.h",
"kernel/cgroup/rstat.c",
"mm/memcontrol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/rstat: validate cpu before css_rstat_cpu() access\n\ncss_rstat_updated() is exposed as a BPF kfunc and accepts a\ncaller-provided cpu argument. The function uses cpu for per-cpu rstat\nlookups without checking whether it refers to a valid possible CPU.\n\nA BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an\ninvalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==\n0x7fffffff triggers:\n\n UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9\n index 2147483647 is out of range for type \u0027long unsigned int [64]\u0027\n Call Trace:\n css_rstat_updated\n bpf_iter_run_prog\n cgroup_iter_seq_show\n bpf_seq_read\n\nAdd cpu validation to the BPF-facing css_rstat_updated() kfunc and\nmove the common implementation to __css_rstat_updated() for in-kernel\ncallers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires loading and running a BPF cgroup iterator/tracing program via local syscalls (bpf, read on iter fd); the call chain is css_rstat_updated \u2192 bpf_iter_run_prog \u2192 cgroup_iter_seq_show \u2192 bpf_seq_read, with no network-facing entry point.\nAC:L - The attacker fully controls the cpu argument passed from BPF (e.g. 0x7fffffff) and can trigger the bug deterministically on each iter read without races or victim-specific state.\nPR:L - Exploitation requires CAP_BPF and CAP_PERFMON to load and run BPF_PROG_TYPE_TRACING/cgroup-iter programs that can invoke the css_rstat_updated kfunc, as stated in the fix commit; these are elevated but not full init-namespace root privileges.\nUI:N - No victim interaction is required; the attacker triggers the bug by loading their own BPF program and reading from the attached iterator file descriptor.\nS:U - The vulnerability corrupts kernel memory from within kernel BPF context on the same host; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:H - An invalid cpu indexes __per_cpu_offset[] out of bounds and yields a wild pointer used for structure reads (llist_on_list), enabling kernel memory disclosure beyond a bounded leak.\nI:H - The same out-of-bounds pointer is written via try_cmpxchg on llist_node.next and llist_add into a per-CPU list head, giving exploitable out-of-bounds kernel memory corruption.\nA:H - Operating on attacker-chosen out-of-bounds kernel addresses can cause kernel oops, panic, or hang during the corrupting cmpxchg/list operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:30.942Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee5afb74688aa6f1f16d8c7e7b6bfaf803fb62fc"
},
{
"url": "https://git.kernel.org/stable/c/b28b862b07257219755d0b0a7fbe5d23b7c9ea91"
},
{
"url": "https://git.kernel.org/stable/c/3d595affbe00a2e8bf43b9f2947a8efcdc1c059e"
},
{
"url": "https://git.kernel.org/stable/c/6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6"
},
{
"url": "https://git.kernel.org/stable/c/fd2bd9fa7700ddf28296486b2598cff2f80cc819"
},
{
"url": "https://git.kernel.org/stable/c/8817005efbdfdf5d4e4814cb5dc52b53d12917d7"
}
],
"title": "cgroup/rstat: validate cpu before css_rstat_cpu() access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64036",
"datePublished": "2026-07-19T15:39:24.783Z",
"dateReserved": "2026-07-19T07:54:57.028Z",
"dateUpdated": "2026-10-30T12:27:30.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68375 (GCVE-0-2026-68375)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Handle partially initialized auxiliary devices
bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
used by bnxt_aux_dev_release() are initialized. After
auxiliary_device_init() succeeds, later errors must unwind with
auxiliary_device_uninit(), which invokes the release callback.
The release callback assumes that aux_priv->id, aux_priv->edev,
edev->net and edev->ulp_tbl are all populated. If allocation fails
after auxiliary_device_init(), the release path can otherwise dereference
or clear partially initialized state.
Allocate and attach the bnxt_en_dev and ULP table before calling
auxiliary_device_init(), so the release callback only sees a fully
initialized auxiliary private object. If auxiliary_device_init() itself
fails, free those allocations directly because device_initialize() has not
run and the release callback will not be invoked.
This issue was found by a static analysis checker and confirmed by manual
source review.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e75f1a5b267e820f5b7900c16d84f12c122218cc",
"status": "affected",
"version": "194fad5b27815ca80e832ac875c0026ff96fc243",
"versionType": "git"
},
{
"lessThan": "8549ac21ab503fc7a40bfa8e6beb69e6320d9877",
"status": "affected",
"version": "194fad5b27815ca80e832ac875c0026ff96fc243",
"versionType": "git"
},
{
"lessThan": "4e1caa5fdd0dea36938fe39cceb1522e9d86c937",
"status": "affected",
"version": "194fad5b27815ca80e832ac875c0026ff96fc243",
"versionType": "git"
},
{
"lessThan": "1cb8553c02e93e5a150cebd42f9ee3db0ece4707",
"status": "affected",
"version": "194fad5b27815ca80e832ac875c0026ff96fc243",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Handle partially initialized auxiliary devices\n\nbnxt_aux_devices_init() calls auxiliary_device_init() before all fields\nused by bnxt_aux_dev_release() are initialized. After\nauxiliary_device_init() succeeds, later errors must unwind with\nauxiliary_device_uninit(), which invokes the release callback.\n\nThe release callback assumes that aux_priv-\u003eid, aux_priv-\u003eedev,\nedev-\u003enet and edev-\u003eulp_tbl are all populated. If allocation fails\nafter auxiliary_device_init(), the release path can otherwise dereference\nor clear partially initialized state.\n\nAllocate and attach the bnxt_en_dev and ULP table before calling\nauxiliary_device_init(), so the release callback only sees a fully\ninitialized auxiliary private object. If auxiliary_device_init() itself\nfails, free those allocations directly because device_initialize() has not\nrun and the release callback will not be invoked.\n\nThis issue was found by a static analysis checker and confirmed by manual\nsource review."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:53.285Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e75f1a5b267e820f5b7900c16d84f12c122218cc"
},
{
"url": "https://git.kernel.org/stable/c/8549ac21ab503fc7a40bfa8e6beb69e6320d9877"
},
{
"url": "https://git.kernel.org/stable/c/4e1caa5fdd0dea36938fe39cceb1522e9d86c937"
},
{
"url": "https://git.kernel.org/stable/c/1cb8553c02e93e5a150cebd42f9ee3db0ece4707"
}
],
"title": "bnxt_en: Handle partially initialized auxiliary devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68375",
"datePublished": "2026-08-10T12:03:53.659Z",
"dateReserved": "2026-07-30T09:28:09.386Z",
"dateUpdated": "2026-10-21T12:43:53.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90234 (GCVE-0-2026-90234)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFS: Return a delegation the client fails to record
When an NFS server grants a delegation in an OPEN reply,
nfs_inode_set_delegation() records it on the client. However, three
of its error flows return without sending DELEGRETURN.
A delegation can be relinquished only by DELEGRETURN (RFC 8881
Section 20.2.4), so dropping one silently leaves the server believing
the client still holds it. If the server happens to recall that
delegation, the client answers CB_RECALL with NFS4ERR_BADHANDLE
because it has no record of the stateid. The server revokes the
delegation and moves it onto its cl_revoked list, because the client
never sends the FREE_STATEID that would drain it. Every subsequent
SEQUENCE reply then carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED,
and the client's state manager loops issuing TEST_STATEID across its
delegations without ever clearing the condition.
The window is easy to reach now that a server offers a write
delegation on any write OPEN: a delegation recalled for one opener
races a re-open that the server answers with a fresh write
delegation.
Instead of dropping it, hand the delegation back during these error
flows.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ade04647dd56881e285983af3db702d56ee97e86 Version: ade04647dd56881e285983af3db702d56ee97e86 Version: ade04647dd56881e285983af3db702d56ee97e86 Version: ade04647dd56881e285983af3db702d56ee97e86 Version: ade04647dd56881e285983af3db702d56ee97e86 Version: ade04647dd56881e285983af3db702d56ee97e86 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/delegation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61b23f482b2082e77d2f78bd1624f93a12ec35ce",
"status": "affected",
"version": "ade04647dd56881e285983af3db702d56ee97e86",
"versionType": "git"
},
{
"lessThan": "9e71e332fa2c7a48f3d00001f856a13cc2d69639",
"status": "affected",
"version": "ade04647dd56881e285983af3db702d56ee97e86",
"versionType": "git"
},
{
"lessThan": "fe3b1c8966a27b70599d28ce7e80819adac1ff22",
"status": "affected",
"version": "ade04647dd56881e285983af3db702d56ee97e86",
"versionType": "git"
},
{
"lessThan": "6822ba1ae9b6df6a094f7f8998f1da734c85fa19",
"status": "affected",
"version": "ade04647dd56881e285983af3db702d56ee97e86",
"versionType": "git"
},
{
"lessThan": "92533e49fe3c455088657b862cf3562260c0ce25",
"status": "affected",
"version": "ade04647dd56881e285983af3db702d56ee97e86",
"versionType": "git"
},
{
"lessThan": "220af23d863995091f0edeb1e6aa0945b3db8b37",
"status": "affected",
"version": "ade04647dd56881e285983af3db702d56ee97e86",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/delegation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Return a delegation the client fails to record\n\nWhen an NFS server grants a delegation in an OPEN reply,\nnfs_inode_set_delegation() records it on the client. However, three\nof its error flows return without sending DELEGRETURN.\n\nA delegation can be relinquished only by DELEGRETURN (RFC 8881\nSection 20.2.4), so dropping one silently leaves the server believing\nthe client still holds it. If the server happens to recall that\ndelegation, the client answers CB_RECALL with NFS4ERR_BADHANDLE\nbecause it has no record of the stateid. The server revokes the\ndelegation and moves it onto its cl_revoked list, because the client\nnever sends the FREE_STATEID that would drain it. Every subsequent\nSEQUENCE reply then carries SEQ4_STATUS_RECALLABLE_STATE_REVOKED,\nand the client\u0027s state manager loops issuing TEST_STATEID across its\ndelegations without ever clearing the condition.\n\nThe window is easy to reach now that a server offers a write\ndelegation on any write OPEN: a delegation recalled for one opener\nraces a re-open that the server answers with a fresh write\ndelegation.\n\nInstead of dropping it, hand the delegation back during these error\nflows."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nfs_inode_set_delegation() is reached from nfs4_process_delegation() after _nfs4_opendata_to_nfs4_state() consumes an NFSv4 OPEN reply; decode_rw_delegation() takes the WRITE open_delegation4 (stateid, want_recall) off that TCP ONC RPC reply, so the remote NFS server supplies the delegation the client then drops without DELEGRETURN.\nAC:L - When the inode\u0027s old delegation has NFS_DELEGATION_RETURNING set, a concurrent write OPEN whose reply carries a different write stateid hits test_and_set_bit(NFS_DELEGATION_RETURNING) or a failed nfs_detach_delegations_locked() and is freed without nfs_do_return_delegation(); nfs4_callback_recall() queues that return and the server can delay DELEGRETURN, so it times both RPCs.\nPR:N - nfs4_process_delegation() and nfs4_callback_recall() run on the established NFSv4 session with no capable() or local uid check; the attacker is the NFS server peer that authored the OPEN reply and CB_RECALL and needs no account or mount privilege on the client.\nUI:N - On an already-mounted NFSv4 share, ordinary open() through nfs4_atomic_open()/nfs4_file_open() drives the OPEN RPC; the server plants the unrecorded WRITE delegation in that reply and sends CB_RECALL, with no further victim action such as mounting a new image.\nS:U - The nfs4_state_manager() recovery loop and nfs4_begin_drain_session() of cl_session stay inside the NFS client kernel; this does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The dropped object is a kmalloc\u0027d nfs_delegation that was never published on nfsi-\u003edelegation; __nfs_free_delegation() frees it immediately, with no use-after-free, out-of-bounds read, or leftover pointer that could disclose kernel memory.\nI:N - The same unused nfs_delegation is only kfree_rcu\u0027d; nfs_inode_set_delegation() does not write through a dangling pointer or overflow a buffer, so there is no arbitrary write or control-flow hijack.\nA:H - After CB_RECALL of the orphaned stateid, nfs_delegation_find_inode() misses it so nfs4_callback_recall() returns NFS4ERR_BADHANDLE; SEQ4_STATUS_RECALLABLE_STATE_REVOKED then makes nfs41_handle_recallable_state_revoked() reschedule nfs_test_expired_all_delegations() forever, and nfs4_begin_drain_session() hangs subsequent NFSv4 RPCs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:52.905Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61b23f482b2082e77d2f78bd1624f93a12ec35ce"
},
{
"url": "https://git.kernel.org/stable/c/9e71e332fa2c7a48f3d00001f856a13cc2d69639"
},
{
"url": "https://git.kernel.org/stable/c/fe3b1c8966a27b70599d28ce7e80819adac1ff22"
},
{
"url": "https://git.kernel.org/stable/c/6822ba1ae9b6df6a094f7f8998f1da734c85fa19"
},
{
"url": "https://git.kernel.org/stable/c/92533e49fe3c455088657b862cf3562260c0ce25"
},
{
"url": "https://git.kernel.org/stable/c/220af23d863995091f0edeb1e6aa0945b3db8b37"
}
],
"title": "NFS: Return a delegation the client fails to record",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90234",
"datePublished": "2026-09-17T16:07:40.584Z",
"dateReserved": "2026-09-11T19:38:34.794Z",
"dateUpdated": "2026-10-30T12:34:52.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99152 (GCVE-0-2026-99152)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Validate the task named by a management response
__iscsi_complete_pdu() fetches the task for five response types from one
place and checks only that the index resolved:
case ISCSI_OP_LOGOUT_RSP:
case ISCSI_OP_LOGIN_RSP:
case ISCSI_OP_TEXT_RSP:
case ISCSI_OP_SCSI_TMFUNC_RSP:
case ISCSI_OP_NOOP_IN:
task = iscsi_itt_to_task(conn, hdr->itt);
if (!task)
return ISCSI_ERR_BAD_ITT;
iscsi_itt_to_task() bounds the index against cmds_max and looks at
nothing else, so a target can name any slot in the pool, including one
that has never been used. task->conn is then NULL, and both
iscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One
unsolicited NOP-In is enough; a Text Response carrying the same ITT
crashes in iscsi_complete_task() instead.
Require the task to be in flight and not a SCSI command, the way
iscsi_itt_to_ctask() does for the command opcodes.
[ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
[ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
[ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160
[ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00
[ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206
[ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020
[ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060
[ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000
[ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800
[ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000
[ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0
[ 6.298712] PKRU: 55555554
[ 6.298713] Call Trace:
[ 6.298714] <IRQ>
[ 6.298714] __iscsi_complete_pdu+0x13a8/0x22a0
[ 6.298758] iscsi_complete_pdu+0x54/0xa0
[ 6.298759] iscsi_tcp_hdr_recv_done+0x870/0x2c80
[ 6.298778] iscsi_tcp_recv_skb+0x31e/0xec0
[ 6.298800] iscsi_sw_tcp_recv+0x12f/0x390
[ 6.298804] __tcp_read_sock+0x1ab/0x810
[ 6.298812] iscsi_sw_tcp_data_ready+0x18b/0x510
[ 6.298814] tcp_rcv_established+0x1f56/0x3a00
[ 6.298842] tcp_v4_do_rcv+0x449/0x960
[ 6.298847] tcp_v4_rcv+0x2245/0x3bc0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf4035656852a386fecb5d6217710a1bde536e76",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "5b56229cc152095fbe4e4ff537cb206c4aa41610",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "7a7a473aec51195778a54fdd71f20fda3047b8ef",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "77134cf996bab55683f0ceafb9e300d97ac046f8",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "e96ae694c5038aae84142b64e41b56324b7af9a7",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "55a65ef61e2775aeb18fda63bd1959fa8b41f936",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "f721487523d45941aed4b0ac8d829b0461a7d860",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "11bffcd9cb346732eab2914ef44fe777a3f0b585",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Validate the task named by a management response\n\n__iscsi_complete_pdu() fetches the task for five response types from one\nplace and checks only that the index resolved:\n\n case ISCSI_OP_LOGOUT_RSP:\n case ISCSI_OP_LOGIN_RSP:\n case ISCSI_OP_TEXT_RSP:\n case ISCSI_OP_SCSI_TMFUNC_RSP:\n case ISCSI_OP_NOOP_IN:\n task = iscsi_itt_to_task(conn, hdr-\u003eitt);\n if (!task)\n return ISCSI_ERR_BAD_ITT;\n\niscsi_itt_to_task() bounds the index against cmds_max and looks at\nnothing else, so a target can name any slot in the pool, including one\nthat has never been used. task-\u003econn is then NULL, and both\niscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One\nunsolicited NOP-In is enough; a Text Response carrying the same ITT\ncrashes in iscsi_complete_task() instead.\n\nRequire the task to be in flight and not a SCSI command, the way\niscsi_itt_to_ctask() does for the command opcodes.\n\n[ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI\n[ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\n[ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy)\n[ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160\n[ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00\n[ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206\n[ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020\n[ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060\n[ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n[ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000\n[ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800\n[ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000\n[ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0\n[ 6.298712] PKRU: 55555554\n[ 6.298713] Call Trace:\n[ 6.298714] \u003cIRQ\u003e\n[ 6.298714] __iscsi_complete_pdu+0x13a8/0x22a0\n[ 6.298758] iscsi_complete_pdu+0x54/0xa0\n[ 6.298759] iscsi_tcp_hdr_recv_done+0x870/0x2c80\n[ 6.298778] iscsi_tcp_recv_skb+0x31e/0xec0\n[ 6.298800] iscsi_sw_tcp_recv+0x12f/0x390\n[ 6.298804] __tcp_read_sock+0x1ab/0x810\n[ 6.298812] iscsi_sw_tcp_data_ready+0x18b/0x510\n[ 6.298814] tcp_rcv_established+0x1f56/0x3a00\n[ 6.298842] tcp_v4_do_rcv+0x449/0x960\n[ 6.298847] tcp_v4_rcv+0x2245/0x3bc0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An iSCSI target supplies the forged ITT in an ISCSI_OP_NOOP_IN PDU over routable TCP; iscsi_sw_tcp_data_ready() through iscsi_tcp_hdr_dissect() and iscsi_complete_pdu() reaches the patched __iscsi_complete_pdu().\nAC:L - iscsi_pool_init() zeroes every task and iscsi_conn_setup() removes only the login task, leaving deterministic in-range slots with task-\u003econn NULL. One NOP-In with the session age, a free-slot index, reserved TTT, and no data triggers the fault without a race.\nPR:N - iscsi_sw_tcp_conn_bind() enables receive processing before iscsi_conn_start() marks the session logged in, while __iscsi_complete_pdu() has no CHAP or session-state gate. The target therefore needs no credentials or local capability.\nUI:N - On a bound or automatically restored iSCSI session, iscsi_sw_tcp_data_ready() parses the target\u0027s NOP-In immediately; no user must open data or perform another action.\nS:U - __iscsi_complete_pdu() misidentifies a task inside the host kernel\u0027s own iscsi_session pool, and the resulting fault affects that same kernel without crossing a VM, IOMMU, or other security boundary.\nC:N - iscsi_nop_out_rsp() reads conn-\u003eping_task through the NULL task-\u003econn pointer and exposes no data to the target. Selecting an active SCSI slot returns any unfilled buffer only to the local requester, not to the remote attacker.\nI:N - The NULL-slot path performs no attacker-controlled write. An active SCSI slot can be completed early, but this supplies no host-memory write or control-flow primitive beyond the target\u0027s existing authority to acknowledge its own remote block operations.\nA:H - A single forged NOP-In naming a zeroed free slot makes iscsi_nop_out_rsp() dereference task-\u003econn at conn-\u003eping_task, producing the demonstrated general-protection fault in IRQ context and potentially panicking the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:00.040Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf4035656852a386fecb5d6217710a1bde536e76"
},
{
"url": "https://git.kernel.org/stable/c/5b56229cc152095fbe4e4ff537cb206c4aa41610"
},
{
"url": "https://git.kernel.org/stable/c/7a7a473aec51195778a54fdd71f20fda3047b8ef"
},
{
"url": "https://git.kernel.org/stable/c/77134cf996bab55683f0ceafb9e300d97ac046f8"
},
{
"url": "https://git.kernel.org/stable/c/e96ae694c5038aae84142b64e41b56324b7af9a7"
},
{
"url": "https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936"
},
{
"url": "https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860"
},
{
"url": "https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585"
}
],
"title": "scsi: libiscsi: Validate the task named by a management response",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99152",
"datePublished": "2026-10-28T10:35:07.622Z",
"dateReserved": "2026-09-25T10:25:14.396Z",
"dateUpdated": "2026-10-31T12:44:00.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89534 (GCVE-0-2026-89534)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,
it creates a replacement listener cm_id and returns 1, telling
the CM core to destroy the old one. If the replacement allocation
fails, sc_cm_id still points at the old cm_id that the CM core is
about to destroy. Any subsequent dereference of sc_cm_id --
such as svc_rdma_detach()'s rdma_disconnect() call -- is a
use-after-free.
NULL sc_cm_id on the failure path and guard svc_rdma_detach()'s
rdma_disconnect() call against NULL so that the listener can
be torn down safely when the server shuts down.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d1b586e75ec619dde1af47e21a41a6b1b51874c2 Version: d1b586e75ec619dde1af47e21a41a6b1b51874c2 Version: d1b586e75ec619dde1af47e21a41a6b1b51874c2 Version: d1b586e75ec619dde1af47e21a41a6b1b51874c2 Version: 2f84d6e8b0a7093758d8da19cec111140e7b6d41 Version: 5cd069ad1cf7fb46af31f0dbe2850868335f5272 Version: 6.1.191 ≤ Version: 6.6.160 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a68aeb2de8ad0fef9c50e73a50622a35c6af1a8",
"status": "affected",
"version": "d1b586e75ec619dde1af47e21a41a6b1b51874c2",
"versionType": "git"
},
{
"lessThan": "65f0f82f20334e76acaf29087a59af7b3b9699ed",
"status": "affected",
"version": "d1b586e75ec619dde1af47e21a41a6b1b51874c2",
"versionType": "git"
},
{
"lessThan": "673e358ab7c11f8cec223c6a36a793056a67facd",
"status": "affected",
"version": "d1b586e75ec619dde1af47e21a41a6b1b51874c2",
"versionType": "git"
},
{
"lessThan": "01500306e1d50de7ca7a2cdcdfa28ac0523eb747",
"status": "affected",
"version": "d1b586e75ec619dde1af47e21a41a6b1b51874c2",
"versionType": "git"
},
{
"status": "affected",
"version": "2f84d6e8b0a7093758d8da19cec111140e7b6d41",
"versionType": "git"
},
{
"status": "affected",
"version": "5cd069ad1cf7fb46af31f0dbe2850868335f5272",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.160",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.191",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.160",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails\n\nWhen svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE,\nit creates a replacement listener cm_id and returns 1, telling\nthe CM core to destroy the old one. If the replacement allocation\nfails, sc_cm_id still points at the old cm_id that the CM core is\nabout to destroy. Any subsequent dereference of sc_cm_id --\nsuch as svc_rdma_detach()\u0027s rdma_disconnect() call -- is a\nuse-after-free.\n\nNULL sc_cm_id on the failure path and guard svc_rdma_detach()\u0027s\nrdma_disconnect() call against NULL so that the listener can\nbe torn down safely when the server shuts down."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - svcrdma is the in-kernel NFS/RDMA server listen path; RDMA_CM_EVENT_ADDR_CHANGE is raised only from cma_netdev_callback on NETDEV_BONDING_FAILOVER when the bound bond MAC changes, so an attacker on the RoCE/IB storage fabric inducing active-backup failover reaches the bug, matching ADDR_CHANGE scoring for RPC-over-RDMA.\nAC:L - svc_rdma_create_listen_id() binds the replacement while the old listen cm_id still owns the port, so rdma_bind_addr() fails deterministically with EADDRINUSE/EADDRNOTAVAIL; the handler still returns 1 and the CM core frees that id, leaving a dangling sc_cm_id the attacker can arm by inducing failover.\nPR:N - The NFS/RDMA listener is already running as a network service; bonding failover and RDMA CM ADDR_CHANGE delivery perform no RPC, NFS export, or other authentication, so an adjacent fabric attacker needs no account or capability on the victim host.\nUI:N - Exploitation uses attacker-induced link failover plus subsequent listener teardown (nfsd restart/shutdown, the normal operational response once the listen endpoint is dead); no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free corrupts the host kernel rdma_cm_id/rdma_id_private object used by nfsd\u0027s RDMA transport in the same kernel security authority and is not a VM, IOMMU, or sandbox escape.\nC:H - After the CM core destroys the listen id, sc_cm_id is a dangling pointer to a freed rdma_cm_id with an event_handler; later rdma_disconnect()/rdma_destroy_id() in svc_rdma_detach/free is a kernel heap UAF that enables arbitrary disclosure via controlled reuse.\nI:H - svc_rdma_detach() calls rdma_disconnect() on the freed cm_id and svc_rdma_free() may rdma_destroy_id() it again, yielding UAF writes, double-free, and function-pointer hijack of event_handler, so integrity impact is High per UAF guidance.\nA:H - Use-after-free of the listen rdma_cm_id during detach/free causes a kernel oops or panic even when not fully exploited, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:03.526Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a68aeb2de8ad0fef9c50e73a50622a35c6af1a8"
},
{
"url": "https://git.kernel.org/stable/c/65f0f82f20334e76acaf29087a59af7b3b9699ed"
},
{
"url": "https://git.kernel.org/stable/c/673e358ab7c11f8cec223c6a36a793056a67facd"
},
{
"url": "https://git.kernel.org/stable/c/01500306e1d50de7ca7a2cdcdfa28ac0523eb747"
}
],
"title": "svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89534",
"datePublished": "2026-09-11T19:44:12.987Z",
"dateReserved": "2026-09-11T19:38:34.720Z",
"dateUpdated": "2026-10-30T12:32:03.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71285 (GCVE-0-2025-71285)
Vulnerability from cvelistv5
Published
2026-05-06 11:32
Modified
2026-11-05 21:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
MHI stack offers the 'auto_queue' feature, which allows the MHI stack to
auto queue the buffers for the RX path (DL channel). Though this feature
simplifies the client driver design, it introduces race between the client
drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback'
for the DL channel may get called before the client driver is fully probed.
This means, by the time the dl_callback gets called, the client driver's
structures might not be initialized, leading to NULL ptr dereference.
Currently, the drivers have to workaround this issue by initializing the
internal structures before calling mhi_prepare_for_transfer_autoqueue().
But even so, there is a chance that the client driver's internal code path
may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is
called, leading to similar NULL ptr dereference. This issue has been
reported on the Qcom X1E80100 CRD machines affecting boot.
So to properly fix all these races, drop the MHI 'auto_queue' feature
altogether and let the client driver (QRTR) manage the RX buffers manually.
In the QRTR driver, queue the RX buffers based on the ring length during
probe and recycle the buffers in 'dl_callback' once they are consumed. This
also warrants removing the setting of 'auto_queue' flag from controller
drivers.
Currently, this 'auto_queue' feature is only enabled for IPCR DL channel.
So only the QRTR client driver requires the modification.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 Version: 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 Version: 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 Version: 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 Version: 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 Version: 227fee5fc99eeb74d43bf68832f6d59d30ac07d8 Version: c682fb70a7dfc25b848a4ff3a385b0471b470606 Version: 5.15.63 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:15:58.206706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:23:11.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/qaic/mhi_controller.c",
"drivers/bus/mhi/host/pci_generic.c",
"drivers/net/wireless/ath/ath11k/mhi.c",
"drivers/net/wireless/ath/ath12k/mhi.c",
"net/qrtr/mhi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7874c74bcc224fd586679e51b9ded65f66edc2a",
"status": "affected",
"version": "227fee5fc99eeb74d43bf68832f6d59d30ac07d8",
"versionType": "git"
},
{
"lessThan": "ab0bdaf7a7f4f83b947193563f2a483ab87f72db",
"status": "affected",
"version": "227fee5fc99eeb74d43bf68832f6d59d30ac07d8",
"versionType": "git"
},
{
"lessThan": "8e130ff078892fa5a6bf272ced7565af58d98a85",
"status": "affected",
"version": "227fee5fc99eeb74d43bf68832f6d59d30ac07d8",
"versionType": "git"
},
{
"lessThan": "7bdff9b9b0c65ac7105416fe3a40686832515e20",
"status": "affected",
"version": "227fee5fc99eeb74d43bf68832f6d59d30ac07d8",
"versionType": "git"
},
{
"lessThan": "8c464e00e0754e016816b1860fa9592dcad80eb2",
"status": "affected",
"version": "227fee5fc99eeb74d43bf68832f6d59d30ac07d8",
"versionType": "git"
},
{
"lessThan": "51731792a25cb312ca94cdccfa139eb46de1b2ef",
"status": "affected",
"version": "227fee5fc99eeb74d43bf68832f6d59d30ac07d8",
"versionType": "git"
},
{
"status": "affected",
"version": "c682fb70a7dfc25b848a4ff3a385b0471b470606",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.63",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/qaic/mhi_controller.c",
"drivers/bus/mhi/host/pci_generic.c",
"drivers/net/wireless/ath/ath11k/mhi.c",
"drivers/net/wireless/ath/ath12k/mhi.c",
"net/qrtr/mhi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.63",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Drop the MHI auto_queue feature for IPCR DL channels\n\nMHI stack offers the \u0027auto_queue\u0027 feature, which allows the MHI stack to\nauto queue the buffers for the RX path (DL channel). Though this feature\nsimplifies the client driver design, it introduces race between the client\ndrivers and the MHI stack. For instance, with auto_queue, the \u0027dl_callback\u0027\nfor the DL channel may get called before the client driver is fully probed.\nThis means, by the time the dl_callback gets called, the client driver\u0027s\nstructures might not be initialized, leading to NULL ptr dereference.\n\nCurrently, the drivers have to workaround this issue by initializing the\ninternal structures before calling mhi_prepare_for_transfer_autoqueue().\nBut even so, there is a chance that the client driver\u0027s internal code path\nmay call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is\ncalled, leading to similar NULL ptr dereference. This issue has been\nreported on the Qcom X1E80100 CRD machines affecting boot.\n\nSo to properly fix all these races, drop the MHI \u0027auto_queue\u0027 feature\naltogether and let the client driver (QRTR) manage the RX buffers manually.\nIn the QRTR driver, queue the RX buffers based on the ring length during\nprobe and recycle the buffers in \u0027dl_callback\u0027 once they are consumed. This\nalso warrants removing the setting of \u0027auto_queue\u0027 flag from controller\ndrivers.\n\nCurrently, this \u0027auto_queue\u0027 feature is only enabled for IPCR DL channel.\nSo only the QRTR client driver requires the modification."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:35.535Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7874c74bcc224fd586679e51b9ded65f66edc2a"
},
{
"url": "https://git.kernel.org/stable/c/ab0bdaf7a7f4f83b947193563f2a483ab87f72db"
},
{
"url": "https://git.kernel.org/stable/c/8e130ff078892fa5a6bf272ced7565af58d98a85"
},
{
"url": "https://git.kernel.org/stable/c/7bdff9b9b0c65ac7105416fe3a40686832515e20"
},
{
"url": "https://git.kernel.org/stable/c/8c464e00e0754e016816b1860fa9592dcad80eb2"
},
{
"url": "https://git.kernel.org/stable/c/51731792a25cb312ca94cdccfa139eb46de1b2ef"
}
],
"title": "net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71285",
"datePublished": "2026-05-06T11:32:18.774Z",
"dateReserved": "2026-05-06T11:31:45.509Z",
"dateUpdated": "2026-11-05T21:23:11.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90335 (GCVE-0-2026-90335)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tty: skip cdev_del() when no cdev is registered
TTY device registration can fail before a cdev is allocated.
Serial core keeps the port so setserial can still use it, and later
removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer
dereference.
Only delete the cdev when the slot is not NULL.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a3a10ce3429e5dee623ad5c8407ea58e204fcb0a Version: a3a10ce3429e5dee623ad5c8407ea58e204fcb0a Version: a3a10ce3429e5dee623ad5c8407ea58e204fcb0a Version: a3a10ce3429e5dee623ad5c8407ea58e204fcb0a Version: a3a10ce3429e5dee623ad5c8407ea58e204fcb0a Version: a3a10ce3429e5dee623ad5c8407ea58e204fcb0a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/tty_io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c92b8d9c23a92f85b20bee3578d0f19cd1b1a68",
"status": "affected",
"version": "a3a10ce3429e5dee623ad5c8407ea58e204fcb0a",
"versionType": "git"
},
{
"lessThan": "ea3d2fae7c1d6492145976553817d22e8ef69a0e",
"status": "affected",
"version": "a3a10ce3429e5dee623ad5c8407ea58e204fcb0a",
"versionType": "git"
},
{
"lessThan": "21031bd0d662549412378110c989b164feb6e4be",
"status": "affected",
"version": "a3a10ce3429e5dee623ad5c8407ea58e204fcb0a",
"versionType": "git"
},
{
"lessThan": "2af4c46b429907edc8cb069c78fca1d950120b98",
"status": "affected",
"version": "a3a10ce3429e5dee623ad5c8407ea58e204fcb0a",
"versionType": "git"
},
{
"lessThan": "3dbf85ef40b6366ba15e882f7536cdc98bea579a",
"status": "affected",
"version": "a3a10ce3429e5dee623ad5c8407ea58e204fcb0a",
"versionType": "git"
},
{
"lessThan": "c3b5623fd97648f2747444aa8932ae604662df93",
"status": "affected",
"version": "a3a10ce3429e5dee623ad5c8407ea58e204fcb0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/tty_io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: skip cdev_del() when no cdev is registered\n\nTTY device registration can fail before a cdev is allocated.\nSerial core keeps the port so setserial can still use it, and later\nremoval passes the NULL cdev slot to cdev_del(), causing a NULL-pointer\ndereference.\n\nOnly delete the cdev when the slot is not NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:13.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c92b8d9c23a92f85b20bee3578d0f19cd1b1a68"
},
{
"url": "https://git.kernel.org/stable/c/ea3d2fae7c1d6492145976553817d22e8ef69a0e"
},
{
"url": "https://git.kernel.org/stable/c/21031bd0d662549412378110c989b164feb6e4be"
},
{
"url": "https://git.kernel.org/stable/c/2af4c46b429907edc8cb069c78fca1d950120b98"
},
{
"url": "https://git.kernel.org/stable/c/3dbf85ef40b6366ba15e882f7536cdc98bea579a"
},
{
"url": "https://git.kernel.org/stable/c/c3b5623fd97648f2747444aa8932ae604662df93"
}
],
"title": "tty: skip cdev_del() when no cdev is registered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90335",
"datePublished": "2026-09-17T16:08:48.127Z",
"dateReserved": "2026-09-11T19:38:34.803Z",
"dateUpdated": "2026-10-30T12:35:13.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39834 (GCVE-0-2025-39834)
Vulnerability from cvelistv5
Published
2025-09-16 13:08
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
When an invalid stc_type is provided, the function allocates memory for
shared_stc but jumps to unlock_and_out without freeing it, causing a
memory leak.
Fix by jumping to free_shared_stc label instead to ensure proper cleanup.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-39834",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T18:18:41.812797Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T18:22:57.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a2751e1af5dc8b1a64cfd463576c58617c2573ac",
"status": "affected",
"version": "504e536d90104c850731840d3fbc95acf251f11b",
"versionType": "git"
},
{
"lessThan": "051fd8576a2e4e95d5870c5c9f8679c5b16882e4",
"status": "affected",
"version": "504e536d90104c850731840d3fbc95acf251f11b",
"versionType": "git"
},
{
"lessThan": "a630f83592cdad1253523a1b760cfe78fef6cd9c",
"status": "affected",
"version": "504e536d90104c850731840d3fbc95acf251f11b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow\n\nWhen an invalid stc_type is provided, the function allocates memory for\nshared_stc but jumps to unlock_and_out without freeing it, causing a\nmemory leak.\n\nFix by jumping to free_shared_stc label instead to ensure proper cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:26.260Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a2751e1af5dc8b1a64cfd463576c58617c2573ac"
},
{
"url": "https://git.kernel.org/stable/c/051fd8576a2e4e95d5870c5c9f8679c5b16882e4"
},
{
"url": "https://git.kernel.org/stable/c/a630f83592cdad1253523a1b760cfe78fef6cd9c"
}
],
"title": "net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39834",
"datePublished": "2025-09-16T13:08:50.896Z",
"dateReserved": "2025-04-16T07:20:57.140Z",
"dateUpdated": "2026-10-21T12:37:26.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64283 (GCVE-0-2026-64283)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
When binding a memslot to a guest_memfd file, treat the offset and size as
unsigned values to fix a bug where the sum of the two can result in a false
negative when checking for overflow against the size of the file. Passing
unsigned values also avoids relying on somewhat obscure checks in other
flows for safety, and tracks the offset and size as they are intended to be
tracked, as unsigned values.
On 64-bit kernels, the number of pages a memslot contains and thus the size
(and offset) of its guest_memfd binding are unsigned 64-bit values. Taking
the offset+size as an loff_t instead of a uoff_t inadvertently converts
the unsigned value to a signed value if the offset and/or size is massive.
Locally storing the offset and size as signed values is benign in and of
itself (though even that is *extremely* difficult to discern), but
operating on their sum is not.
For the offset, KVM explicitly checks against a negative value, which might
seem like a bug as KVM could incorrectly reject a legitimate binding, but
that's not actually the case as KVM_CREATE_GUEST_MEMFD takes a signed value
for its size, i.e. a would-be-negative offset is also greater than the
maximum possible size of any guest_memfd file.
Regarding the size, while KVM lacks an explicit check for a negative value,
i.e. seemingly has a flawed overflow check, KVM restricts the number of
pages in a single memslot to the largest positive signed 32-bit value:
if (id < KVM_USER_MEM_SLOTS &&
(mem->memory_size >> PAGE_SHIFT) > KVM_MEM_MAX_NR_PAGES)
return -EINVAL;
and so that maximum "size" will ever be is 0x7fffffff000.
The sum of the two is, however, problematic. While the size is restricted
by KVM's memslot logic, the offset is not, i.e. the offset is completely
unchecked until the "offset + size > i_size_read(inode)" check. If the
offset is the (nearly) largest possible _positive_ value, then adding size
to the offset can result in a signed, negative 64-bit value. When compared
against the size of the file (guaranteed to be positive), the negative sum
is always smaller, and KVM incorrectly allows the absurd offset.
Opportunistically add missing includes in kvm_mm.h (instead of relying on
its parents).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:33:42.663577Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:32.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"virt/kvm/guest_memfd.c",
"virt/kvm/kvm_mm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4683654881f3303ab286e45df6f91c0675d867c",
"status": "affected",
"version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
"versionType": "git"
},
{
"lessThan": "3f9c0fdefa0431ad7a5528d76b9cdad912500bdf",
"status": "affected",
"version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
"versionType": "git"
},
{
"lessThan": "f3a98d5881b9bd4807f49156143565f6aabcef1e",
"status": "affected",
"version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
"versionType": "git"
},
{
"lessThan": "eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6",
"status": "affected",
"version": "a7800aa80ea4d5356b8474c2302812e9d4926fa6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"virt/kvm/guest_memfd.c",
"virt/kvm/kvm_mm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: guest_memfd: Treat memslot binding offset+size as unsigned values\n\nWhen binding a memslot to a guest_memfd file, treat the offset and size as\nunsigned values to fix a bug where the sum of the two can result in a false\nnegative when checking for overflow against the size of the file. Passing\nunsigned values also avoids relying on somewhat obscure checks in other\nflows for safety, and tracks the offset and size as they are intended to be\ntracked, as unsigned values.\n\nOn 64-bit kernels, the number of pages a memslot contains and thus the size\n(and offset) of its guest_memfd binding are unsigned 64-bit values. Taking\nthe offset+size as an loff_t instead of a uoff_t inadvertently converts\nthe unsigned value to a signed value if the offset and/or size is massive.\n\nLocally storing the offset and size as signed values is benign in and of\nitself (though even that is *extremely* difficult to discern), but\noperating on their sum is not.\n\nFor the offset, KVM explicitly checks against a negative value, which might\nseem like a bug as KVM could incorrectly reject a legitimate binding, but\nthat\u0027s not actually the case as KVM_CREATE_GUEST_MEMFD takes a signed value\nfor its size, i.e. a would-be-negative offset is also greater than the\nmaximum possible size of any guest_memfd file.\n\nRegarding the size, while KVM lacks an explicit check for a negative value,\ni.e. seemingly has a flawed overflow check, KVM restricts the number of\npages in a single memslot to the largest positive signed 32-bit value:\n\n if (id \u003c KVM_USER_MEM_SLOTS \u0026\u0026\n (mem-\u003ememory_size \u003e\u003e PAGE_SHIFT) \u003e KVM_MEM_MAX_NR_PAGES)\n return -EINVAL;\n\nand so that maximum \"size\" will ever be is 0x7fffffff000.\n\nThe sum of the two is, however, problematic. While the size is restricted\nby KVM\u0027s memslot logic, the offset is not, i.e. the offset is completely\nunchecked until the \"offset + size \u003e i_size_read(inode)\" check. If the\noffset is the (nearly) largest possible _positive_ value, then adding size\nto the offset can result in a signed, negative 64-bit value. When compared\nagainst the size of the file (guaranteed to be positive), the negative sum\nis always smaller, and KVM incorrectly allows the absurd offset.\n\nOpportunistically add missing includes in kvm_mm.h (instead of relying on\nits parents)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:13.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4683654881f3303ab286e45df6f91c0675d867c"
},
{
"url": "https://git.kernel.org/stable/c/3f9c0fdefa0431ad7a5528d76b9cdad912500bdf"
},
{
"url": "https://git.kernel.org/stable/c/f3a98d5881b9bd4807f49156143565f6aabcef1e"
},
{
"url": "https://git.kernel.org/stable/c/eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6"
}
],
"title": "KVM: guest_memfd: Treat memslot binding offset+size as unsigned values",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64283",
"datePublished": "2026-07-25T08:49:25.642Z",
"dateReserved": "2026-07-19T15:36:31.777Z",
"dateUpdated": "2026-11-06T16:34:32.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99124 (GCVE-0-2026-99124)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/pci: Fix leak of uninitialized kernel data in SCLP report
While report_error_write() checks that the provided buffer is at least
as large as the header struct, but not that it is large enough to
contain the report with the length claimed by report->length. If
user-space provides a short buffer, meaning a larger report->length than
the actually written payload, up to around 4K of kernel data from past
the kmalloc(len + 1) sized buffer allocated in kernfs_fop_write_iter()
will leak into the SCLP report.
However, as the entity processing the SCLP is privileged and able to
access at least the page including the report, this does not leak data
that entity could not access but it is still an out of bounds read and
a malformed error report that should be rejected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f Version: 368704a65be8620df795ccbeb44e025dafbc3e1f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/pci/pci_sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad1be38823d4b6dbc88648da296ca0c0f8824a55",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "61ce6f9a527932f4482ebe00847490f17d63a0d1",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "332f2d867f64dd530517e9a58394e3eab454df12",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "ff31c34e921d11c7da3d7664ce495106267ca408",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "eb10f25e32576bb3dbbea4457648614537f04211",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "ba5001db9bb23ff7d2ea328c405c287ffb07786f",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "126a7c227d8543e13903dd5622640c1f0fcc5a16",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
},
{
"lessThan": "8ac60ae2a307a50b599bf5d300b448d638f3ba29",
"status": "affected",
"version": "368704a65be8620df795ccbeb44e025dafbc3e1f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/pci/pci_sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix leak of uninitialized kernel data in SCLP report\n\nWhile report_error_write() checks that the provided buffer is at least\nas large as the header struct, but not that it is large enough to\ncontain the report with the length claimed by report-\u003elength. If\nuser-space provides a short buffer, meaning a larger report-\u003elength than\nthe actually written payload, up to around 4K of kernel data from past\nthe kmalloc(len + 1) sized buffer allocated in kernfs_fop_write_iter()\nwill leak into the SCLP report.\n\nHowever, as the entity processing the SCLP is privileged and able to\naccess at least the page including the report, this does not leak data\nthat entity could not access but it is still an out of bounds read and\na malformed error report that should be rejected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:58.903Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad1be38823d4b6dbc88648da296ca0c0f8824a55"
},
{
"url": "https://git.kernel.org/stable/c/61ce6f9a527932f4482ebe00847490f17d63a0d1"
},
{
"url": "https://git.kernel.org/stable/c/332f2d867f64dd530517e9a58394e3eab454df12"
},
{
"url": "https://git.kernel.org/stable/c/ff31c34e921d11c7da3d7664ce495106267ca408"
},
{
"url": "https://git.kernel.org/stable/c/eb10f25e32576bb3dbbea4457648614537f04211"
},
{
"url": "https://git.kernel.org/stable/c/ba5001db9bb23ff7d2ea328c405c287ffb07786f"
},
{
"url": "https://git.kernel.org/stable/c/126a7c227d8543e13903dd5622640c1f0fcc5a16"
},
{
"url": "https://git.kernel.org/stable/c/8ac60ae2a307a50b599bf5d300b448d638f3ba29"
}
],
"title": "s390/pci: Fix leak of uninitialized kernel data in SCLP report",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99124",
"datePublished": "2026-10-28T10:34:39.370Z",
"dateReserved": "2026-09-25T10:25:14.393Z",
"dateUpdated": "2026-10-30T12:41:58.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98053 (GCVE-0-2026-98053)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: avs: Refactor and fix init_config access
Existing code accesses enties found in ->init_configs array through
indexes that are part of ->config_ids array. Those two are limited by:
->num_init_configs and ->num_config_ids respectively. Using ID larger
or equal to ->num_init_configs leads to out-of-bounds access:
avs_path_module_send_init_configs()
loop:
(...) &acomp->tplg->init_configs[ids[i]]
^ out-of-bounds candidate
Rather than adding another if-statement, refactor the code. There is no
need to store the IDs, have a list of pointers to actual config-entries
instead. As the verification of ->init_config entries does not differ from
verification of other types that are part of the topology.c file, simply
reuse the code.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/intel/avs/path.c",
"sound/soc/intel/avs/topology.c",
"sound/soc/intel/avs/topology.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70ffcaf86a053be99daaf3b103beac0ad7136ca3",
"status": "affected",
"version": "8a49ef789b1be68242624d460df2ada8087308a7",
"versionType": "git"
},
{
"lessThan": "75bd5ea9c858d89fb8862f23afb00783bf02cd7a",
"status": "affected",
"version": "8a49ef789b1be68242624d460df2ada8087308a7",
"versionType": "git"
},
{
"lessThan": "8f20a0f4f7d638e83ae86db1719a24c7049762f5",
"status": "affected",
"version": "8a49ef789b1be68242624d460df2ada8087308a7",
"versionType": "git"
},
{
"lessThan": "681e91035dc794896a904852040837190e5041f5",
"status": "affected",
"version": "8a49ef789b1be68242624d460df2ada8087308a7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/intel/avs/path.c",
"sound/soc/intel/avs/topology.c",
"sound/soc/intel/avs/topology.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Refactor and fix init_config access\n\nExisting code accesses enties found in -\u003einit_configs array through\nindexes that are part of -\u003econfig_ids array. Those two are limited by:\n-\u003enum_init_configs and -\u003enum_config_ids respectively. Using ID larger\nor equal to -\u003enum_init_configs leads to out-of-bounds access:\n\navs_path_module_send_init_configs()\nloop:\n\t(...) \u0026acomp-\u003etplg-\u003einit_configs[ids[i]]\n\t\t\t\t\t^ out-of-bounds candidate\n\nRather than adding another if-statement, refactor the code. There is no\nneed to store the IDs, have a list of pointers to actual config-entries\ninstead. As the verification of -\u003einit_config entries does not differ from\nverification of other types that are part of the topology.c file, simply\nreuse the code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:17.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70ffcaf86a053be99daaf3b103beac0ad7136ca3"
},
{
"url": "https://git.kernel.org/stable/c/75bd5ea9c858d89fb8862f23afb00783bf02cd7a"
},
{
"url": "https://git.kernel.org/stable/c/8f20a0f4f7d638e83ae86db1719a24c7049762f5"
},
{
"url": "https://git.kernel.org/stable/c/681e91035dc794896a904852040837190e5041f5"
}
],
"title": "ASoC: Intel: avs: Refactor and fix init_config access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98053",
"datePublished": "2026-09-25T10:24:01.074Z",
"dateReserved": "2026-09-25T10:19:56.072Z",
"dateUpdated": "2026-10-21T12:54:17.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68376 (GCVE-0-2025-68376)
Vulnerability from cvelistv5
Published
2025-12-24 10:33
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
coresight: ETR: Fix ETR buffer use-after-free issue
When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed
and enabled again, currently sysfs_buf will point to the newly
allocated memory(buf_new) and free the old memory(buf_old). But the
etr_buf that is being used by the ETR remains pointed to buf_old, not
updated to buf_new. In this case, it will result in a memory
use-after-free issue.
Fix this by checking ETR's mode before updating and releasing buf_old,
if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bd2767ec3df2775bc336f441f9068a989ccb919d Version: bd2767ec3df2775bc336f441f9068a989ccb919d Version: bd2767ec3df2775bc336f441f9068a989ccb919d Version: bd2767ec3df2775bc336f441f9068a989ccb919d Version: bd2767ec3df2775bc336f441f9068a989ccb919d Version: fdd3ceb0001da6768bede9779a0190a42e65c404 Version: 6.5.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-tmc-etr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5d5d130835b417c7bfd6c942f0149e34397d4463",
"status": "affected",
"version": "bd2767ec3df2775bc336f441f9068a989ccb919d",
"versionType": "git"
},
{
"lessThan": "4e83434247ff8005a0b9a1ee997864abf8f259ec",
"status": "affected",
"version": "bd2767ec3df2775bc336f441f9068a989ccb919d",
"versionType": "git"
},
{
"lessThan": "70acbc9c77686b7a521af6d7a543dcd9c324cf07",
"status": "affected",
"version": "bd2767ec3df2775bc336f441f9068a989ccb919d",
"versionType": "git"
},
{
"lessThan": "cda077a19f5c8d6ec61e5b97deca203d95e3a422",
"status": "affected",
"version": "bd2767ec3df2775bc336f441f9068a989ccb919d",
"versionType": "git"
},
{
"lessThan": "35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3",
"status": "affected",
"version": "bd2767ec3df2775bc336f441f9068a989ccb919d",
"versionType": "git"
},
{
"status": "affected",
"version": "fdd3ceb0001da6768bede9779a0190a42e65c404",
"versionType": "git"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-tmc-etr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR\u0027s mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:21.502Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d5d130835b417c7bfd6c942f0149e34397d4463"
},
{
"url": "https://git.kernel.org/stable/c/4e83434247ff8005a0b9a1ee997864abf8f259ec"
},
{
"url": "https://git.kernel.org/stable/c/70acbc9c77686b7a521af6d7a543dcd9c324cf07"
},
{
"url": "https://git.kernel.org/stable/c/cda077a19f5c8d6ec61e5b97deca203d95e3a422"
},
{
"url": "https://git.kernel.org/stable/c/35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3"
}
],
"title": "coresight: ETR: Fix ETR buffer use-after-free issue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68376",
"datePublished": "2025-12-24T10:33:05.503Z",
"dateReserved": "2025-12-16T14:48:05.310Z",
"dateUpdated": "2026-10-21T12:38:21.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31771 (GCVE-0-2026-31771)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: move wake reason storage into validated event handlers
hci_store_wake_reason() is called from hci_event_packet() immediately
after stripping the HCI event header but before hci_event_func()
enforces the per-event minimum payload length from hci_ev_table.
This means a short HCI event frame can reach bacpy() before any bounds
check runs.
Rather than duplicating skb parsing and per-event length checks inside
hci_store_wake_reason(), move wake-address storage into the individual
event handlers after their existing event-length validation has
succeeded. Convert hci_store_wake_reason() into a small helper that only
stores an already-validated bdaddr while the caller holds hci_dev_lock().
Use the same helper after hci_event_func() with a NULL address to
preserve the existing unexpected-wake fallback semantics when no
validated event handler records a wake address.
Annotate the helper with __must_hold(&hdev->lock) and add
lockdep_assert_held(&hdev->lock) so future call paths keep the lock
contract explicit.
Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),
hci_sync_conn_complete_evt(), le_conn_complete_evt(),
hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),
hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and
hci_le_past_received_evt().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 Version: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 Version: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 Version: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 Version: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 Version: 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:13:04.391952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:07.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fbea63d0d301edd4a42f4390b49b8519d78b802d",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
},
{
"lessThan": "1e4b738dd0d0f7b237686167706badad9d30649c",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
},
{
"lessThan": "ac7889b0fe441e4ef892c40b1d002e91f93fa4ae",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
},
{
"lessThan": "dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
},
{
"lessThan": "86c8d07a64d553c41e213b52650020010f9ef23e",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
},
{
"lessThan": "2b2bf47cd75518c36fa2d41380e4a40641cc89cd",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026hdev-\u003elock) and add\nlockdep_assert_held(\u0026hdev-\u003elock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable parser is in Bluetooth HCI event handling, reached from controller events generated by nearby Bluetooth activity such as connection or advertising wake events. Bluetooth attacks require radio adjacency rather than IP network reachability.\nAC:L - No race is required; a short HCI event reaches wake-reason parsing before the normal per-event length checks. The suspended/wake-reason state is a normal Bluetooth remote-wake deployment condition, so under the higher-severity rule this is low complexity.\nPR:N - An adjacent Bluetooth peer does not need privileges on the vulnerable host, and affected events can occur before any Bluetooth authentication or pairing decision in the host stack. Local HCI injection paths may require privileges, but the adjacent radio scenario requires none.\nUI:N - No victim action is required once Bluetooth remote wake/scanning is enabled and the system is in the affected state. The attacker only needs to deliver the triggering Bluetooth activity/event.\nS:U - The impact remains within the same kernel/host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds kernel heap read from an skb before validation, copied into wake-address state that is later reported through management resume events. Although each copy is small, repeated malformed wake events and multiple event layouts make kernel memory disclosure plausible, so the higher severity option is selected.\nI:N - The vulnerable operation copies out-of-bounds source bytes into intended hci_dev wake-reason fields, but does not provide an out-of-bounds write or control over unrelated kernel memory. I found no path from this state corruption to arbitrary modification or code execution.\nA:H - The malformed short event can drive invalid kernel memory reads before bounds checks; depending on allocator layout or hardening, this can cause an oops/panic. As a kernel fault from attacker-supplied malformed Bluetooth input is plausible, availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:42.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fbea63d0d301edd4a42f4390b49b8519d78b802d"
},
{
"url": "https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c"
},
{
"url": "https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae"
},
{
"url": "https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2"
},
{
"url": "https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"
},
{
"url": "https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"
}
],
"title": "Bluetooth: hci_event: move wake reason storage into validated event handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31771",
"datePublished": "2026-05-01T14:14:59.918Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-10-30T12:24:42.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72162 (GCVE-0-2026-72162)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
[BUG]
On-disk corruption setting l_next_free_rec to 0 in an inode's embedded
extent list triggers a UBSAN panic on the next write to that file.
[CAUSE]
ocfs2_sum_rightmost_rec() computes
i = le16_to_cpu(el->l_next_free_rec) - 1
and accesses el->l_recs[i] without validating i. When l_next_free_rec
is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls
past the end of the array. Either case violates the
__counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.
[FIX]
Validate the inode's embedded extent list when the inode is read, in
ocfs2_validate_inode_block(): l_count must be non-zero and no larger
than the inode block can hold, and l_next_free_rec must not exceed
l_count. A corrupt list is rejected at read time, before the b-tree
code can index l_recs[] out of bounds.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 Version: dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 Version: dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 Version: dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 Version: dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 Version: dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c88226315aec298894ec57e532f5e95f3b09e874",
"status": "affected",
"version": "dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8",
"versionType": "git"
},
{
"lessThan": "c286319746cef02bcce7384fda3a3f08989070d2",
"status": "affected",
"version": "dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8",
"versionType": "git"
},
{
"lessThan": "720fb324cf0f5116318cae7f75cb393d118ffb67",
"status": "affected",
"version": "dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8",
"versionType": "git"
},
{
"lessThan": "671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1",
"status": "affected",
"version": "dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8",
"versionType": "git"
},
{
"lessThan": "858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85",
"status": "affected",
"version": "dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8",
"versionType": "git"
},
{
"lessThan": "452a8467be8143747292218212671deeb186d2ae",
"status": "affected",
"version": "dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec\n\n[BUG]\nOn-disk corruption setting l_next_free_rec to 0 in an inode\u0027s embedded\nextent list triggers a UBSAN panic on the next write to that file.\n\n[CAUSE]\nocfs2_sum_rightmost_rec() computes\ni = le16_to_cpu(el-\u003el_next_free_rec) - 1\nand accesses el-\u003el_recs[i] without validating i. When l_next_free_rec\nis 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls\npast the end of the array. Either case violates the\n__counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.\n\n[FIX]\nValidate the inode\u0027s embedded extent list when the inode is read, in\nocfs2_validate_inode_block(): l_count must be non-zero and no larger\nthan the inode block can hold, and l_next_free_rec must not exceed\nl_count. A corrupt list is rejected at read time, before the b-tree\ncode can index l_recs[] out of bounds."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local VFS write paths on a mounted OCFS2 volume (write/mmap extending allocation), not from network packet handling or remote protocols; exploitation requires local syscall access to a mounted filesystem.\nAC:L - An attacker can reliably craft on-disk inode metadata (e.g., l_next_free_rec=0) in an OCFS2 image and trigger btree growth with a normal extending write; syzkaller reproduced this deterministically without races or victim-specific timing.\nPR:L - Full exploitation requires mounting a crafted OCFS2 image and writing to it; CAP_SYS_ADMIN for mount/loop setup is obtainable by an unprivileged user via user namespaces, matching the low-privilege bar used for comparable OCFS2 corruption CVEs.\nUI:N - No victim interaction is required when the attacker crafts the corrupt image, mounts it (including via user namespace), and performs the triggering write themselves; no third party must open files or take other actions.\nS:U - Impact is confined to kernel memory/filesystem integrity on the host processing the corrupt OCFS2 metadata; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - The flaw is an out-of-bounds read of extent records from attacker-controlled on-disk fields; even when UBSAN traps, the invalid index access can expose adjacent inode metadata and is classed as information-disclosure-capable memory corruption.\nI:H - The out-of-bounds sum feeds btree growth/shift logic that writes derived cluster counts and tree pointers back to disk, enabling attacker-influenced metadata corruption beyond the immediate read primitive.\nA:H - On UBSAN-enabled kernels the invalid array index triggers a kernel panic on write; even without UBSAN, corrupt btree updates from the bad sum can crash or destabilize the system, satisfying high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:52.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c88226315aec298894ec57e532f5e95f3b09e874"
},
{
"url": "https://git.kernel.org/stable/c/c286319746cef02bcce7384fda3a3f08989070d2"
},
{
"url": "https://git.kernel.org/stable/c/720fb324cf0f5116318cae7f75cb393d118ffb67"
},
{
"url": "https://git.kernel.org/stable/c/671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1"
},
{
"url": "https://git.kernel.org/stable/c/858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85"
},
{
"url": "https://git.kernel.org/stable/c/452a8467be8143747292218212671deeb186d2ae"
}
],
"title": "ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72162",
"datePublished": "2026-08-15T05:53:30.420Z",
"dateReserved": "2026-08-09T03:40:39.909Z",
"dateUpdated": "2026-10-30T12:28:52.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74611 (GCVE-0-2026-74611)
Vulnerability from cvelistv5
Published
2026-08-22 15:31
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
tls_decrypt_sg() advances msg->msg_iter when it maps user pages for
the optimistic TLS 1.3 zero-copy path. If the decrypted record turns
out not to be unpadded application data, tls_decrypt_sw() retries into
a kernel skb, but leaves the iterator advanced.
The subsequent copy from the skb then writes decrypted bytes again at
a later point in the caller iovecs while recvmsg() reports only the
post-retry length. A TLS peer can trigger this after the receiver
enables TLS_RX_EXPECT_NO_PAD.
Revert the iterator by the number of bytes consumed by the optimistic
mapping before retrying without zero-copy.
Add a selftest which sends a TLS 1.3 control record with
TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not
overwrite later iovecs beyond the returned length.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ce61327ce989b63c0bd1cc7afee00e218ee696ac Version: ce61327ce989b63c0bd1cc7afee00e218ee696ac Version: ce61327ce989b63c0bd1cc7afee00e218ee696ac Version: ce61327ce989b63c0bd1cc7afee00e218ee696ac Version: ce61327ce989b63c0bd1cc7afee00e218ee696ac Version: ce61327ce989b63c0bd1cc7afee00e218ee696ac |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:02:18.342764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:06:01.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c",
"tools/testing/selftests/net/tls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "97004f3c17371ee1b259887298711e0604666688",
"status": "affected",
"version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
"versionType": "git"
},
{
"lessThan": "c71bacacd59166adbea423a04e7474b0e8245b84",
"status": "affected",
"version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
"versionType": "git"
},
{
"lessThan": "3c4e21b1bf8e666a1c141e0f5813ece929570deb",
"status": "affected",
"version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
"versionType": "git"
},
{
"lessThan": "68787940274ec89f41dc91b1a68ee1a16a90735f",
"status": "affected",
"version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
"versionType": "git"
},
{
"lessThan": "3c837266a734e2a22b24d2d567404a501d405835",
"status": "affected",
"version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
"versionType": "git"
},
{
"lessThan": "1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e",
"status": "affected",
"version": "ce61327ce989b63c0bd1cc7afee00e218ee696ac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c",
"tools/testing/selftests/net/tls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: rx: restore msg_iter before TLS 1.3 optimistic retry\n\ntls_decrypt_sg() advances msg-\u003emsg_iter when it maps user pages for\nthe optimistic TLS 1.3 zero-copy path. If the decrypted record turns\nout not to be unpadded application data, tls_decrypt_sw() retries into\na kernel skb, but leaves the iterator advanced.\n\nThe subsequent copy from the skb then writes decrypted bytes again at\na later point in the caller iovecs while recvmsg() reports only the\npost-retry length. A TLS peer can trigger this after the receiver\nenables TLS_RX_EXPECT_NO_PAD.\n\nRevert the iterator by the number of bytes consumed by the optimistic\nmapping before retrying without zero-copy.\n\nAdd a selftest which sends a TLS 1.3 control record with\nTLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not\noverwrite later iovecs beyond the returned length."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in kTLS software RX (tls_decrypt_sw/tls_sw_recvmsg) and is driven by TLS 1.3 records received from a remote TCP peer; per kernel CNA guidance, kTLS flaws triggered by peer ciphertext on an established connection are Network-reachable (e.g., malicious client to nginx/HAProxy/NVMe-oF-TLS server).\nAC:L - Once the receiver has TLS 1.3 kTLS RX with TLS_RX_EXPECT_NO_PAD, a remote peer can deterministically trigger the optimistic-decrypt retry by sending a non-application-data inner record (handshake/alert/KeyUpdate) or padded data; no race, special heap layout, or rare kernel build is required.\nPR:N - Exploitation requires only being the remote TLS peer on an established kTLS connection; the attacker needs no credentials or Linux capabilities on the victim host. TLS_RX_EXPECT_NO_PAD is a receiver-side performance option set by the service, not an attacker privilege gate.\nUI:N - No victim user action beyond normal automated server operation (maintaining a TLS session and calling recvmsg on kTLS sockets). The attacker triggers the flaw solely by sending protocol-valid TLS records over the network.\nS:U - The out-of-bounds write corrupts user-space iovec buffers of the process owning the kTLS socket within the same security authority; it does not cross a VM, IOMMU, or sandbox boundary to another security domain.\nC:H - skb_copy_datagram_msg writes decrypted peer-controlled bytes past the recvmsg-reported length into adjacent user buffers. This memory corruption can be leveraged for information disclosure via heap/stack grooming even though the immediate primitive is a write.\nI:H - The remote peer controls the decrypted payload written out-of-bounds (up to a full TLS record, roughly 16 KiB) into later iovecs while recvmsg under-reports bytes copied, giving a reliable user-space memory corruption primitive suitable for control-flow or data hijack in privileged daemons.\nA:H - Corrupting adjacent application buffers in kTLS-enabled daemons (web proxies, storage targets, RPC endpoints) can crash workers or destabilize the service; the silent mismatch between returned length and bytes written also enables persistent denial of service on long-lived connections."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:14.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/97004f3c17371ee1b259887298711e0604666688"
},
{
"url": "https://git.kernel.org/stable/c/c71bacacd59166adbea423a04e7474b0e8245b84"
},
{
"url": "https://git.kernel.org/stable/c/3c4e21b1bf8e666a1c141e0f5813ece929570deb"
},
{
"url": "https://git.kernel.org/stable/c/68787940274ec89f41dc91b1a68ee1a16a90735f"
},
{
"url": "https://git.kernel.org/stable/c/3c837266a734e2a22b24d2d567404a501d405835"
},
{
"url": "https://git.kernel.org/stable/c/1c8629651cb54f7b51db8fc0b1a9944e4a4b0f5e"
}
],
"title": "tls: rx: restore msg_iter before TLS 1.3 optimistic retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74611",
"datePublished": "2026-08-22T15:31:57.534Z",
"dateReserved": "2026-08-15T05:44:03.920Z",
"dateUpdated": "2026-10-30T12:30:14.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89920 (GCVE-0-2026-89920)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix memory corruption by not reinjecting CK machine checks
Channel-subsystem damage machine checks are for the host channel
subsystem. The guest channel subsystem is emulated in the userspace VMM.
There is no point in forwarding such machine checks into the guest.
This also simplifies the machine check reinjection and avoids kfree of a
stack variable as reported by sashiko. There might be still machine
checks that have the ck bit set with another bit (like instruction
damage), mask out the CK bit in s390_backup_mcck_info(), like the CP and
ED bits already are.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 Version: 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 Version: 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 Version: 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 Version: 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 Version: 4d62fcc0b692e3b4058d7d138114c27cd8b011f7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/include/asm/nmi.h",
"arch/s390/kernel/nmi.c",
"arch/s390/kvm/interrupt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "045f3e95a0deccb277c29bd003e1d43c0ad40c90",
"status": "affected",
"version": "4d62fcc0b692e3b4058d7d138114c27cd8b011f7",
"versionType": "git"
},
{
"lessThan": "5c63e2ed840c85e27172ab78e7db3ac77fba281b",
"status": "affected",
"version": "4d62fcc0b692e3b4058d7d138114c27cd8b011f7",
"versionType": "git"
},
{
"lessThan": "b7631982fb65dd355acd18e62b384bc8125e9c44",
"status": "affected",
"version": "4d62fcc0b692e3b4058d7d138114c27cd8b011f7",
"versionType": "git"
},
{
"lessThan": "6ee52d3af2a1bf70349cf3f860933c8d221e229a",
"status": "affected",
"version": "4d62fcc0b692e3b4058d7d138114c27cd8b011f7",
"versionType": "git"
},
{
"lessThan": "7077ec953996acc04b49d1dfc43df1c1a2a74395",
"status": "affected",
"version": "4d62fcc0b692e3b4058d7d138114c27cd8b011f7",
"versionType": "git"
},
{
"lessThan": "546dde823a36d7283dcf46127c2f3d093443860f",
"status": "affected",
"version": "4d62fcc0b692e3b4058d7d138114c27cd8b011f7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/include/asm/nmi.h",
"arch/s390/kernel/nmi.c",
"arch/s390/kvm/interrupt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix memory corruption by not reinjecting CK machine checks\n\nChannel-subsystem damage machine checks are for the host channel\nsubsystem. The guest channel subsystem is emulated in the userspace VMM.\nThere is no point in forwarding such machine checks into the guest.\n\nThis also simplifies the machine check reinjection and avoids kfree of a\nstack variable as reported by sashiko. There might be still machine\nchecks that have the ck bit set with another bit (like instruction\ndamage), mask out the CK bit in s390_backup_mcck_info(), like the CP and\nED bits already are."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reached only after a local KVM_RUN puts an s390 vCPU in SIE (kvm_arch_vcpu_ioctl_run -\u003e __vcpu_run -\u003e kvm_s390_enter_exit_sie/sie64a, also vsie). A host CK machine check then hits vcpu_post_run -\u003e kvm_s390_reinject_machine_check. No network or physical path.\nAC:H - The CK bit comes from host lowcore via s390_backup_mcck_info(), not guest or ioctl input. Channel-subsystem damage is a host CSS hardware/firmware condition the attacker cannot induce; guest CSS is emulated in userspace and does not drive the host CSS.\nPR:L - KVM_CREATE_VM and KVM_RUN have no capable() check for ordinary (non-ucontrol) VMs. A kvm-group user who can open /dev/kvm, or a tenant already running in an s390 KVM guest, suffices; host init-namespace root is not required.\nUI:N - The attacker issues KVM_RUN on a vCPU they created, or a tenant guest is already in SIE. No separate victim action such as mounting a filesystem, opening a file, or attaching a device is required.\nS:C - kvm_s390_reinject_machine_check runs in the host kernel on the SIE-exit path and kfree()s a stack object, corrupting host allocator state. That crosses the KVM guest-to-hypervisor boundary and can compromise the host and co-located VMs.\nC:H - kfree() of the on-stack kvm_s390_interrupt_info treats a kernel stack address as a slab or large-kmalloc object (page_slab/free_large_kmalloc/slab_free), corrupting allocator metadata. That host-kernel memory corruption can be leveraged for disclosure.\nI:H - The same invalid free corrupts SLUB or page-allocator metadata, which can be turned into an arbitrary host write or control-flow hijack. CNA guidance scores this class of kernel memory corruption as High integrity.\nA:H - kfree of a non-slab stack address hits WARN_ON_ONCE in free_large_kmalloc or slab_free on a bogus object and oopses or panics the host kernel, denying service to the hypervisor and every co-located VM."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:25.963Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/045f3e95a0deccb277c29bd003e1d43c0ad40c90"
},
{
"url": "https://git.kernel.org/stable/c/5c63e2ed840c85e27172ab78e7db3ac77fba281b"
},
{
"url": "https://git.kernel.org/stable/c/b7631982fb65dd355acd18e62b384bc8125e9c44"
},
{
"url": "https://git.kernel.org/stable/c/6ee52d3af2a1bf70349cf3f860933c8d221e229a"
},
{
"url": "https://git.kernel.org/stable/c/7077ec953996acc04b49d1dfc43df1c1a2a74395"
},
{
"url": "https://git.kernel.org/stable/c/546dde823a36d7283dcf46127c2f3d093443860f"
}
],
"title": "KVM: s390: Fix memory corruption by not reinjecting CK machine checks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89920",
"datePublished": "2026-09-16T10:32:14.735Z",
"dateReserved": "2026-09-11T19:38:34.775Z",
"dateUpdated": "2026-10-30T12:33:25.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68745 (GCVE-0-2025-68745)
Vulnerability from cvelistv5
Published
2025-12-24 12:09
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Clear cmds after chip reset
Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling
and host reset handling") caused two problems:
1. Commands sent to FW, after chip reset got stuck and never freed as FW
is not going to respond to them anymore.
2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a
("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
attempted to fix this, but introduced another bug under different
circumstances when two different CPUs were racing to call
qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in
dma_unmap_sg_attrs().
So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and
partially revert "scsi: qla2xxx: target: Fix offline port handling and
host reset handling" at __qla2x00_abort_all_cmds.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: eb67b7a23d357f578578e737cb6412ae2384f352 Version: ec9639d92c1e10d4bc667e842753d85e21683d5c Version: e6e957f552d5b696879a31e5b0e2a9120e1ea86e Version: 4.9.316 ≤ Version: 4.14.281 ≤ Version: 4.19.245 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:04:59.378599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:43.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c",
"drivers/scsi/qla2xxx/qla_target.c",
"drivers/scsi/qla2xxx/qla_target.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e87e9f92d7735895b7dd97f53dce6d95d08cf29c",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "0d0a1a267c1ee7c41aeffdca84afcb113787a91a",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "c82c0fbb97d0fd44324eb55ab758408c7c964b32",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "d46c69a087aa3d1513f7a78f871b80251ea0c1ae",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"status": "affected",
"version": "eb67b7a23d357f578578e737cb6412ae2384f352",
"versionType": "git"
},
{
"status": "affected",
"version": "ec9639d92c1e10d4bc667e842753d85e21683d5c",
"versionType": "git"
},
{
"status": "affected",
"version": "e6e957f552d5b696879a31e5b0e2a9120e1ea86e",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.316",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.281",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.245",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c",
"drivers/scsi/qla2xxx/qla_target.c",
"drivers/scsi/qla2xxx/qla_target.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.316",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.281",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.245",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clear cmds after chip reset\n\nCommit aefed3e5548f (\"scsi: qla2xxx: target: Fix offline port handling\nand host reset handling\") caused two problems:\n\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\n is not going to respond to them anymore.\n\n2. BUG_ON(cmd-\u003esg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a\n (\"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\")\n attempted to fix this, but introduced another bug under different\n circumstances when two different CPUs were racing to call\n qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\n dma_unmap_sg_attrs().\n\nSo revert \"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\" and\npartially revert \"scsi: qla2xxx: target: Fix offline port handling and\nhost reset handling\" at __qla2x00_abort_all_cmds."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote Fibre Channel/FCoE initiator can reach the vulnerable command lifecycle by sending FCP I/O and ABTS/TMR frames, without local host access.\nAC:L - The initiator can keep large PI/DIF I/O active while repeatedly issuing abort or reset requests, controlling both sides of the abort-versus-completion race.\nPR:N - Dynamic/demo ACL configurations admit fabric initiators without credentials, and WWPN-based session establishment requires no privilege on the target host.\nUI:N - Exploitation requires only attacker-generated fabric traffic and no victim action during the attack.\nS:U - The vulnerable driver and the affected kernel memory and storage resources belong to the same security authority.\nC:H - Concurrent unmapping can double-free shared DIF CRC-context and DSD objects, producing overlapping firmware-visible DMA contexts that can expose kernel or cross-command data.\nI:H - The DMA-pool double-free and concurrent DSD list deletion can corrupt kernel memory or redirect device DMA, potentially enabling arbitrary modification or code execution.\nA:H - The reported paths reach kernel BUG assertions, while reset-time command leaks can permanently exhaust resources; either can crash or render the target unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:17.973Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e87e9f92d7735895b7dd97f53dce6d95d08cf29c"
},
{
"url": "https://git.kernel.org/stable/c/0d0a1a267c1ee7c41aeffdca84afcb113787a91a"
},
{
"url": "https://git.kernel.org/stable/c/c82c0fbb97d0fd44324eb55ab758408c7c964b32"
},
{
"url": "https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936"
},
{
"url": "https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae"
}
],
"title": "scsi: qla2xxx: Clear cmds after chip reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68745",
"datePublished": "2025-12-24T12:09:41.517Z",
"dateReserved": "2025-12-24T10:30:51.031Z",
"dateUpdated": "2026-10-30T12:23:17.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93122 (GCVE-0-2026-93122)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uac: validate rate list length before storing
UAC1 and UAC2 configfs rate-list attributes parse a comma-separated
list of sampling rates and store each parsed value in fixed-size arrays.
The arrays have UAC_MAX_RATES entries, but the store paths do not check
that the input contains at most that many tokens before writing through
opts->name##s[i++].
Writing more than ten rates therefore writes past the end of the
p_srates[] or c_srates[] array in struct f_uac1_opts or struct
f_uac2_opts.
With CONFIG_UBSAN_BOUNDS enabled, writing an 11-entry rate list to the
UAC1 p_srate attribute reports:
UBSAN: array-index-out-of-bounds
drivers/usb/gadget/function/f_uac1.c:1669:1
index 10 is out of range for type 'int [10]'
__ubsan_handle_out_of_bounds.cold
f_uac1_opts_p_srate_store
configfs_write_iter
vfs_write
ksys_write
do_syscall_64
The same reproducer against the UAC2 p_srate attribute reports:
UBSAN: array-index-out-of-bounds
drivers/usb/gadget/function/f_uac2.c:2087:1
index 10 is out of range for type 'int [10]'
__ubsan_handle_out_of_bounds.cold
f_uac2_opts_p_srate_store
configfs_write_iter
vfs_write
ksys_write
do_syscall_64
Reject additional tokens once UAC_MAX_RATES entries have been parsed.
Also keep the original kstrdup() pointer for kfree(), because strsep()
advances the parsing cursor. Freeing the advanced cursor leaks the
original buffer on successful parses and can free an interior pointer on
some error paths.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a7339e4f5788bd088bb0be1f96a6cce459676ed0 Version: a7339e4f5788bd088bb0be1f96a6cce459676ed0 Version: a7339e4f5788bd088bb0be1f96a6cce459676ed0 Version: a7339e4f5788bd088bb0be1f96a6cce459676ed0 Version: a7339e4f5788bd088bb0be1f96a6cce459676ed0 Version: a7339e4f5788bd088bb0be1f96a6cce459676ed0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_uac1.c",
"drivers/usb/gadget/function/f_uac2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30b3b3494000aa01fc8f08bf07ed503c9fde4895",
"status": "affected",
"version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
"versionType": "git"
},
{
"lessThan": "72888d54bae3677ecd4ba9793b7fd27ba0b27862",
"status": "affected",
"version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
"versionType": "git"
},
{
"lessThan": "0c2710a36b41bf8defba83c395b99eb1660e9e9a",
"status": "affected",
"version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
"versionType": "git"
},
{
"lessThan": "0203146ad450932c2d3132e367a99c49efe3122d",
"status": "affected",
"version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
"versionType": "git"
},
{
"lessThan": "3819c6f255a37c4d085ce9f264f9f11bf3c2c6bb",
"status": "affected",
"version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
"versionType": "git"
},
{
"lessThan": "844d83d5964b87919b958ff48405188c6ddae9cc",
"status": "affected",
"version": "a7339e4f5788bd088bb0be1f96a6cce459676ed0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_uac1.c",
"drivers/usb/gadget/function/f_uac2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uac: validate rate list length before storing\n\nUAC1 and UAC2 configfs rate-list attributes parse a comma-separated\nlist of sampling rates and store each parsed value in fixed-size arrays.\nThe arrays have UAC_MAX_RATES entries, but the store paths do not check\nthat the input contains at most that many tokens before writing through\nopts-\u003ename##s[i++].\n\nWriting more than ten rates therefore writes past the end of the\np_srates[] or c_srates[] array in struct f_uac1_opts or struct\nf_uac2_opts.\n\nWith CONFIG_UBSAN_BOUNDS enabled, writing an 11-entry rate list to the\nUAC1 p_srate attribute reports:\n\n UBSAN: array-index-out-of-bounds\n drivers/usb/gadget/function/f_uac1.c:1669:1\n index 10 is out of range for type \u0027int [10]\u0027\n __ubsan_handle_out_of_bounds.cold\n f_uac1_opts_p_srate_store\n configfs_write_iter\n vfs_write\n ksys_write\n do_syscall_64\n\nThe same reproducer against the UAC2 p_srate attribute reports:\n\n UBSAN: array-index-out-of-bounds\n drivers/usb/gadget/function/f_uac2.c:2087:1\n index 10 is out of range for type \u0027int [10]\u0027\n __ubsan_handle_out_of_bounds.cold\n f_uac2_opts_p_srate_store\n configfs_write_iter\n vfs_write\n ksys_write\n do_syscall_64\n\nReject additional tokens once UAC_MAX_RATES entries have been parsed.\nAlso keep the original kstrdup() pointer for kfree(), because strsep()\nadvances the parsing cursor. Freeing the advanced cursor leaks the\noriginal buffer on successful parses and can free an interior pointer on\nsome error paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malformed comma-separated rates enter via write(2)\u2192configfs_write_iter()\u2192f_uac1_opts_p_srate_store/f_uac1_opts_c_srate_store (and the UAC2 twins) on /sys/kernel/config/usb_gadget/\u003cg\u003e/functions/uac{1,2}.*/{p,c}_srate; USB SETUP/iso packets never supply that page.\nAC:L - A fresh function_make() uac1/uac2 instance has opts-\u003erefcnt==0, so one write of eleven or more kstrtou32 tokens (up to configfs SIMPLE_ATTR_SIZE-1 bytes) stores through opts-\u003ep_srates[i++]/c_srates[i++] past UAC_MAX_RATES with no race or victim state.\nPR:L - f_uac1_opts_p_srate_store and f_uac2_opts_p_srate_store (and the c_srate stores) do no capable() check; CONFIGFS_ATTR is S_IWUSR, and Android/embedded USB gadget HALs routinely chown /sys/kernel/config/usb_gadget to a non-root system or HAL daemon.\nUI:N - The attacker mkdir\u0027s the uac1/uac2 function instance and writes the oversized p_srate or c_srate list themselves; no other user must plug a cable, mount a volume, or open a file.\nS:U - The store overwrites the kmalloc\u0027d struct f_uac1_opts/f_uac2_opts and neighbouring host-kernel slab in the same OS authority; it is not a VM escape, IOMMU/DMA bypass, or sandbox breakout.\nC:H - Each extra token is an attacker-chosen u32 written past p_srates[9]/c_srates[9] into the rest of the kzalloc\u0027d opts object and adjacent slab; that heap overflow is groomable into a kernel-memory disclosure primitive.\nI:H - f_uac1_opts_p_srate_store writes attacker-controlled ints past p_srates[] over p_ssize, the 126-byte name arrays, refcnt, and opts-\u003elock, then mutex_unlock()s the corrupted mutex \u2014 an arbitrary-write and control-flow hijack primitive.\nA:H - The commit\u0027s UBSAN report is array-index-out-of-bounds at f_uac1_opts_p_srate_store/f_uac2_opts_p_srate_store index 10 of int[10]; without UBSAN the same store corrupts opts-\u003elock and adjacent slab and oopses or panics."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:02.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30b3b3494000aa01fc8f08bf07ed503c9fde4895"
},
{
"url": "https://git.kernel.org/stable/c/72888d54bae3677ecd4ba9793b7fd27ba0b27862"
},
{
"url": "https://git.kernel.org/stable/c/0c2710a36b41bf8defba83c395b99eb1660e9e9a"
},
{
"url": "https://git.kernel.org/stable/c/0203146ad450932c2d3132e367a99c49efe3122d"
},
{
"url": "https://git.kernel.org/stable/c/3819c6f255a37c4d085ce9f264f9f11bf3c2c6bb"
},
{
"url": "https://git.kernel.org/stable/c/844d83d5964b87919b958ff48405188c6ddae9cc"
}
],
"title": "usb: gadget: uac: validate rate list length before storing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93122",
"datePublished": "2026-09-17T16:11:27.890Z",
"dateReserved": "2026-09-17T16:02:15.086Z",
"dateUpdated": "2026-10-30T12:36:02.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72499 (GCVE-0-2026-72499)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
Free the toggle page only after firmware teardown completes so that
an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write
the toggle value to an already-freed page. Move free_page() after
bnxt_qplib_destroy_cq.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72499",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:12.867035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:27.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a8d69a01bda1fec9b07b5559be2b6ed45b1e974",
"status": "affected",
"version": "e275919d96693c5ca964b20d73a33d52a7e57f04",
"versionType": "git"
},
{
"lessThan": "33aed3ba04aa56eeeb876935896aa6530c46640e",
"status": "affected",
"version": "e275919d96693c5ca964b20d73a33d52a7e57f04",
"versionType": "git"
},
{
"lessThan": "b193854675ecad43b4d69c304c1b6a90b206cc99",
"status": "affected",
"version": "e275919d96693c5ca964b20d73a33d52a7e57f04",
"versionType": "git"
},
{
"lessThan": "bb45e06f9914ca64ac95341a80a0c20bb8dd46a9",
"status": "affected",
"version": "e275919d96693c5ca964b20d73a33d52a7e57f04",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Free CQ toggle page after firmware teardown\n\nFree the toggle page only after firmware teardown completes so that\nan NQ interrupt arriving during bnxt_qplib_destroy_cq() won\u0027t write\nthe toggle value to an already-freed page. Move free_page() after\nbnxt_qplib_destroy_cq."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered by destroying a user CQ through the RDMA uverbs ioctl on /dev/infiniband/uverbs*; although RoCE peers can generate CQ/NQ events, the premature free_page() only occurs in this local destroy path, not from remote packet handling alone.\nAC:L - An attacker controls CQ teardown timing via ibv_destroy_cq and can reliably create the race by keeping QPs active and/or soliciting CQ notifications (including from a cooperating RoCE peer) while destroy_cq runs through bnxt_qplib_destroy_cq firmware teardown.\nPR:L - Exploitation requires only local RDMA verbs access to create/destroy a user CQ on a Gen P7 bnxt_re device; uverbs char devices are created world-accessible (0666) and RDMA is commonly granted to unprivileged HPC/cloud/Kubernetes workload users rather than real root.\nUI:N - No victim interaction is required beyond the attacker (or compromised local workload) invoking CQ destroy on resources it already controls; remote peers may assist timing but do not need the victim to click, mount, or open files.\nS:C - On Kubernetes/HPC hosts that expose bnxt_re to containers/pods, triggering this host-kernel UAF from an unprivileged RDMA-enabled workload can corrupt host memory and enable container-to-host sandbox escape beyond the workload security boundary.\nC:H - This is a kernel write-after-free: an NQ interrupt writes a toggle value into a page already returned to the buddy allocator, enabling corruption of subsequently reallocated kernel objects and classic UAF-based information disclosure primitives.\nI:H - The interrupt path performs a controlled 4-byte write to freed kernel memory during destroy_cq, providing a heap corruption primitive that can be developed into arbitrary kernel write or code execution rather than being limited to a benign crash.\nA:H - Writing to a freed page during interrupt handling can oops/panic the kernel immediately, and repeated CQ create/destroy cycles let an attacker reliably induce host-level denial of service on RDMA-enabled systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:06.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a8d69a01bda1fec9b07b5559be2b6ed45b1e974"
},
{
"url": "https://git.kernel.org/stable/c/33aed3ba04aa56eeeb876935896aa6530c46640e"
},
{
"url": "https://git.kernel.org/stable/c/b193854675ecad43b4d69c304c1b6a90b206cc99"
},
{
"url": "https://git.kernel.org/stable/c/bb45e06f9914ca64ac95341a80a0c20bb8dd46a9"
}
],
"title": "RDMA/bnxt_re: Free CQ toggle page after firmware teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72499",
"datePublished": "2026-08-15T05:57:31.696Z",
"dateReserved": "2026-08-09T03:40:39.937Z",
"dateUpdated": "2026-10-21T12:45:06.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53118 (GCVE-0-2026-53118)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-11-06 16:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vdpa: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:19:41.801775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:24:02.153Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa.c",
"include/linux/vdpa.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4005cb89139f7c9af85046b241dcf3fa2e1b3559",
"status": "affected",
"version": "539fec78edb4e084e7c532affc56cc42d4ceea4b",
"versionType": "git"
},
{
"lessThan": "4eab1a74a498f0bf19f102f9362e9deef9307aea",
"status": "affected",
"version": "539fec78edb4e084e7c532affc56cc42d4ceea4b",
"versionType": "git"
},
{
"lessThan": "654ef9c33e138ede6734ac286282df9faf83cd11",
"status": "affected",
"version": "539fec78edb4e084e7c532affc56cc42d4ceea4b",
"versionType": "git"
},
{
"lessThan": "fb5cb4913ce333cc4647722e8c2b8378e12f2464",
"status": "affected",
"version": "539fec78edb4e084e7c532affc56cc42d4ceea4b",
"versionType": "git"
},
{
"lessThan": "85bb534ff12aab6916058897b39c748940a7a4c6",
"status": "affected",
"version": "539fec78edb4e084e7c532affc56cc42d4ceea4b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa.c",
"include/linux/vdpa.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus\u0027 match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:06.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559"
},
{
"url": "https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea"
},
{
"url": "https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11"
},
{
"url": "https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464"
},
{
"url": "https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"
}
],
"title": "vdpa: use generic driver_override infrastructure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53118",
"datePublished": "2026-06-24T16:30:49.308Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-11-06T16:24:02.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63979 (GCVE-0-2026-63979)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/handshake: hand off the pinned file reference to accept_doit
handshake_req_next() removes the request from the per-net
pending list and drops hn_lock before handshake_nl_accept_doit()
reads req->hr_sk->sk_socket and dereferences sock->file (once in
FD_PREPARE() and again in get_file()). In that window a
consumer running tls_handshake_cancel() followed by sockfd_put()
(svc_sock_free) or __fput_sync() (xs_reset_transport) releases
sock->file. sock_release() then runs sock_orphan(), zeroing
sk_socket, and frees the struct socket. The accept-side code
either reads NULL through sk_socket or chases freed memory.
The submit-side sock_hold() does not prevent this. sk_refcnt
protects struct sock, but struct socket and sock->file are
independently refcounted via the file descriptor the consumer
owns. Pinning sk leaves sock and sock->file unprotected.
Retarget the accept-side dereferences at req->hr_file, which was
pinned at submit time, instead of req->hr_sk->sk_socket->file.
Pinning on its own is not sufficient: a consumer that cancels
between handshake_req_next() returning and accept_doit reaching
FD_PREPARE() takes the !remove_pending() branch in
handshake_req_cancel() and drops hr_file before the accept side
takes its own reference. Hand off an additional file reference
inside handshake_req_next(), under hn_lock, so the accept side
operates on a reference that no concurrent handshake_req_cancel()
can revoke. FD_PREPARE() consumes that handed-off reference,
either by transferring it to the new fd in fd_publish() or by
dropping it in the cleanup destructor on error; the explicit
get_file() that previously balanced FD_PREPARE() is therefore
redundant and goes away.
Update handshake_req_cancel_test2 and _test3 to simulate the
FD_PREPARE() consumption with an fput() so the kunit file-count
assertions stay balanced.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63979",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:33.675009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:00.491Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/handshake/handshake-test.c",
"net/handshake/netlink.c",
"net/handshake/request.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b869e3e4ce1996df23b3efdbbe9a64c4ab81d745",
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"versionType": "git"
},
{
"lessThan": "2f28dbb30b88eafab8d49aaec94710b4e12dea8e",
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"versionType": "git"
},
{
"lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f",
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"versionType": "git"
},
{
"lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4",
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"versionType": "git"
},
{
"lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055",
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/handshake/handshake-test.c",
"net/handshake/netlink.c",
"net/handshake/request.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req-\u003ehr_sk-\u003esk_socket and dereferences sock-\u003efile (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock-\u003efile. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock-\u003efile are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock-\u003efile unprotected.\n\nRetarget the accept-side dereferences at req-\u003ehr_file, which was\npinned at submit time, instead of req-\u003ehr_sk-\u003esk_socket-\u003efile.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The race is triggered by remote TLS handshake activity on network-facing kernel consumers (nfsd RPC-over-TLS STARTTLS probe, NVMe-oTCP TLS13 connections). A remote peer can initiate handshake_req_submit() and force cancellation via disconnect, while tlshd automatically issues HANDSHAKE_CMD_ACCEPT in response to kernel notifications.\nAC:L - The attacker controls both sides of the race by opening TLS connections and timing disconnects or aborts against tlshd accept processing. Repeated parallel connection attempts make winning the window between handshake_req_next() and FD_PREPARE() practical without conditions outside attacker control.\nPR:N - Exploitation requires no credentials on the target server. NFS RPC_AUTH_TLS uses a NULL-procedure STARTTLS probe before any RPC authentication, and NVMe-oTCP TLS handshakes run at initial connection setup prior to namespace authentication.\nUI:N - No victim interaction is required. The tlshd daemon automatically accepts pending handshake requests upon receiving HANDSHAKE_CMD_READY multicast notifications; the attacker only needs to manipulate connection timing over the network.\nS:U - The vulnerability corrupts kernel heap memory (struct socket/file UAF or NULL dereference through sk_socket) within the kernel\u0027s security authority. It does not cross a VM, container, or IOMMU security boundary.\nC:H - The accept path dereferences sock-\u003efile after sock_release() may free the struct socket and sock_orphan() zeroes sk_socket, constituting a use-after-free. UAF of socket/file structures can be leveraged for arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of the pinned socket file object provides a foundation for heap spraying and arbitrary write primitives to hijack kernel control flow, not merely a bounded or transient modification.\nA:H - The bug manifests as either a NULL pointer dereference through zeroed sk_socket or chasing freed socket memory in FD_PREPARE()/get_file(), both of which cause kernel oops or panic and deny service to the affected host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:50.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"
},
{
"url": "https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"
},
{
"url": "https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"
},
{
"url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"
},
{
"url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"
}
],
"title": "net/handshake: hand off the pinned file reference to accept_doit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63979",
"datePublished": "2026-07-19T14:56:03.177Z",
"dateReserved": "2026-07-19T07:54:57.025Z",
"dateUpdated": "2026-10-21T12:42:50.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38041 (GCVE-0-2025-38041)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
The H616 manual does not state that the GPU PLL supports
dynamic frequency configuration, so we must take extra care when changing
the frequency. Currently any attempt to do device DVFS on the GPU lead
to panfrost various ooops, and GPU hangs.
The manual describes the algorithm for changing the PLL
frequency, which the CPU PLL notifier code already support, so we reuse
that to reparent the GPU clock to GPU1 clock during frequency
changes.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/sunxi-ng/ccu-sun50i-h616.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b447255bf170aee508d50c4a3a1156eb6dcc9b4",
"status": "affected",
"version": "88dde5e23da1a16fe9a417171e6c941736b8d3a6",
"versionType": "git"
},
{
"lessThan": "47a0da0c80749767de1bc0a7a27a69b34c22fbda",
"status": "affected",
"version": "88dde5e23da1a16fe9a417171e6c941736b8d3a6",
"versionType": "git"
},
{
"lessThan": "0c4f89f02c72f7cfb98a9a09cae89cc2e39e6017",
"status": "affected",
"version": "88dde5e23da1a16fe9a417171e6c941736b8d3a6",
"versionType": "git"
},
{
"lessThan": "1439673b78185eaaa5fae444b3a9d58c434ee78e",
"status": "affected",
"version": "88dde5e23da1a16fe9a417171e6c941736b8d3a6",
"versionType": "git"
},
{
"lessThan": "eb963d7948ce6571939c6875424b557b25f16610",
"status": "affected",
"version": "88dde5e23da1a16fe9a417171e6c941736b8d3a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/sunxi-ng/ccu-sun50i-h616.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.9",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: sunxi-ng: h616: Reparent GPU clock during frequency changes\n\nThe H616 manual does not state that the GPU PLL supports\ndynamic frequency configuration, so we must take extra care when changing\nthe frequency. Currently any attempt to do device DVFS on the GPU lead\nto panfrost various ooops, and GPU hangs.\n\nThe manual describes the algorithm for changing the PLL\nfrequency, which the CPU PLL notifier code already support, so we reuse\nthat to reparent the GPU clock to GPU1 clock during frequency\nchanges."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:33.881Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b447255bf170aee508d50c4a3a1156eb6dcc9b4"
},
{
"url": "https://git.kernel.org/stable/c/47a0da0c80749767de1bc0a7a27a69b34c22fbda"
},
{
"url": "https://git.kernel.org/stable/c/0c4f89f02c72f7cfb98a9a09cae89cc2e39e6017"
},
{
"url": "https://git.kernel.org/stable/c/1439673b78185eaaa5fae444b3a9d58c434ee78e"
},
{
"url": "https://git.kernel.org/stable/c/eb963d7948ce6571939c6875424b557b25f16610"
}
],
"title": "clk: sunxi-ng: h616: Reparent GPU clock during frequency changes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38041",
"datePublished": "2025-06-18T09:33:26.543Z",
"dateReserved": "2025-04-16T04:51:23.978Z",
"dateUpdated": "2026-10-30T12:21:33.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72500 (GCVE-0-2026-72500)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
Free the toggle page only after firmware teardown completes so that
an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write
the toggle values to an already-freed page. Move free_page() after
bnxt_qplib_destroy_srq().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:15.063449Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:27.608Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b6ecad5b9b0f7230ed725aafaf8c4ed9327a9bf",
"status": "affected",
"version": "181028a0d84cdcc7ac86d05cc49eaa416ce85c8b",
"versionType": "git"
},
{
"lessThan": "104a7ff382a58a83cae018925e3574c784e8274c",
"status": "affected",
"version": "181028a0d84cdcc7ac86d05cc49eaa416ce85c8b",
"versionType": "git"
},
{
"lessThan": "0adcd67f3d6f84835be682da0153f57f5c2f8036",
"status": "affected",
"version": "181028a0d84cdcc7ac86d05cc49eaa416ce85c8b",
"versionType": "git"
},
{
"lessThan": "131e2918b9b0529687e67e2e58047304027f095a",
"status": "affected",
"version": "181028a0d84cdcc7ac86d05cc49eaa416ce85c8b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Free SRQ toggle page after firmware teardown\n\nFree the toggle page only after firmware teardown completes so that\nan NQ interrupt arriving during bnxt_qplib_destroy_srq() won\u0027t write\nthe toggle values to an already-freed page. Move free_page() after\nbnxt_qplib_destroy_srq()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered by destroying a user SRQ through the RDMA uverbs ioctl on /dev/infiniband/uverbs*; although RoCE peers can generate SRQ/NQ events, the premature free_page() only occurs in this local destroy path, not from remote packet handling alone.\nAC:L - An attacker controls SRQ teardown timing via ibv_destroy_srq and can reliably create the race by keeping QPs/posted receives active and/or soliciting SRQ threshold events (including from a cooperating RoCE peer) while destroy_srq runs through bnxt_qplib_destroy_srq firmware teardown.\nPR:L - Exploitation requires only local RDMA verbs access to create/destroy a user SRQ on a Gen P7 bnxt_re device; uverbs char devices are created world-accessible (0666) and RDMA is commonly granted to unprivileged HPC/cloud/Kubernetes workload users rather than real root.\nUI:N - No victim interaction is required beyond the attacker (or compromised local workload) invoking SRQ destroy on resources it already controls; remote peers may assist timing but do not need the victim to click, mount, or open files.\nS:C - On Kubernetes/HPC hosts that expose bnxt_re to containers/pods, triggering this host-kernel UAF from an unprivileged RDMA-enabled workload can corrupt host memory and enable container-to-host sandbox escape beyond the workload security boundary.\nC:H - This is a kernel write-after-free: an NQ interrupt writes a toggle value into a page already returned to the buddy allocator, enabling corruption of subsequently reallocated kernel objects and classic UAF-based information disclosure primitives.\nI:H - The interrupt path performs a controlled 4-byte write to freed kernel memory during destroy_srq, providing a heap corruption primitive that can be developed into arbitrary kernel write or code execution rather than being limited to a benign crash.\nA:H - Writing to a freed page during interrupt handling can oops/panic the kernel immediately, and repeated SRQ create/destroy cycles let an attacker reliably induce host-level denial of service on RDMA-enabled systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:07.452Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b6ecad5b9b0f7230ed725aafaf8c4ed9327a9bf"
},
{
"url": "https://git.kernel.org/stable/c/104a7ff382a58a83cae018925e3574c784e8274c"
},
{
"url": "https://git.kernel.org/stable/c/0adcd67f3d6f84835be682da0153f57f5c2f8036"
},
{
"url": "https://git.kernel.org/stable/c/131e2918b9b0529687e67e2e58047304027f095a"
}
],
"title": "RDMA/bnxt_re: Free SRQ toggle page after firmware teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72500",
"datePublished": "2026-08-15T05:57:32.341Z",
"dateReserved": "2026-08-09T03:40:39.937Z",
"dateUpdated": "2026-10-21T12:45:07.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74544 (GCVE-0-2026-74544)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,
0-255) into the kernel knode object without bounds validation. When a
packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates
`ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit
value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior
per C11 6.5.7p3, triggerable by an unprivileged user via user/network
namespaces.
UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43
shift exponent 32 is too large for 32-bit type int
Fix this by rejecting offshift >= 16 during filter creation in
u32_change().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74544",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:49.230429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:54.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_u32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7fd5b2287e5cf33e114fb7f0cef781a546039757",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "724c8edbacf1259988829cb9967f751222121d8a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "006a4598da9a6b02e0ddc3ca5042b97224774364",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9990cac513e8b191de2ee589051ea7ebf3cee940",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "313cb9ffc4101a885d791facf4b5ea3d5e06144d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "aef96eead2860cbfa371e4471d4f04412213b958",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_u32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: validate offshift to prevent shift-out-of-bounds\n\nu32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,\n0-255) into the kernel knode object without bounds validation. When a\npacket later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates\n`ntohs(offmask \u0026 *data) \u003e\u003e offshift` where the left operand is a 16-bit\nvalue promoted to a 32-bit int. Any offshift \u003e= 32 is undefined behavior\nper C11 6.5.7p3, triggerable by an unprivileged user via user/network\nnamespaces.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43\nshift exponent 32 is too large for 32-bit type int\n\nFix this by rejecting offshift \u003e= 16 during filter creation in\nu32_change()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is configured through RTM_NEWTFILTER rtnetlink (tc filter add) in u32_change(); per kernel CNA guidance, tc/qdisc/netlink classifier setup is Local even though subsequent packets invoke u32_classify() on ingress/egress paths.\nAC:L - The attacker fully controls offshift (32-255), TC_U32_VAROFFSET selector flags, and matching packet bytes when installing the filter and sending traffic through the attached qdisc; no race or external victim state is required.\nPR:L - Creating u32 filters requires CAP_NET_ADMIN, which an unprivileged local user obtains in a user/network namespace via unshare -Urn; rtnetlink enforces netlink_net_capable() against that namespace\u0027s user_ns, not only init-root.\nUI:N - The attacker installs the malicious u32 filter and injects triggering packets themselves within their namespace; no separate victim action (opening files, mounting media, clicking links) is needed.\nS:U - Corrupted classifier offset arithmetic and any resulting kernel crash stay within the host kernel\u0027s security authority; this is standard local kernel compromise, not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Undefined-behavior right-shift (offshift\u003e=32) on packet-derived values corrupts variable offset math in u32_classify(), driving attacker-influenced skb_header_pointer reads at unintended offsets; per CNA guidance, exploitable kernel memory-unsafe operations warrant High confidentiality impact.\nI:H - Invalid shift results corrupt off2 and unsigned off accumulation in the classifier hot path, derailing cls_u32 control flow; C11 undefined behavior in kernel packet classification is exploitable for integrity compromise and potential code execution per CNA memory-corruption guidance.\nA:H - Hitting u32_classify() with offshift\u003e=32 provokes documented UBSAN shift-out-of-bounds at cls_u32.c:236; undefined shifts can also trigger kernel oops/panic during packet classification, satisfying CNA guidance that kernel crashes are High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:09.940Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7fd5b2287e5cf33e114fb7f0cef781a546039757"
},
{
"url": "https://git.kernel.org/stable/c/724c8edbacf1259988829cb9967f751222121d8a"
},
{
"url": "https://git.kernel.org/stable/c/006a4598da9a6b02e0ddc3ca5042b97224774364"
},
{
"url": "https://git.kernel.org/stable/c/9990cac513e8b191de2ee589051ea7ebf3cee940"
},
{
"url": "https://git.kernel.org/stable/c/313cb9ffc4101a885d791facf4b5ea3d5e06144d"
},
{
"url": "https://git.kernel.org/stable/c/aef96eead2860cbfa371e4471d4f04412213b958"
}
],
"title": "net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74544",
"datePublished": "2026-08-15T12:27:53.941Z",
"dateReserved": "2026-08-15T05:44:03.914Z",
"dateUpdated": "2026-10-30T12:30:09.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90346 (GCVE-0-2026-90346)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: clean up color-change beacon data on errors
nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next
template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies.
A parsing failure returned directly instead of using the out: cleanup,
leaking any allocations completed before the error.
Allocate the nested attribute table before parsing beacon_next. Its
allocation failure can then return before beacon data exists, while a
later parsing failure uses out: to release the parsed data.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dc1e3cb8da8b414b37208b2fb6755fef8122504b Version: dc1e3cb8da8b414b37208b2fb6755fef8122504b Version: dc1e3cb8da8b414b37208b2fb6755fef8122504b Version: dc1e3cb8da8b414b37208b2fb6755fef8122504b Version: dc1e3cb8da8b414b37208b2fb6755fef8122504b Version: dc1e3cb8da8b414b37208b2fb6755fef8122504b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62f8c28a0fb08611e1278ab2af964550e22aac3c",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "5f47c9bc4a62e61f932a83680a796bc09ae48dd3",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "bbe3a69a7b64398dddd1c989e9a40eaa57616b33",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "0ec1d14cf302ae7c23ec218527b2849a1fced3f4",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "4e0a67fbe3d9e2e1d6f81dfc607184c6b0abd3dd",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "927ee844c47ac2aef22c8f7a35f098ff576b398b",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: clean up color-change beacon data on errors\n\nnl80211_color_change() calls nl80211_parse_beacon() for the beacon_next\ntemplate, which can allocate params.beacon_next.mbssid_ies and .rnr_ies.\nA parsing failure returned directly instead of using the out: cleanup,\nleaking any allocations completed before the error.\n\nAllocate the nested attribute table before parsing beacon_next. Its\nallocation failure can then return before beacon data exists, while a\nlater parsing failure uses out: to release the parsed data."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:18.517Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62f8c28a0fb08611e1278ab2af964550e22aac3c"
},
{
"url": "https://git.kernel.org/stable/c/5f47c9bc4a62e61f932a83680a796bc09ae48dd3"
},
{
"url": "https://git.kernel.org/stable/c/bbe3a69a7b64398dddd1c989e9a40eaa57616b33"
},
{
"url": "https://git.kernel.org/stable/c/0ec1d14cf302ae7c23ec218527b2849a1fced3f4"
},
{
"url": "https://git.kernel.org/stable/c/4e0a67fbe3d9e2e1d6f81dfc607184c6b0abd3dd"
},
{
"url": "https://git.kernel.org/stable/c/927ee844c47ac2aef22c8f7a35f098ff576b398b"
}
],
"title": "wifi: nl80211: clean up color-change beacon data on errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90346",
"datePublished": "2026-09-17T16:08:55.591Z",
"dateReserved": "2026-09-11T19:38:34.805Z",
"dateUpdated": "2026-10-30T12:35:18.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99077 (GCVE-0-2026-99077)
Vulnerability from cvelistv5
Published
2026-10-23 12:23
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: udp: Create exceptions before socket matching
Currently, when ICMP Fragmentation Needed and Redirect Message packets
are locally delivered and quote a UDP packet, a FIB nexthop exception
(FNHE) is only created if the kernel can match the UDP packet to an
existing socket.
This behavior allows off-path attackers to conduct a side-channel attack
on the FNHE cache in order to discover the ephemeral port used by a
connected UDP socket.
Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache
less predictible") tried to mitigate such attacks by making it harder
for attackers to discover hash collisions in the FNHE cache and by
randomizing the number of exceptions a hash bucket can hold,
respectively. Unfortunately, both of the mitigations can be bypassed.
Instead, mitigate such attacks by always creating a FNHE, even before
trying to find a matching socket. Do that by calling ipv4_update_pmtu()
and ipv4_redirect(), the helpers used when the quoted packet did not
originate from a socket.
This means that guesses (right or wrong) from an off-path attacker will
always result in a FNHE being created or updated in the cache that the
attacker can observe.
Pass an oif of 0, in a similar fashion to icmp_err(). This is also the
oif used by the socket path for sockets that are not bound to a device.
Note that this does not allow attackers to create FNHEs that they could
not create before, as both helpers can already be reached with little to
no validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.
Also note that in the good case (matched socket) the above scheme comes
at the cost of an extra route lookup, as the no socket helpers perform
their own lookup before the one performed by ipv4_sk_update_pmtu() /
ipv4_sk_redirect(). When the two resolve to different nexthops, it also
results in two exceptions being created for the same destination IP. One
in the FNHE cache of the nexthop resolved by the no socket helpers and
another in the FNHE cache of the nexthop used by the socket.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 Version: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8f211a37396f1684af9ac81b3fc53538eb9c2f7",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "9f97b01ee799bdf57d9183623f3987c8bbfd4f6f",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "e0cd4942831d4ef8f6d4b90b0d3510460fdfbceb",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "0cf0ff2f728f2a1434c56c0bcf267fe230abf124",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "3b92e4349c6b0dd1e05d5f0483e71ef37691b1c3",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "ecd7ead4bf05e221e90f18a29aec570a50fd1592",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "be4fd05398f2b5e42029be70ee875fc749b8ce3a",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
},
{
"lessThan": "4c3499f79f8c7e8561266bcc220a18538cec0458",
"status": "affected",
"version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in the FNHE cache of the nexthop used by the socket."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote IPv4 ICMP Fragmentation Needed or Redirect message carries the attacker-controlled inner IPv4/UDP quote through ip_rcv(), icmp_rcv(), icmp_socket_deliver(), and udp_err(), where its guessed four-tuple is matched.\nAC:H - Exploiting a connected socket requires turning fnhe_hashfun() bucket occupancy and update_or_create_fnhe() eviction into an oracle while the UDP tuple remains live; keyed hashing, randomized bucket depth, cache noise, and the short DNS response window are conditions the attacker cannot fully determine, although the mitigations can be bypassed.\nPR:N - icmp_rcv() checks packet structure, checksum, and policy but has no authentication or capability gate; icmp_unreach() passes a valid Fragmentation Needed quote to udp_err() without verifying that its sender is an on-path router.\nUI:N - The attacker can induce a resolver\u0027s connected UDP socket with a DNS query and then send the ICMP probes and cache-verification traffic; no victim user action is required.\nS:U - The FNHE oracle in udp_err() compromises networking and application data governed by the same host security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The __udp4_lib_lookup() result controls whether ipv4_sk_update_pmtu() or ipv4_sk_redirect() leaves an observable FNHE, disclosing the complete ephemeral source port. On a recursive DNS resolver, removing that entropy enables cache poisoning and redirection of client traffic, permitting broad disclosure.\nI:H - After learning the port, the same attacker can forge UDP DNS replies and brute-force the remaining transaction ID; an accepted reply can poison the resolver cache and map chosen names to attacker-controlled addresses.\nA:N - The fixed defect is the match-dependent FNHE oracle, not memory corruption or a crash. update_or_create_fnhe() already accepts other minimally validated ICMP cases, and the fix deliberately preserves exception creation, so route-cache manipulation is not an availability impact removed by this patch."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:34.248Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8f211a37396f1684af9ac81b3fc53538eb9c2f7"
},
{
"url": "https://git.kernel.org/stable/c/9f97b01ee799bdf57d9183623f3987c8bbfd4f6f"
},
{
"url": "https://git.kernel.org/stable/c/e0cd4942831d4ef8f6d4b90b0d3510460fdfbceb"
},
{
"url": "https://git.kernel.org/stable/c/0cf0ff2f728f2a1434c56c0bcf267fe230abf124"
},
{
"url": "https://git.kernel.org/stable/c/3b92e4349c6b0dd1e05d5f0483e71ef37691b1c3"
},
{
"url": "https://git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592"
},
{
"url": "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a"
},
{
"url": "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"
}
],
"title": "ipv4: udp: Create exceptions before socket matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99077",
"datePublished": "2026-10-23T12:23:22.773Z",
"dateReserved": "2026-09-25T10:25:14.389Z",
"dateUpdated": "2026-10-30T12:41:34.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99114 (GCVE-0-2026-99114)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION,
that is the whole of struct smb2_fs_control_info, but never assigns
FileSystemControlFlags. Those four bytes go to the client as they are
found in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks
nothing. A compound request can leak: the offset of the next response
is advanced by the length pinned for the previous one, so a reply that
was written into the buffer and then dropped in favour of the short
error response of smb2_set_err_rsp() stays there, and the next reply is
laid over it with only the header cleared.
ksmbd does not implement quota tracking, so report no control flags.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "995456b5e703e128904a6cbc8b3347eb3d04c72c",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "c78aea8984c84767e87f677477e4784deb8adfde",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "e8b82184a1982894820a91a72ac9857ddd5dffbf",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "370459776468fc68c97008360108f381e3120953",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "d8c450ad0d08980b39b08d435efa921086c8b227",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "03bb4338c3a7c3fc4decf699a35753f0891aab2a",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION\n\nsmb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION,\nthat is the whole of struct smb2_fs_control_info, but never assigns\nFileSystemControlFlags. Those four bytes go to the client as they are\nfound in the response buffer.\n\nThe buffer is zeroed on allocation, so a standalone request leaks\nnothing. A compound request can leak: the offset of the next response\nis advanced by the length pinned for the previous one, so a reply that\nwas written into the buffer and then dropped in favour of the short\nerror response of smb2_set_err_rsp() stays there, and the next reply is\nlaid over it with only the header cleared.\n\nksmbd does not implement quota tracking, so report no control flags."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:52.446Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/995456b5e703e128904a6cbc8b3347eb3d04c72c"
},
{
"url": "https://git.kernel.org/stable/c/c78aea8984c84767e87f677477e4784deb8adfde"
},
{
"url": "https://git.kernel.org/stable/c/e8b82184a1982894820a91a72ac9857ddd5dffbf"
},
{
"url": "https://git.kernel.org/stable/c/370459776468fc68c97008360108f381e3120953"
},
{
"url": "https://git.kernel.org/stable/c/d8c450ad0d08980b39b08d435efa921086c8b227"
},
{
"url": "https://git.kernel.org/stable/c/03bb4338c3a7c3fc4decf699a35753f0891aab2a"
},
{
"url": "https://git.kernel.org/stable/c/c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e"
}
],
"title": "ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99114",
"datePublished": "2026-10-28T10:34:31.576Z",
"dateReserved": "2026-09-25T10:25:14.392Z",
"dateUpdated": "2026-10-30T12:41:52.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74600 (GCVE-0-2026-74600)
Vulnerability from cvelistv5
Published
2026-08-22 15:31
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/page_table_check: skip special zero mappings
page_table_check_set() and page_table_check_clear() account mappings based
on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special
mappings, but page_table_check can still account them as file-backed
pages.
An unprivileged process can populate enough zero mappings to overflow
file_map_count and hit the existing BUG_ON(). The PTE path can do this
with the shared zero page, and the PMD path can do the same with huge zero
mappings.
Skip special zero mappings in the user page-table accounting paths. Keep
the PTE-side pte_special() check, and identify huge zero PMDs from the
mapped folio instead of pmd_special(). That covers architectures where
pmd_special() is a no-op without adding huge_zero_pfn checks to the
generic counter helpers.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: df4e817b710809425d899340dbfa8504a3ca4ba5 Version: df4e817b710809425d899340dbfa8504a3ca4ba5 Version: df4e817b710809425d899340dbfa8504a3ca4ba5 Version: df4e817b710809425d899340dbfa8504a3ca4ba5 Version: df4e817b710809425d899340dbfa8504a3ca4ba5 Version: df4e817b710809425d899340dbfa8504a3ca4ba5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/page_table_check.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "084b031a1cc13b1d50b9660baace0b7eba52bebe",
"status": "affected",
"version": "df4e817b710809425d899340dbfa8504a3ca4ba5",
"versionType": "git"
},
{
"lessThan": "f6cf9832e677ec07b1675782bd2bad472cfd3cdc",
"status": "affected",
"version": "df4e817b710809425d899340dbfa8504a3ca4ba5",
"versionType": "git"
},
{
"lessThan": "51e16e5adadaa78b56f31a1cb02eb7267787625e",
"status": "affected",
"version": "df4e817b710809425d899340dbfa8504a3ca4ba5",
"versionType": "git"
},
{
"lessThan": "7755be923e325dc300f4b0c3e1ad7e91b28b3cb9",
"status": "affected",
"version": "df4e817b710809425d899340dbfa8504a3ca4ba5",
"versionType": "git"
},
{
"lessThan": "b726eb3c94d23e09da0e0f46b0fa09fb2b5d99cc",
"status": "affected",
"version": "df4e817b710809425d899340dbfa8504a3ca4ba5",
"versionType": "git"
},
{
"lessThan": "8db4bab826ccc9ec10fa41736a48031cd338d392",
"status": "affected",
"version": "df4e817b710809425d899340dbfa8504a3ca4ba5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/page_table_check.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_table_check: skip special zero mappings\n\npage_table_check_set() and page_table_check_clear() account mappings based\non PageAnon(). Shared zero-page PTEs and huge zero PMDs are special\nmappings, but page_table_check can still account them as file-backed\npages.\n\nAn unprivileged process can populate enough zero mappings to overflow\nfile_map_count and hit the existing BUG_ON(). The PTE path can do this\nwith the shared zero page, and the PMD path can do the same with huge zero\nmappings.\n\nSkip special zero mappings in the user page-table accounting paths. Keep\nthe PTE-side pte_special() check, and identify huge zero PMDs from the\nmapped folio instead of pmd_special(). That covers architectures where\npmd_special() is a no-op without adding huge_zero_pfn checks to the\ngeneric counter helpers."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:13.139Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/084b031a1cc13b1d50b9660baace0b7eba52bebe"
},
{
"url": "https://git.kernel.org/stable/c/f6cf9832e677ec07b1675782bd2bad472cfd3cdc"
},
{
"url": "https://git.kernel.org/stable/c/51e16e5adadaa78b56f31a1cb02eb7267787625e"
},
{
"url": "https://git.kernel.org/stable/c/7755be923e325dc300f4b0c3e1ad7e91b28b3cb9"
},
{
"url": "https://git.kernel.org/stable/c/b726eb3c94d23e09da0e0f46b0fa09fb2b5d99cc"
},
{
"url": "https://git.kernel.org/stable/c/8db4bab826ccc9ec10fa41736a48031cd338d392"
}
],
"title": "mm/page_table_check: skip special zero mappings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74600",
"datePublished": "2026-08-22T15:31:49.334Z",
"dateReserved": "2026-08-15T05:44:03.919Z",
"dateUpdated": "2026-10-30T12:30:13.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31630 (GCVE-0-2026-31630)
Vulnerability from cvelistv5
Published
2026-04-24 14:44
Modified
2026-10-21 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: proc: size address buffers for %pISpc output
The AF_RXRPC procfs helpers format local and remote socket addresses into
fixed 50-byte stack buffers with "%pISpc".
That is too small for the longest current-tree IPv6-with-port form the
formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a
dotted-quad tail not only for v4mapped addresses, but also for ISATAP
addresses via ipv6_addr_is_isatap().
As a result, a case such as
[ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535
is possible with the current formatter. That is 50 visible characters, so
51 bytes including the trailing NUL, which does not fit in the existing
char[50] buffers used by net/rxrpc/proc.c.
Size the buffers from the formatter's maximum textual form and switch the
call sites to scnprintf().
Changes since v1:
- correct the changelog to cite the actual maximum current-tree case
explicitly
- frame the proof around the ISATAP formatting path instead of the earlier
mapped-v4 example
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 Version: 75b54cb57ca34cbe7a87c6ac757c55360a624590 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:17:22.345Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:11:18.108954Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:56:00.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rxrpc/proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "386c86412608d3449006a318a662cbcd6ca1f668",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "235b2115de892eab2e107a42efa7a4347baaa80b",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "625af53a1564e31bb2df9adc3739df46137f46c1",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "808a34cdbe8ce336c202d8ea6d5e48496764dc37",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "a6042b8066b24dbcc7945616a157d4d43e463668",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "db297c78ce537c9ac96f0eda9b25ad72c8caefa9",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "10ebed83f9f6414af4e85bc85ffaeda7effdd874",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
},
{
"lessThan": "a44ce6aa2efb61fe44f2cfab72bb01544bbca272",
"status": "affected",
"version": "75b54cb57ca34cbe7a87c6ac757c55360a624590",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rxrpc/proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter\u0027s maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflowing sprintf is executed when a local process reads the world-readable RXRPC procfs seq files under /proc/net/rxrpc. A remote RXRPC peer can influence stored addresses on a listening service, but cannot directly invoke the proc show path without a local proc read.\nAC:L - No race or hard-to-control timing is required; an attacker can create or cause an RXRPC IPv6 peer/address with the maximal ISATAP-style textual form and read the proc entry. The overflow condition is deterministic once such an address is present.\nPR:L - The proc entries are created mode 0444 and RXRPC socket creation/sendmsg paths do not impose a capability check, so a basic unprivileged local user can reach the vulnerable show functions. This does not require real root or init-namespace administrative privileges.\nUI:N - The attacker can trigger the vulnerable formatting by reading the proc file themselves. No separate victim action is required.\nS:U - The bug corrupts kernel memory within the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is kernel stack memory corruption from an out-of-bounds write in attacker-reachable code. Following the higher-severity rule for memory corruption, successful exploitation could compromise kernel confidentiality.\nI:H - The vulnerable sprintf writes past a fixed stack buffer, giving an out-of-bounds kernel stack write. Under the required scoring guidance, out-of-bounds writes are treated as high integrity impact due to potential control-flow or kernel state corruption.\nA:H - Even if not shaped into code execution, the stack corruption can produce an oops, panic, or other kernel crash. The attacker can retrigger it repeatedly by reading the affected proc entries while the crafted address object exists."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:36.441Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668"
},
{
"url": "https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b"
},
{
"url": "https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1"
},
{
"url": "https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37"
},
{
"url": "https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668"
},
{
"url": "https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9"
},
{
"url": "https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874"
},
{
"url": "https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"
}
],
"title": "rxrpc: proc: size address buffers for %pISpc output",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31630",
"datePublished": "2026-04-24T14:44:46.606Z",
"dateReserved": "2026-03-09T15:48:24.124Z",
"dateUpdated": "2026-10-21T12:39:36.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90247 (GCVE-0-2026-90247)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix mmap_lock leak in irq_work path
stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer
mmap_read_unlock() from NMI context, and bpf_find_vma() later reused the
same mmap_unlock_work. Both callers only check whether the work is busy
before taking mmap_lock, so a nested caller can reuse the slot before the
first caller queues it. Two read locks may then be acquired while only one
deferred unlock runs, leaking a read lock and blocking exit_mmap().
Reserve the per-CPU slot before mmap_read_trylock(). Use the same wrapper
in stackmap and bpf_find_vma() so both callers release the reservation on
trylock failure. Keep rejecting the slot while the irq_work remains busy.
Release it after the irq_work callback unlocks the mm.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eac9153f2b584c702cea02c1f1a57d85aa9aea42 Version: eac9153f2b584c702cea02c1f1a57d85aa9aea42 Version: eac9153f2b584c702cea02c1f1a57d85aa9aea42 Version: eac9153f2b584c702cea02c1f1a57d85aa9aea42 Version: eac9153f2b584c702cea02c1f1a57d85aa9aea42 Version: eac9153f2b584c702cea02c1f1a57d85aa9aea42 Version: a7f4da875c16f3b8bef0d9ec67528111045bfcd8 Version: f1838da73cccb238b8be4ef464fce0168dc7ba84 Version: 4.19.92 ≤ Version: 5.4.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/mmap_unlock_work.h",
"kernel/bpf/stackmap.c",
"kernel/bpf/task_iter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6d091873e12d1de36d7228c4f452e6cace3a23e",
"status": "affected",
"version": "eac9153f2b584c702cea02c1f1a57d85aa9aea42",
"versionType": "git"
},
{
"lessThan": "b6c9daf6097f9b39162b8e736a6ac7caf5ef6fc8",
"status": "affected",
"version": "eac9153f2b584c702cea02c1f1a57d85aa9aea42",
"versionType": "git"
},
{
"lessThan": "931f62311c058d79f29548f20943969bb441ce87",
"status": "affected",
"version": "eac9153f2b584c702cea02c1f1a57d85aa9aea42",
"versionType": "git"
},
{
"lessThan": "a052ad5edccf5319f50ed955de4368f8318a9f20",
"status": "affected",
"version": "eac9153f2b584c702cea02c1f1a57d85aa9aea42",
"versionType": "git"
},
{
"lessThan": "051f2da26ce377f683b938a3382e0f16d02f3139",
"status": "affected",
"version": "eac9153f2b584c702cea02c1f1a57d85aa9aea42",
"versionType": "git"
},
{
"lessThan": "fa9dcacdcdf487f0ffef64bf67622f1caed509f1",
"status": "affected",
"version": "eac9153f2b584c702cea02c1f1a57d85aa9aea42",
"versionType": "git"
},
{
"status": "affected",
"version": "a7f4da875c16f3b8bef0d9ec67528111045bfcd8",
"versionType": "git"
},
{
"status": "affected",
"version": "f1838da73cccb238b8be4ef464fce0168dc7ba84",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.92",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/mmap_unlock_work.h",
"kernel/bpf/stackmap.c",
"kernel/bpf/task_iter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix mmap_lock leak in irq_work path\n\nstack_map_get_build_id_offset() introduced a per-CPU irq_work to defer\nmmap_read_unlock() from NMI context, and bpf_find_vma() later reused the\nsame mmap_unlock_work. Both callers only check whether the work is busy\nbefore taking mmap_lock, so a nested caller can reuse the slot before the\nfirst caller queues it. Two read locks may then be acquired while only one\ndeferred unlock runs, leaking a read lock and blocking exit_mmap().\n\nReserve the per-CPU slot before mmap_read_trylock(). Use the same wrapper\nin stackmap and bpf_find_vma() so both callers release the reservation on\ntrylock failure. Keep rejecting the slot while the irq_work remains busy.\nRelease it after the irq_work callback unlocks the mm."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:55.059Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6d091873e12d1de36d7228c4f452e6cace3a23e"
},
{
"url": "https://git.kernel.org/stable/c/b6c9daf6097f9b39162b8e736a6ac7caf5ef6fc8"
},
{
"url": "https://git.kernel.org/stable/c/931f62311c058d79f29548f20943969bb441ce87"
},
{
"url": "https://git.kernel.org/stable/c/a052ad5edccf5319f50ed955de4368f8318a9f20"
},
{
"url": "https://git.kernel.org/stable/c/051f2da26ce377f683b938a3382e0f16d02f3139"
},
{
"url": "https://git.kernel.org/stable/c/fa9dcacdcdf487f0ffef64bf67622f1caed509f1"
}
],
"title": "bpf: Fix mmap_lock leak in irq_work path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90247",
"datePublished": "2026-09-17T16:07:49.444Z",
"dateReserved": "2026-09-11T19:38:34.795Z",
"dateUpdated": "2026-10-30T12:34:55.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31526 (GCVE-0-2026-31526)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-11-05 21:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix exception exit lock checking for subprogs
process_bpf_exit_full() passes check_lock = !curframe to
check_resource_leak(), which is false in cases when bpf_throw() is
called from a static subprog. This makes check_resource_leak() to skip
validation of active_rcu_locks, active_preempt_locks, and
active_irq_id on exception exits from subprogs.
At runtime bpf_throw() unwinds the stack via ORC without releasing any
user-acquired locks, which may cause various issues as the result.
Fix by setting check_lock = true for exception exits regardless of
curframe, since exceptions bypass all intermediate frame
cleanup. Update the error message prefix to "bpf_throw" for exception
exits to distinguish them from normal BPF_EXIT.
Fix reject_subprog_with_rcu_read_lock test which was previously
passing for the wrong reason. Test program returned directly from the
subprog call without closing the RCU section, so the error was
triggered by the unclosed RCU lock on normal exit, not by
bpf_throw. Update __msg annotations for affected tests to match the
new "bpf_throw" error prefix.
The spin_lock case is not affected because they are already checked [1]
at the call site in do_check_insn() before bpf_throw can run.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:37:35.566566Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:45:06.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c",
"tools/testing/selftests/bpf/progs/exceptions_fail.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4eca06a55417c3b2e538656d12c89e224343653e",
"status": "affected",
"version": "f18b03fabaa9b7c80e80b72a621f481f0d706ae0",
"versionType": "git"
},
{
"lessThan": "c0281da1f2aa5c2fca3a05f79b86bea96591c358",
"status": "affected",
"version": "f18b03fabaa9b7c80e80b72a621f481f0d706ae0",
"versionType": "git"
},
{
"lessThan": "5a399f3117642494e35545f6ca397d3e177c1f9b",
"status": "affected",
"version": "f18b03fabaa9b7c80e80b72a621f481f0d706ae0",
"versionType": "git"
},
{
"lessThan": "6c2128505f61b504c79a20b89596feba61388112",
"status": "affected",
"version": "f18b03fabaa9b7c80e80b72a621f481f0d706ae0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c",
"tools/testing/selftests/bpf/progs/exceptions_fail.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix exception exit lock checking for subprogs\n\nprocess_bpf_exit_full() passes check_lock = !curframe to\ncheck_resource_leak(), which is false in cases when bpf_throw() is\ncalled from a static subprog. This makes check_resource_leak() to skip\nvalidation of active_rcu_locks, active_preempt_locks, and\nactive_irq_id on exception exits from subprogs.\n\nAt runtime bpf_throw() unwinds the stack via ORC without releasing any\nuser-acquired locks, which may cause various issues as the result.\n\nFix by setting check_lock = true for exception exits regardless of\ncurframe, since exceptions bypass all intermediate frame\ncleanup. Update the error message prefix to \"bpf_throw\" for exception\nexits to distinguish them from normal BPF_EXIT.\n\nFix reject_subprog_with_rcu_read_lock test which was previously\npassing for the wrong reason. Test program returned directly from the\nsubprog call without closing the RCU section, so the error was\ntriggered by the unclosed RCU lock on normal exit, not by\nbpf_throw. Update __msg annotations for affected tests to match the\nnew \"bpf_throw\" error prefix.\n\nThe spin_lock case is not affected because they are already checked [1]\nat the call site in do_check_insn() before bpf_throw can run.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:24.405Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4eca06a55417c3b2e538656d12c89e224343653e"
},
{
"url": "https://git.kernel.org/stable/c/c0281da1f2aa5c2fca3a05f79b86bea96591c358"
},
{
"url": "https://git.kernel.org/stable/c/5a399f3117642494e35545f6ca397d3e177c1f9b"
},
{
"url": "https://git.kernel.org/stable/c/6c2128505f61b504c79a20b89596feba61388112"
}
],
"title": "bpf: Fix exception exit lock checking for subprogs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31526",
"datePublished": "2026-04-22T13:54:39.800Z",
"dateReserved": "2026-03-09T15:48:24.111Z",
"dateUpdated": "2026-11-05T21:45:06.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99160 (GCVE-0-2026-99160)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not show buffer_meta for CPUs without a buffer
The per_cpu/cpuN/buffer_meta files are created for every possible CPU,
but buffer->buffers[cpu] is only allocated once that CPU comes online.
Reading the file of a CPU that never came online dereferences a NULL
cpu_buffer in rbm_start().
Fail the open with -ENODEV when the CPU has no buffer, as the other
per CPU ring buffer interfaces do.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "445bc0e0ed7b3f69b78a0fd8d3a8fdb4e20bc379",
"status": "affected",
"version": "950032ffcee7a43c960951940059afc5a2bdbcbc",
"versionType": "git"
},
{
"lessThan": "8512d0312cc0ea83ca4511b164c29a138bbb0c21",
"status": "affected",
"version": "950032ffcee7a43c960951940059afc5a2bdbcbc",
"versionType": "git"
},
{
"lessThan": "ae670c1a24fb5ffb167f26358cf47a5f0abbd670",
"status": "affected",
"version": "950032ffcee7a43c960951940059afc5a2bdbcbc",
"versionType": "git"
},
{
"lessThan": "3f23cae09a4677a3f7c163a68388512cb231ff22",
"status": "affected",
"version": "950032ffcee7a43c960951940059afc5a2bdbcbc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not show buffer_meta for CPUs without a buffer\n\nThe per_cpu/cpuN/buffer_meta files are created for every possible CPU,\nbut buffer-\u003ebuffers[cpu] is only allocated once that CPU comes online.\nReading the file of a CPU that never came online dereferences a NULL\ncpu_buffer in rbm_start().\n\nFail the open with -ENODEV when the CPU has no buffer, as the other\nper CPU ring buffer interfaces do."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:26.948Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/445bc0e0ed7b3f69b78a0fd8d3a8fdb4e20bc379"
},
{
"url": "https://git.kernel.org/stable/c/8512d0312cc0ea83ca4511b164c29a138bbb0c21"
},
{
"url": "https://git.kernel.org/stable/c/ae670c1a24fb5ffb167f26358cf47a5f0abbd670"
},
{
"url": "https://git.kernel.org/stable/c/3f23cae09a4677a3f7c163a68388512cb231ff22"
}
],
"title": "ring-buffer: Do not show buffer_meta for CPUs without a buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99160",
"datePublished": "2026-10-28T10:35:13.341Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-30T12:42:26.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74257 (GCVE-0-2026-74257)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sockmap: Fix use-after-free in udp_bpf_recvmsg()
syzbot reported use-after-free of struct sk_msg in sk_msg_recvmsg(). [0]
sk_msg_recvmsg() peeks sk_msg from psock->ingress_msg under a lock,
but its processing is lockless.
Thus, sk_msg_recvmsg() must be serialised by callers, otherwise
multiple threads could touch the same sk_msg.
For example, TCP uses lock_sock(), and AF_UNIX uses unix_sk(sk)->iolock.
Initially, udp_bpf_recvmsg() had used lock_sock(), but the cited
commit removed it.
Let's serialise sk_msg_recvmsg() with lock_sock() in udp_bpf_recvmsg().
Note that holding spin_lock_bh(&sk->sk_receive_queue.lock) is not
an option due to copy_page_to_iter() in sk_msg_recvmsg().
[0]:
BUG: KASAN: slab-use-after-free in sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428
Read of size 4 at addr ffff88814cdcf000 by task syz.0.24/6020
CPU: 1 UID: 0 PID: 6020 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428
udp_bpf_recvmsg+0x4bd/0xe00 net/ipv4/udp_bpf.c:84
inet_recvmsg+0x260/0x270 net/ipv4/af_inet.c:891
sock_recvmsg_nosec net/socket.c:1078 [inline]
sock_recvmsg+0x1a8/0x270 net/socket.c:1100
____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2812
___sys_recvmsg+0x215/0x590 net/socket.c:2854
do_recvmmsg+0x334/0x800 net/socket.c:2949
__sys_recvmmsg net/socket.c:3023 [inline]
__do_sys_recvmmsg net/socket.c:3046 [inline]
__se_sys_recvmmsg net/socket.c:3039 [inline]
__x64_sys_recvmmsg+0x198/0x250 net/socket.c:3039
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb319f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb31ad97028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007fb31a216090 RCX: 00007fb319f9aeb9
RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000004
RBP: 00007fb31a008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000040000021 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb31a216128 R14: 00007fb31a216090 R15: 00007ffe21dd0a98
</TASK>
Allocated by task 6019:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x3d1/0x6e0 mm/slub.c:5780
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
alloc_sk_msg net/core/skmsg.c:510 [inline]
sk_psock_skb_ingress_self+0x60/0x350 net/core/skmsg.c:612
sk_psock_verdict_apply net/core/skmsg.c:1038 [inline]
sk_psock_verdict_recv+0x7d9/0x8d0 net/core/skmsg.c:1236
udp_read_skb+0x73e/0x7e0 net/ipv4/udp.c:2045
sk_psock_verdict_data_ready+0x12d/0x550 net/core/skmsg.c:1257
__udp_enqueue_schedule_skb+0xc54/0x10b0 net/ipv4/udp.c:1789
__udp_queue_rcv_skb net/ipv4/udp.c:2346 [inline]
udp_queue_rcv_one_skb+0xac5/0x19c0 net/ipv4/udp.c:2475
__udp4_lib_mcast_deliver+0xc06/0xcf0 net/ipv4/udp.c:2585
__udp4_lib_rcv+0x10f6/0x2620 net/ipv4/udp.c:2724
ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
dst_input include/net/dst.h:474 [inline]
ip_sublist_rcv_finish+0x221/0x2a0 net/ipv4/ip_input.c:584
ip_list_rcv_finish net/ipv4/ip_inp
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9f2470fbc4cb4583c080bb729a998933ba61aca4 Version: 9f2470fbc4cb4583c080bb729a998933ba61aca4 Version: 9f2470fbc4cb4583c080bb729a998933ba61aca4 Version: 9f2470fbc4cb4583c080bb729a998933ba61aca4 Version: 9f2470fbc4cb4583c080bb729a998933ba61aca4 Version: 9f2470fbc4cb4583c080bb729a998933ba61aca4 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:30.468106Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:28.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6ea94949a5afe457647def276cd6958721481abd",
"status": "affected",
"version": "9f2470fbc4cb4583c080bb729a998933ba61aca4",
"versionType": "git"
},
{
"lessThan": "6b59007d95aeef6619a72f5ea51f58752c47c198",
"status": "affected",
"version": "9f2470fbc4cb4583c080bb729a998933ba61aca4",
"versionType": "git"
},
{
"lessThan": "05c29e7d42926170f0595c7188d60d8ecb665593",
"status": "affected",
"version": "9f2470fbc4cb4583c080bb729a998933ba61aca4",
"versionType": "git"
},
{
"lessThan": "81567d2b3f4dc4fc32f8b61433738bce2cafd4a1",
"status": "affected",
"version": "9f2470fbc4cb4583c080bb729a998933ba61aca4",
"versionType": "git"
},
{
"lessThan": "39d44ed6904bfa9a1c6d0538672dd50c7b85520e",
"status": "affected",
"version": "9f2470fbc4cb4583c080bb729a998933ba61aca4",
"versionType": "git"
},
{
"lessThan": "c010995b29c8939c6aa69e3cb26f8dbee163d156",
"status": "affected",
"version": "9f2470fbc4cb4583c080bb729a998933ba61aca4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsockmap: Fix use-after-free in udp_bpf_recvmsg()\n\nsyzbot reported use-after-free of struct sk_msg in sk_msg_recvmsg(). [0]\n\nsk_msg_recvmsg() peeks sk_msg from psock-\u003eingress_msg under a lock,\nbut its processing is lockless.\n\nThus, sk_msg_recvmsg() must be serialised by callers, otherwise\nmultiple threads could touch the same sk_msg.\n\nFor example, TCP uses lock_sock(), and AF_UNIX uses unix_sk(sk)-\u003eiolock.\n\nInitially, udp_bpf_recvmsg() had used lock_sock(), but the cited\ncommit removed it.\n\nLet\u0027s serialise sk_msg_recvmsg() with lock_sock() in udp_bpf_recvmsg().\n\nNote that holding spin_lock_bh(\u0026sk-\u003esk_receive_queue.lock) is not\nan option due to copy_page_to_iter() in sk_msg_recvmsg().\n\n[0]:\nBUG: KASAN: slab-use-after-free in sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428\nRead of size 4 at addr ffff88814cdcf000 by task syz.0.24/6020\n\nCPU: 1 UID: 0 PID: 6020 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xba/0x230 mm/kasan/report.c:482\n kasan_report+0x117/0x150 mm/kasan/report.c:595\n sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428\n udp_bpf_recvmsg+0x4bd/0xe00 net/ipv4/udp_bpf.c:84\n inet_recvmsg+0x260/0x270 net/ipv4/af_inet.c:891\n sock_recvmsg_nosec net/socket.c:1078 [inline]\n sock_recvmsg+0x1a8/0x270 net/socket.c:1100\n ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2812\n ___sys_recvmsg+0x215/0x590 net/socket.c:2854\n do_recvmmsg+0x334/0x800 net/socket.c:2949\n __sys_recvmmsg net/socket.c:3023 [inline]\n __do_sys_recvmmsg net/socket.c:3046 [inline]\n __se_sys_recvmmsg net/socket.c:3039 [inline]\n __x64_sys_recvmmsg+0x198/0x250 net/socket.c:3039\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fb319f9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fb31ad97028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b\nRAX: ffffffffffffffda RBX: 00007fb31a216090 RCX: 00007fb319f9aeb9\nRDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000004\nRBP: 00007fb31a008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000040000021 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fb31a216128 R14: 00007fb31a216090 R15: 00007ffe21dd0a98\n \u003c/TASK\u003e\n\nAllocated by task 6019:\n kasan_save_stack mm/kasan/common.c:57 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __kmalloc_cache_noprof+0x3d1/0x6e0 mm/slub.c:5780\n kmalloc_noprof include/linux/slab.h:957 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n alloc_sk_msg net/core/skmsg.c:510 [inline]\n sk_psock_skb_ingress_self+0x60/0x350 net/core/skmsg.c:612\n sk_psock_verdict_apply net/core/skmsg.c:1038 [inline]\n sk_psock_verdict_recv+0x7d9/0x8d0 net/core/skmsg.c:1236\n udp_read_skb+0x73e/0x7e0 net/ipv4/udp.c:2045\n sk_psock_verdict_data_ready+0x12d/0x550 net/core/skmsg.c:1257\n __udp_enqueue_schedule_skb+0xc54/0x10b0 net/ipv4/udp.c:1789\n __udp_queue_rcv_skb net/ipv4/udp.c:2346 [inline]\n udp_queue_rcv_one_skb+0xac5/0x19c0 net/ipv4/udp.c:2475\n __udp4_lib_mcast_deliver+0xc06/0xcf0 net/ipv4/udp.c:2585\n __udp4_lib_rcv+0x10f6/0x2620 net/ipv4/udp.c:2724\n ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207\n ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241\n NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318\n dst_input include/net/dst.h:474 [inline]\n ip_sublist_rcv_finish+0x221/0x2a0 net/ipv4/ip_input.c:584\n ip_list_rcv_finish net/ipv4/ip_inp\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered in sk_msg_recvmsg() via concurrent local recvmsg/recvmmsg syscalls on a UDP socket whose -\u003erecvmsg was replaced by udp_bpf_recvmsg() after sockmap attachment; per kernel CNA BPF guidance this sockmap path is Local even though remote UDP can populate ingress_msg.\nAC:L - Syzkaller reproduced the bug with attacker-controlled concurrent recvmmsg on one socket; the attacker owns both racing threads and can reliably interleave sk_msg_recvmsg() reads with kfree_sk_msg() without conditions outside attacker control.\nPR:L - Creating BPF sockmap maps and SK_SKB verdict programs requires CAP_NET_ADMIN (obtainable in user namespaces), but once a socket is in the map any unprivileged local holder can trigger the race with ordinary recv syscalls without init-namespace root.\nUI:N - Exploitation requires only the attacker\u0027s own concurrent recv threads and traffic on the target socket; no independent action by another user or administrator is needed at trigger time.\nS:U - The use-after-free corrupts kernel sk_msg/slab and page state within the same kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries by itself.\nC:H - KASAN reported slab-use-after-free on struct sk_msg scatterlist fields during copy_page_to_iter(); the freed sk_msg object can be reclaimed with attacker-controlled contents to read arbitrary kernel memory.\nI:H - Concurrent threads can double-free scatterlist pages and corrupt sk_msg queue linkage on a groomable slab object, yielding standard UAF write primitives usable for arbitrary kernel modification and privilege escalation.\nA:H - The published syzbot trace shows KASAN slab-use-after-free in sk_msg_recvmsg(); this UAF reliably corrupts kernel memory and can oops or panic the host even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:32.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6ea94949a5afe457647def276cd6958721481abd"
},
{
"url": "https://git.kernel.org/stable/c/6b59007d95aeef6619a72f5ea51f58752c47c198"
},
{
"url": "https://git.kernel.org/stable/c/05c29e7d42926170f0595c7188d60d8ecb665593"
},
{
"url": "https://git.kernel.org/stable/c/81567d2b3f4dc4fc32f8b61433738bce2cafd4a1"
},
{
"url": "https://git.kernel.org/stable/c/39d44ed6904bfa9a1c6d0538672dd50c7b85520e"
},
{
"url": "https://git.kernel.org/stable/c/c010995b29c8939c6aa69e3cb26f8dbee163d156"
}
],
"title": "sockmap: Fix use-after-free in udp_bpf_recvmsg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74257",
"datePublished": "2026-08-15T05:57:35.604Z",
"dateReserved": "2026-08-15T05:44:03.877Z",
"dateUpdated": "2026-10-30T12:29:32.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80698 (GCVE-0-2026-80698)
Vulnerability from cvelistv5
Published
2026-08-28 06:53
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix double free of wq, engine, and group structs
The release callbacks for wq, engine, and group devices
(idxd_conf_wq_release, idxd_conf_engine_release,
idxd_conf_group_release) each call kfree() on the enclosing struct.
The setup error paths and cleanup functions also call kfree()
explicitly after put_device(), producing a double free whenever
put_device() drops the reference count to zero and fires the release.
In the setup functions, device_initialize() is called before
device_add(), so the reference count is exactly 1 at the error sites.
put_device() unconditionally fires the release, which frees the struct;
the subsequent explicit kfree() then operates on freed memory.
For idxd_setup_wqs(), the wq release callback also owns opcap_bmap
and wqcfg. The error unwind additionally freed those fields explicitly
before calling put_device(), causing further double frees on both.
Remove the redundant explicit kfree() calls from all setup error paths
and cleanup functions for wq, engine, and group structs, delegating
sole ownership of those allocations to the release callbacks.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 Version: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 Version: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 Version: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 Version: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 Version: 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 Version: 394e179f51fce06d6bb8ca5af8fa53f33c718cf4 Version: b09ad63775f58a8de3e228f59fb9543bfd964c9c Version: 26c219e7522c494f7865a928c81ced84cc7db3ae Version: 35ea8721d9e6e74c6847cf4d6c27e883b00b0331 Version: e6f86fe368cdc14764833a6e8bb59f7a85a40e06 Version: 1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886 Version: 5.11.22 ≤ Version: 5.12.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "899aa2424a75b1812a1f4766e41e82315a521e7e",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"lessThan": "84cf00b1376c717e55d704dc259483e822ae1b34",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"lessThan": "38208445c41a6164e26748c600f954296991364d",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"lessThan": "63844dc03960b09b36746eda636c08f1479407ce",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"lessThan": "c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"lessThan": "ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c",
"status": "affected",
"version": "7c5dd23e57c14cf7177b8a5e0fd08916e0c60005",
"versionType": "git"
},
{
"status": "affected",
"version": "394e179f51fce06d6bb8ca5af8fa53f33c718cf4",
"versionType": "git"
},
{
"status": "affected",
"version": "b09ad63775f58a8de3e228f59fb9543bfd964c9c",
"versionType": "git"
},
{
"status": "affected",
"version": "26c219e7522c494f7865a928c81ced84cc7db3ae",
"versionType": "git"
},
{
"status": "affected",
"version": "35ea8721d9e6e74c6847cf4d6c27e883b00b0331",
"versionType": "git"
},
{
"status": "affected",
"version": "e6f86fe368cdc14764833a6e8bb59f7a85a40e06",
"versionType": "git"
},
{
"status": "affected",
"version": "1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886",
"versionType": "git"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.22",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix double free of wq, engine, and group structs\n\nThe release callbacks for wq, engine, and group devices\n(idxd_conf_wq_release, idxd_conf_engine_release,\nidxd_conf_group_release) each call kfree() on the enclosing struct.\nThe setup error paths and cleanup functions also call kfree()\nexplicitly after put_device(), producing a double free whenever\nput_device() drops the reference count to zero and fires the release.\n\nIn the setup functions, device_initialize() is called before\ndevice_add(), so the reference count is exactly 1 at the error sites.\nput_device() unconditionally fires the release, which frees the struct;\nthe subsequent explicit kfree() then operates on freed memory.\n\nFor idxd_setup_wqs(), the wq release callback also owns opcap_bmap\nand wqcfg. The error unwind additionally freed those fields explicitly\nbefore calling put_device(), causing further double frees on both.\n\nRemove the redundant explicit kfree() calls from all setup error paths\nand cleanup functions for wq, engine, and group structs, delegating\nsole ownership of those allocations to the release callbacks."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:59.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/899aa2424a75b1812a1f4766e41e82315a521e7e"
},
{
"url": "https://git.kernel.org/stable/c/84cf00b1376c717e55d704dc259483e822ae1b34"
},
{
"url": "https://git.kernel.org/stable/c/38208445c41a6164e26748c600f954296991364d"
},
{
"url": "https://git.kernel.org/stable/c/63844dc03960b09b36746eda636c08f1479407ce"
},
{
"url": "https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c"
},
{
"url": "https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c"
}
],
"title": "dmaengine: idxd: fix double free of wq, engine, and group structs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80698",
"datePublished": "2026-08-28T06:53:02.829Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-10-30T12:30:59.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99110 (GCVE-0-2026-99110)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix heap overflow in cifs_do_set_acl()
cifs_set_acl() validates ACL size using posix_acl_xattr_size():
4 + (count * 8) // 4-byte header + 8 bytes per ACE
cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS
wire format into the same buffer:
6 + (count * 10) // 6-byte header + 10 bytes per ACE
An ACL that passes the xattr-based check in cifs_set_acl() can
overflow the heap when posix_acl_to_cifs() writes the larger CIFS
format.
Validate the CIFS format size against the remaining buffer space and
USHRT_MAX before converting--data_count is __u16, so sizes above
USHRT_MAX truncate the on-wire packet length, causing the server to
apply a partial ACL. Replace MaxDataCount = 1000 with
min(CIFSMaxBufSize, USHRT_MAX).
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifssmb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68652afb9b9adf70125971abee9b95341e042249",
"status": "affected",
"version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
"versionType": "git"
},
{
"lessThan": "9312a00215602ba028495ef3fa00fb84af0478e0",
"status": "affected",
"version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
"versionType": "git"
},
{
"lessThan": "d96f3365ce61c5f39602955af43c8174548dee98",
"status": "affected",
"version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
"versionType": "git"
},
{
"lessThan": "596b4062e6c75bdd85a7f2b7f2087a872dc420ac",
"status": "affected",
"version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
"versionType": "git"
},
{
"lessThan": "1dac61e2c29d1a71784604b48cf3b1234a65ec29",
"status": "affected",
"version": "dc1af4c4b4721abfa07b351063825acc7e69cc66",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifssmb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix heap overflow in cifs_do_set_acl()\n\ncifs_set_acl() validates ACL size using posix_acl_xattr_size():\n\n 4 + (count * 8) // 4-byte header + 8 bytes per ACE\n\ncifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS\nwire format into the same buffer:\n\n 6 + (count * 10) // 6-byte header + 10 bytes per ACE\n\nAn ACL that passes the xattr-based check in cifs_set_acl() can\noverflow the heap when posix_acl_to_cifs() writes the larger CIFS\nformat.\n\nValidate the CIFS format size against the remaining buffer space and\nUSHRT_MAX before converting--data_count is __u16, so sizes above\nUSHRT_MAX truncate the on-wire packet length, causing the server to\napply a partial ACL. Replace MaxDataCount = 1000 with\nmin(CIFSMaxBufSize, USHRT_MAX)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - setxattr(2) on system.posix_acl_access/default flows through do_set_acl() \u2192 set_posix_acl() \u2192 cifs_set_acl() \u2192 patched cifs_do_set_acl(); the oversized ACL originates in the local xattr, while SMB_COM_TRANSACTION2 is only an outbound request.\nAC:H - The copy is deterministic once reached, but it requires default-off CONFIG_CIFS_POSIX, an SMB1 mount, and server negotiation of CIFS_UNIX_POSIX_ACL_CAP to set SB_POSIXACL. An unprivileged local attacker cannot create that mount or capability state.\nPR:L - set_posix_acl() gates the path with inode_owner_or_capable(), so an ordinary user who owns a file on the mounted share can submit the ACL without capabilities; on a non-multiuser mount cifs_sb_tlink() simply reuses the master tcon.\nUI:N - The attacker directly invokes setxattr() or fsetxattr() on their CIFS inode, causing cifs_set_acl() to run without any separate victim action after the qualifying mount exists.\nS:U - posix_acl_to_cifs() overwrites the client kernel\u0027s cifs_request slab, and any resulting kernel compromise remains within the same host security authority rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - cifs_init_ace() emits attacker-shaped 10-byte tag, permission, and uid/gid records past the cifs_request object; with the supported 8KiB CIFSMaxBufSize, the overflow reaches neighboring request objects. This controllable slab corruption can be groomed into reuse or overlap and kernel-memory disclosure.\nI:H - posix_acl_to_cifs() writes a multi-kilobyte out-of-bounds stream whose ACE tags, permissions, and 32-bit uid/gid values are caller-selected; corrupting adjacent request or allocator state provides heap-write and control-flow-hijack potential.\nA:H - With default CIFSMaxBufSize=16384, 2047 valid entries pass cifs_set_acl()\u0027s 16380-byte check but make posix_acl_to_cifs() write 20476 bytes, nearly 4KiB beyond the 16588-byte allocation before SendReceive() rejects the frame. Repeated calls can oops or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:03.377Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68652afb9b9adf70125971abee9b95341e042249"
},
{
"url": "https://git.kernel.org/stable/c/9312a00215602ba028495ef3fa00fb84af0478e0"
},
{
"url": "https://git.kernel.org/stable/c/d96f3365ce61c5f39602955af43c8174548dee98"
},
{
"url": "https://git.kernel.org/stable/c/596b4062e6c75bdd85a7f2b7f2087a872dc420ac"
},
{
"url": "https://git.kernel.org/stable/c/1dac61e2c29d1a71784604b48cf3b1234a65ec29"
}
],
"title": "smb: client: fix heap overflow in cifs_do_set_acl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99110",
"datePublished": "2026-10-28T10:34:28.239Z",
"dateReserved": "2026-09-25T10:25:14.392Z",
"dateUpdated": "2026-10-31T12:43:03.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99204 (GCVE-0-2026-99204)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: Protect the recovery list during debugfs reads
Recovery participant records must remain alive while debug_state_print()
walks reco.node_data and formats their fields. The formatter holds
dlm->spinlock, but the recovery participant list is protected by
dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches
the list under dlm_reco_state_lock and frees the detached records after
releasing it. A concurrent debugfs open can therefore read freed memory.
Protect the participant traversal and field reads in debug_state_print()
with dlm_reco_state_lock, matching the existing list writers. This also
serializes the traversal against list_add_tail() during recovery-area
initialization. Make the existing lock available to the debug code
through dlmcommon.h; the lock remains internal to the OCFS2 DLM module.
Release dlm->spinlock after formatting the other domain state and before
acquiring dlm_reco_state_lock, so the debug reader does not nest the two
locks. Leave recovery list insertion, detachment and freeing unchanged.
KASAN report as below:
BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0
Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896
CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? debug_state_open+0x1169/0x12d0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? debug_state_open+0x1169/0x12d0
kasan_report+0xe0/0x110
? debug_state_open+0x1169/0x12d0
debug_state_open+0x1169/0x12d0
? __pfx_debug_state_open+0x10/0x10
full_proxy_open_regular+0x193/0x310
do_dentry_open+0x595/0x12d0
? __pfx_full_proxy_open_regular+0x10/0x10
vfs_open_consume+0xd1/0x400
? srso_alias_return_thunk+0x5/0xfbef5
path_openat+0x18d0/0x2020
? __pfx_path_openat+0x10/0x10
do_file_open+0x21e/0x470
? __pfx_do_file_open+0x10/0x10
? _raw_spin_unlock+0x23/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? alloc_fd+0x3a6/0x6b0
do_sys_openat2+0xf4/0x1b0
? __pfx_do_sys_openat2+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __fput+0x5b5/0xa60
__x64_sys_openat+0x136/0x1e0
? __pfx___x64_sys_openat+0x10/0x10
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Register dump omitted.]
</TASK>
Allocated by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x28d/0x610
dlm_remaster_locks+0x147/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
Freed by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
dlm_destroy_recovery_area+0x285/0x460
dlm_remaster_locks+0x17c4/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
The buggy address belongs to the object at ffff88810662ef80
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
freed 32-byte region [ffff88810662ef80, ffff88810662efa0)
[Page and memory-state dumps omitted.]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd Version: 007dce53a29ccffc000ab5373d188f73881390fd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/dlm/dlmcommon.h",
"fs/ocfs2/dlm/dlmdebug.c",
"fs/ocfs2/dlm/dlmrecovery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "03f2fdcc94238a5127ff8a21a4544fd6118cfc7b",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "1c1dbaa16d70cf3d6b9b21503fc188f560376866",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "c8bc0d0f2ca3df37ef4d9c69ac5fb7d417d9b035",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "403669041cb77bb5ffc5ce92bcfb49b2da3d989d",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "25de9d3b5a81ba7bd52fdc9601f9ea7d1d3d6ae8",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "04d4571c00db61a9664f387752fa05cb3c08a537",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "2bc426a32bfb78868c7f76d9547132837b6b5284",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "4c435828932bf46f29860e4a0375bcae101b778a",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/dlm/dlmcommon.h",
"fs/ocfs2/dlm/dlmdebug.c",
"fs/ocfs2/dlm/dlmrecovery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm-\u003espinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock, matching the existing list writers. This also\nserializes the traversal against list_add_tail() during recovery-area\ninitialization. Make the existing lock available to the debug code\nthrough dlmcommon.h; the lock remains internal to the OCFS2 DLM module.\n\nRelease dlm-\u003espinlock after formatting the other domain state and before\nacquiring dlm_reco_state_lock, so the debug reader does not nest the two\nlocks. Leave recovery list insertion, detachment and freeing unchanged.\n\nKASAN report as below:\n\n BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0\n Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896\n\n CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x93/0xd0\n print_report+0xce/0x630\n ? debug_state_open+0x1169/0x12d0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20e/0x420\n ? debug_state_open+0x1169/0x12d0\n kasan_report+0xe0/0x110\n ? debug_state_open+0x1169/0x12d0\n debug_state_open+0x1169/0x12d0\n ? __pfx_debug_state_open+0x10/0x10\n full_proxy_open_regular+0x193/0x310\n do_dentry_open+0x595/0x12d0\n ? __pfx_full_proxy_open_regular+0x10/0x10\n vfs_open_consume+0xd1/0x400\n ? srso_alias_return_thunk+0x5/0xfbef5\n path_openat+0x18d0/0x2020\n ? __pfx_path_openat+0x10/0x10\n do_file_open+0x21e/0x470\n ? __pfx_do_file_open+0x10/0x10\n ? _raw_spin_unlock+0x23/0x40\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? alloc_fd+0x3a6/0x6b0\n do_sys_openat2+0xf4/0x1b0\n ? __pfx_do_sys_openat2+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __fput+0x5b5/0xa60\n __x64_sys_openat+0x136/0x1e0\n ? __pfx___x64_sys_openat+0x10/0x10\n do_syscall_64+0x114/0x620\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [Register dump omitted.]\n \u003c/TASK\u003e\n\n Allocated by task 880:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kmalloc_cache_noprof+0x28d/0x610\n dlm_remaster_locks+0x147/0x1d90\n dlm_do_recovery+0xde1/0x1580\n dlm_recovery_thread+0x109/0x300\n kthread+0x351/0x460\n ret_from_fork+0x659/0x940\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 880:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x308/0x580\n dlm_destroy_recovery_area+0x285/0x460\n dlm_remaster_locks+0x17c4/0x1d90\n dlm_do_recovery+0xde1/0x1580\n dlm_recovery_thread+0x109/0x300\n kthread+0x351/0x460\n ret_from_fork+0x659/0x940\n ret_from_fork_asm+0x1a/0x30\n\n The buggy address belongs to the object at ffff88810662ef80\n which belongs to the cache kmalloc-32 of size 32\n The buggy address is located 0 bytes inside of\n freed 32-byte region [ffff88810662ef80, ffff88810662efa0)\n\n [Page and memory-state dumps omitted.]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:54.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/03f2fdcc94238a5127ff8a21a4544fd6118cfc7b"
},
{
"url": "https://git.kernel.org/stable/c/1c1dbaa16d70cf3d6b9b21503fc188f560376866"
},
{
"url": "https://git.kernel.org/stable/c/c8bc0d0f2ca3df37ef4d9c69ac5fb7d417d9b035"
},
{
"url": "https://git.kernel.org/stable/c/403669041cb77bb5ffc5ce92bcfb49b2da3d989d"
},
{
"url": "https://git.kernel.org/stable/c/25de9d3b5a81ba7bd52fdc9601f9ea7d1d3d6ae8"
},
{
"url": "https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537"
},
{
"url": "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284"
},
{
"url": "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"
}
],
"title": "ocfs2/dlm: Protect the recovery list during debugfs reads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99204",
"datePublished": "2026-10-28T10:35:58.336Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-30T12:42:54.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99176 (GCVE-0-2026-99176)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails
in the "not from VM-Entry" case, i.e. when emulating RSM or handling
KVM_SET_NESTED_STATE. Failure to unwind the MMU pointer results in KVM
trying to run L1 with a nested MMU, and is especially problematic if the
vCPU manages to free its nested state before the VM crashes. Constructing
the root for a nested EPT MMU goes through vmcs12, which is dynamically
allocated/freed when nVMX is enabled/disabled. And so if the nested state
is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL
pointer deref when attempting to get L1=>L2 EPTP.
BUG: kernel NULL pointer dereference, address: 0000000000000078
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0
Oops: Oops: 0000 [#1] SMP
CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]
Call Trace:
<TASK>
kvm_mmu_load+0xcd/0x870 [kvm]
kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm]
kvm_vcpu_ioctl+0x2c7/0x970 [kvm]
__x64_sys_ioctl+0x90/0xd0
do_syscall_64+0x9c/0x4d0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x47491b
</TASK>
Modules linked in: kvm_intel kvm irqbypass
CR2: 0000000000000078
---[ end trace 0000000000000000 ]---
RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]
[sean: write changelog]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 Version: 72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2586874605ec23b611c57fe71d183d98f168971",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "c611337aee17a0627e365e58e2b6e78803fb3c36",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "df4d01be5b318024bec68654c7af0ebc0e0ed8a1",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "6a36b05fc5b3d660fcc826133dc92e2fc87bd1de",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "f0c077c36fda9d498db39199e3997860e985efc8",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "d00d5f534a8238674755e59826a6c7d3c8efb870",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "c9716f956216eb74ab0aad7f633586edd49e0322",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
},
{
"lessThan": "c8f4cfe1cf93bce924e27f2abead7a4c4a487505",
"status": "affected",
"version": "72e9cbdb43384ceacc49e2fb6b8c8fb7c5988778",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry\n\nReset the vCPU\u0027s MMU pointer back to the root MMU if loading L2 state fails\nin the \"not from VM-Entry\" case, i.e. when emulating RSM or handling\nKVM_SET_NESTED_STATE. Failure to unwind the MMU pointer results in KVM\ntrying to run L1 with a nested MMU, and is especially problematic if the\nvCPU manages to free its nested state before the VM crashes. Constructing\nthe root for a nested EPT MMU goes through vmcs12, which is dynamically\nallocated/freed when nVMX is enabled/disabled. And so if the nested state\nis freed with the MMU still pointing at the nested MMU, KVM will hit a NULL\npointer deref when attempting to get L1=\u003eL2 EPTP.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000078\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]\n Call Trace:\n \u003cTASK\u003e\n kvm_mmu_load+0xcd/0x870 [kvm]\n kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm]\n kvm_vcpu_ioctl+0x2c7/0x970 [kvm]\n __x64_sys_ioctl+0x90/0xd0\n do_syscall_64+0x9c/0x4d0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x47491b\n \u003c/TASK\u003e\n Modules linked in: kvm_intel kvm irqbypass\n CR2: 0000000000000078\n ---[ end trace 0000000000000000 ]---\n RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]\n\n[sean: write changelog]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:40.156Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2586874605ec23b611c57fe71d183d98f168971"
},
{
"url": "https://git.kernel.org/stable/c/c611337aee17a0627e365e58e2b6e78803fb3c36"
},
{
"url": "https://git.kernel.org/stable/c/df4d01be5b318024bec68654c7af0ebc0e0ed8a1"
},
{
"url": "https://git.kernel.org/stable/c/6a36b05fc5b3d660fcc826133dc92e2fc87bd1de"
},
{
"url": "https://git.kernel.org/stable/c/f0c077c36fda9d498db39199e3997860e985efc8"
},
{
"url": "https://git.kernel.org/stable/c/d00d5f534a8238674755e59826a6c7d3c8efb870"
},
{
"url": "https://git.kernel.org/stable/c/c9716f956216eb74ab0aad7f633586edd49e0322"
},
{
"url": "https://git.kernel.org/stable/c/c8f4cfe1cf93bce924e27f2abead7a4c4a487505"
}
],
"title": "KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99176",
"datePublished": "2026-10-28T10:35:30.615Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:40.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64006 (GCVE-0-2026-64006)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix dst corruption in same register operation
For lshift and rshift, the shift operations are performed in a loop over
32-bit words. The loop calculates the shifted value and write it to dst,
and then immediately reads from src to calculate the carry for the next
iteration. Because src and dst could point to the same memory location,
the carry is incorrectly calculated using the newly modified dst value
instead of the original src value.
Adding a temporary local variable to cache the original value before
writing to dst and using it for the carry calculation solves the
problem. In addition, partial overlap is rejected from control plane for
all kind of operations including byteorder. This was tested with the
following bytecode:
table test_table ip flags 0 use 1 handle 1
ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1
ip test_table test_chain 2
[ immediate reg 1 0x44332211 0x88776655 ]
[ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]
[ cmp eq reg 1 0x66443322 0x00887766 ]
[ counter pkts 0 bytes 0 ]
ip test_table test_chain 4 3
[ immediate reg 1 0x44332211 0x88776655 ]
[ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]
[ cmp eq reg 1 0x55443322 0x00887766 ]
[ counter pkts 21794 bytes 1917798 ]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nft_bitwise.c",
"net/netfilter/nft_byteorder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95bf63844045e7948fd1aeb5e71b942e86ca0414",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "b80ef316e978de2ef81d5bee9c19800b4cf96fb8",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "379ff8d40f59632bea1208956629c2a04067d403",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "96bea2a7baac4a1137c188dc7610184487ab30a7",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "a391afe74398b70107f111aa731eab608624949d",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "18014147d3ee7831dce53fe65d7fc8d428b02552",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_tables.h",
"net/netfilter/nft_bitwise.c",
"net/netfilter/nft_byteorder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix dst corruption in same register operation\n\nFor lshift and rshift, the shift operations are performed in a loop over\n32-bit words. The loop calculates the shifted value and write it to dst,\nand then immediately reads from src to calculate the carry for the next\niteration. Because src and dst could point to the same memory location,\nthe carry is incorrectly calculated using the newly modified dst value\ninstead of the original src value.\n\nAdding a temporary local variable to cache the original value before\nwriting to dst and using it for the carry calculation solves the\nproblem. In addition, partial overlap is rejected from control plane for\nall kind of operations including byteorder. This was tested with the\nfollowing bytecode:\n\ntable test_table ip flags 0 use 1 handle 1\nip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1\nip test_table test_chain 2\n [ immediate reg 1 0x44332211 0x88776655 ]\n [ bitwise reg 1 = ( reg 1 \u003c\u003c 0x08000000 ) ]\n [ cmp eq reg 1 0x66443322 0x00887766 ]\n [ counter pkts 0 bytes 0 ]\nip test_table test_chain 4 3\n [ immediate reg 1 0x44332211 0x88776655 ]\n [ bitwise reg 1 = ( reg 1 \u003c\u003c 0x08000000 ) ]\n [ cmp eq reg 1 0x55443322 0x00887766 ]\n [ counter pkts 21794 bytes 1917798 ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:26.715Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95bf63844045e7948fd1aeb5e71b942e86ca0414"
},
{
"url": "https://git.kernel.org/stable/c/b80ef316e978de2ef81d5bee9c19800b4cf96fb8"
},
{
"url": "https://git.kernel.org/stable/c/379ff8d40f59632bea1208956629c2a04067d403"
},
{
"url": "https://git.kernel.org/stable/c/96bea2a7baac4a1137c188dc7610184487ab30a7"
},
{
"url": "https://git.kernel.org/stable/c/a391afe74398b70107f111aa731eab608624949d"
},
{
"url": "https://git.kernel.org/stable/c/18014147d3ee7831dce53fe65d7fc8d428b02552"
}
],
"title": "netfilter: nf_tables: fix dst corruption in same register operation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64006",
"datePublished": "2026-07-19T14:56:22.321Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-30T12:27:26.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39677 (GCVE-0-2025-39677)
Vulnerability from cvelistv5
Published
2025-09-05 17:20
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: Fix backlog accounting in qdisc_dequeue_internal
This issue applies for the following qdiscs: hhf, fq, fq_codel, and
fq_pie, and occurs in their change handlers when adjusting to the new
limit. The problem is the following in the values passed to the
subsequent qdisc_tree_reduce_backlog call given a tbf parent:
When the tbf parent runs out of tokens, skbs of these qdiscs will
be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,
which accounts for both qlen and backlog. However, in the case of
qdisc_dequeue_internal, ONLY qlen is accounted for when pulling
from gso_skb. This means that these qdiscs are missing a
qdisc_qstats_backlog_dec when dropping packets to satisfy the
new limit in their change handlers.
One can observe this issue with the following (with tc patched to
support a limit of 0):
export TARGET=fq
tc qdisc del dev lo root
tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms
tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000
echo ''; echo 'add child'; tc -s -d qdisc show dev lo
ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null
echo ''; echo 'after ping'; tc -s -d qdisc show dev lo
tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0
echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo
tc qdisc replace dev lo handle 2: parent 1:1 sfq
echo ''; echo 'post graft'; tc -s -d qdisc show dev lo
The second to last show command shows 0 packets but a positive
number (74) of backlog bytes. The problem becomes clearer in the
last show command, where qdisc_purge_queue triggers
qdisc_tree_reduce_backlog with the positive backlog and causes an
underflow in the tbf parent's backlog (4096 Mb instead of 0).
To fix this issue, the codepath for all clients of qdisc_dequeue_internal
has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.
qdisc_dequeue_internal handles the backlog adjustments for all cases that
do not directly use the dequeue handler.
The old fq_codel_change limit adjustment loop accumulated the arguments to
the subsequent qdisc_tree_reduce_backlog call through the cstats field.
However, this is confusing and error prone as fq_codel_dequeue could also
potentially mutate this field (which qdisc_dequeue_internal calls in the
non gso_skb case), so we have unified the code here with other qdiscs.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:53:13.090718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T22:02:29.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sch_generic.h",
"net/sched/sch_codel.c",
"net/sched/sch_fq.c",
"net/sched/sch_fq_codel.c",
"net/sched/sch_fq_pie.c",
"net/sched/sch_hhf.c",
"net/sched/sch_pie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "65d1b5d84a0d697e9cfcdd0e07aad1bf1cb96295",
"status": "affected",
"version": "4b549a2ef4bef9965d97cbd992ba67930cd3e0fe",
"versionType": "git"
},
{
"lessThan": "dcfed7251e23cd71d32c4ecc444ff97992087e46",
"status": "affected",
"version": "4b549a2ef4bef9965d97cbd992ba67930cd3e0fe",
"versionType": "git"
},
{
"lessThan": "38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb",
"status": "affected",
"version": "4b549a2ef4bef9965d97cbd992ba67930cd3e0fe",
"versionType": "git"
},
{
"lessThan": "a225f44d84b8900d679c5f5a9ea46fe9c0cc7802",
"status": "affected",
"version": "4b549a2ef4bef9965d97cbd992ba67930cd3e0fe",
"versionType": "git"
},
{
"lessThan": "52bf272636bda69587952b35ae97690b8dc89941",
"status": "affected",
"version": "4b549a2ef4bef9965d97cbd992ba67930cd3e0fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sch_generic.h",
"net/sched/sch_codel.c",
"net/sched/sch_fq.c",
"net/sched/sch_fq_codel.c",
"net/sched/sch_fq_pie.c",
"net/sched/sch_hhf.c",
"net/sched/sch_pie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.4",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix backlog accounting in qdisc_dequeue_internal\n\nThis issue applies for the following qdiscs: hhf, fq, fq_codel, and\nfq_pie, and occurs in their change handlers when adjusting to the new\nlimit. The problem is the following in the values passed to the\nsubsequent qdisc_tree_reduce_backlog call given a tbf parent:\n\n When the tbf parent runs out of tokens, skbs of these qdiscs will\n be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,\n which accounts for both qlen and backlog. However, in the case of\n qdisc_dequeue_internal, ONLY qlen is accounted for when pulling\n from gso_skb. This means that these qdiscs are missing a\n qdisc_qstats_backlog_dec when dropping packets to satisfy the\n new limit in their change handlers.\n\n One can observe this issue with the following (with tc patched to\n support a limit of 0):\n\n export TARGET=fq\n tc qdisc del dev lo root\n tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms\n tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000\n echo \u0027\u0027; echo \u0027add child\u0027; tc -s -d qdisc show dev lo\n ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2\u003e\u00261 \u003e/dev/null\n echo \u0027\u0027; echo \u0027after ping\u0027; tc -s -d qdisc show dev lo\n tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0\n echo \u0027\u0027; echo \u0027after limit drop\u0027; tc -s -d qdisc show dev lo\n tc qdisc replace dev lo handle 2: parent 1:1 sfq\n echo \u0027\u0027; echo \u0027post graft\u0027; tc -s -d qdisc show dev lo\n\n The second to last show command shows 0 packets but a positive\n number (74) of backlog bytes. The problem becomes clearer in the\n last show command, where qdisc_purge_queue triggers\n qdisc_tree_reduce_backlog with the positive backlog and causes an\n underflow in the tbf parent\u0027s backlog (4096 Mb instead of 0).\n\nTo fix this issue, the codepath for all clients of qdisc_dequeue_internal\nhas been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.\nqdisc_dequeue_internal handles the backlog adjustments for all cases that\ndo not directly use the dequeue handler.\n\nThe old fq_codel_change limit adjustment loop accumulated the arguments to\nthe subsequent qdisc_tree_reduce_backlog call through the cstats field.\nHowever, this is confusing and error prone as fq_codel_dequeue could also\npotentially mutate this field (which qdisc_dequeue_internal calls in the\nnon gso_skb case), so we have unified the code here with other qdiscs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached exclusively through RTM_NEWQDISC/tc netlink messages that invoke the qdisc -\u003echange() handlers on a local netlink socket. Per kernel scoring guidance, tc/netlink qdisc configuration is a local attack vector.\nAC:L - The commit message contains a fully deterministic reproducer (tbf parent + fq child, ping to fill the queue, then change the limit and graft) with no race, no memory-layout dependence, and no non-default kernel config \u2014 fq and fq_codel are built in on virtually all distributions and fq_codel is the default qdisc.\nPR:L - tc_modify_qdisc is gated only by netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against net-\u003euser_ns, so an unprivileged user obtains it with `unshare -Urn` and configures qdiscs on the loopback device in the new namespace. No real root in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 creating the qdisc hierarchy, generating traffic into the queue, changing the limit, and grafting \u2014 with no victim action required.\nS:U - The corrupted state and its consequences are confined to the kernel\u0027s qdisc tree within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The qdisc queue-accounting desync is the same primitive that has repeatedly escalated to use-after-free on qdisc class objects via wrongly-driven cops-\u003eqlen_notify() (CVE-2025-21703, CVE-2025-38000/38001), and a UAF on those objects yields attacker-controlled reads of freed kernel memory.\nI:H - The bug produces an attacker-controlled u32 underflow of qstats.backlog that propagates through qdisc_tree_reduce_backlog into every ancestor qdisc, corrupting kernel state that drives class active-list maintenance and enqueue/drop decisions; the resulting accounting desync is exploitable for heap corruption in the same manner as the prior net/sched accounting CVEs.\nA:H - The underflowed backlog permanently blackholes the device (bfifo/plug limit checks and sch_red\u0027s qavg see a ~4 GiB queue and drop everything), and the unguarded pre-fix trim loops give an outright kernel oops via qdisc_pkt_len(NULL) in codel/pie/fq_pie/fq_codel or an infinite loop in hhf while holding sch_tree_lock and RTNL."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:20.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/65d1b5d84a0d697e9cfcdd0e07aad1bf1cb96295"
},
{
"url": "https://git.kernel.org/stable/c/dcfed7251e23cd71d32c4ecc444ff97992087e46"
},
{
"url": "https://git.kernel.org/stable/c/38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb"
},
{
"url": "https://git.kernel.org/stable/c/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802"
},
{
"url": "https://git.kernel.org/stable/c/52bf272636bda69587952b35ae97690b8dc89941"
}
],
"title": "net/sched: Fix backlog accounting in qdisc_dequeue_internal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39677",
"datePublished": "2025-09-05T17:20:43.145Z",
"dateReserved": "2025-04-16T07:20:57.112Z",
"dateUpdated": "2026-10-30T12:22:20.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46302 (GCVE-0-2026-46302)
Vulnerability from cvelistv5
Published
2026-06-08 15:46
Modified
2026-11-06 16:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: allow multiple opens of /sys/fs/selinux/policy
Currently there can only be a single open of /sys/fs/selinux/policy at
any time. This allows any process to block any other process from
reading the kernel policy. The original motivation seems to have been
a mix of preventing an inconsistent view of the policy size and
preventing userspace from allocating kernel memory without bound, but
this is arguably equally bad. Eliminate the policy_opened flag and
shrink the critical section that the policy mutex is held. While we
are making changes here, drop a couple of extraneous BUG_ONs.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cee74f47a6baba0ac457e87687fdcf0abd599f0a Version: cee74f47a6baba0ac457e87687fdcf0abd599f0a Version: cee74f47a6baba0ac457e87687fdcf0abd599f0a Version: cee74f47a6baba0ac457e87687fdcf0abd599f0a Version: cee74f47a6baba0ac457e87687fdcf0abd599f0a Version: cee74f47a6baba0ac457e87687fdcf0abd599f0a |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:13:45.536424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:23:48.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/selinuxfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9795810d116bc9071485929ba6471dc8d5bd158b",
"status": "affected",
"version": "cee74f47a6baba0ac457e87687fdcf0abd599f0a",
"versionType": "git"
},
{
"lessThan": "d8cafd0226d5df682d1f4ea978a4318fe3a11210",
"status": "affected",
"version": "cee74f47a6baba0ac457e87687fdcf0abd599f0a",
"versionType": "git"
},
{
"lessThan": "0ed712134a3db0075bfe9a0f8536c48728ec745e",
"status": "affected",
"version": "cee74f47a6baba0ac457e87687fdcf0abd599f0a",
"versionType": "git"
},
{
"lessThan": "c24d2e190b955baf3a95e05d34b192f61bd201b3",
"status": "affected",
"version": "cee74f47a6baba0ac457e87687fdcf0abd599f0a",
"versionType": "git"
},
{
"lessThan": "714362f3779dfa453a78ced32396a72726962a41",
"status": "affected",
"version": "cee74f47a6baba0ac457e87687fdcf0abd599f0a",
"versionType": "git"
},
{
"lessThan": "a02cd6805562305f936e807da83e253b719dd965",
"status": "affected",
"version": "cee74f47a6baba0ac457e87687fdcf0abd599f0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/selinuxfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: allow multiple opens of /sys/fs/selinux/policy\n\nCurrently there can only be a single open of /sys/fs/selinux/policy at\nany time. This allows any process to block any other process from\nreading the kernel policy. The original motivation seems to have been\na mix of preventing an inconsistent view of the policy size and\npreventing userspace from allocating kernel memory without bound, but\nthis is arguably equally bad. Eliminate the policy_opened flag and\nshrink the critical section that the policy mutex is held. While we\nare making changes here, drop a couple of extraneous BUG_ONs."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:15.203Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9795810d116bc9071485929ba6471dc8d5bd158b"
},
{
"url": "https://git.kernel.org/stable/c/d8cafd0226d5df682d1f4ea978a4318fe3a11210"
},
{
"url": "https://git.kernel.org/stable/c/0ed712134a3db0075bfe9a0f8536c48728ec745e"
},
{
"url": "https://git.kernel.org/stable/c/c24d2e190b955baf3a95e05d34b192f61bd201b3"
},
{
"url": "https://git.kernel.org/stable/c/714362f3779dfa453a78ced32396a72726962a41"
},
{
"url": "https://git.kernel.org/stable/c/a02cd6805562305f936e807da83e253b719dd965"
}
],
"title": "selinux: allow multiple opens of /sys/fs/selinux/policy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46302",
"datePublished": "2026-06-08T15:46:29.545Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-11-06T16:23:48.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72009 (GCVE-0-2026-72009)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
The MIPI DSI and CSI domains share control bits for clock and reset, which
can lead to incorrect behavior if one domain disables the shared resource
while the other is still active.
To fix the issue, introduce a shared MIPI PHY power domain to own the
common resources and make DSI and CSI its subdomains. This ensures the
shared bits are properly managed and not disabled while still in use.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:53.130863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:12.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/imx/imx93-blk-ctrl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "73c0d6957811d7c138124107e1d31e8fb0133156",
"status": "affected",
"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
"versionType": "git"
},
{
"lessThan": "94b8a47f45f19c537964355fa539670631882b20",
"status": "affected",
"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
"versionType": "git"
},
{
"lessThan": "4fd5b33faf092ef2d09f730a7d9e49f9e976ac67",
"status": "affected",
"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
"versionType": "git"
},
{
"lessThan": "4ba6d7166750d0b810c6cfc0b1df7585f513b48c",
"status": "affected",
"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
"versionType": "git"
},
{
"lessThan": "99611233f8cda833169fa6487d5dacdf189e5cb0",
"status": "affected",
"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pmdomain/imx/imx93-blk-ctrl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access on an i.MX93 system to trigger MIPI DSI/CSI power-domain transitions via DRM display ioctls and V4L2 camera streaming on /dev/dri/* and /dev/video*; there is no network, Bluetooth, or physical USB attack path to this pmdomain driver.\nAC:L - On affected imx93 boards with both DSI and CSI enabled, an attacker can reliably reproduce the fault by starting a CSI capture (keeping the CSI genpd active) then suspending or closing the DSI path so imx93_blk_ctrl_power_off() clears shared PHY bit 12; no uncontrollable timing or rare layout is required.\nPR:L - Triggering the vulnerable power_off path needs only a local unprivileged application user able to open standard media device nodes (typical video/render group or embedded app account on automotive, kiosk, and industrial i.MX93 targets), not init-namespace root or capabilities unavailable via user namespaces.\nUI:N - No separate victim action is required when the attacker controls both display and camera interfaces on the same device; they can independently start CSI streaming and release DSI runtime PM to force premature shared PHY teardown.\nS:U - Impact is confined to kernel and on-chip media hardware on the same i.MX93 host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Asserting reset and gating the shared MIPI PHY (BIT(12)) while CSI/DSI DMA is still active can leave media bus masters operating against powered-down hardware; on i.MX93 platforms without in-tree SMMU isolation this plausibly enables errant DMA reads exposing kernel or other process memory.\nI:H - The same premature PHY reset/clock gate during active capture or display transfers can cause misdirected media-master writes beyond intended buffers, corrupting arbitrary physical memory on affected embedded i.MX93 deployments where DMA is not IOMMU-contained.\nA:H - Disabling shared PHY resources while the sibling MIPI interface remains active causes camera/display failure, driver hangs, and potential kernel oops or panic from malfunctioning CSI/DSI hardware and interrupt storms on safety-critical embedded systems using concurrent display and camera."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:44.807Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/73c0d6957811d7c138124107e1d31e8fb0133156"
},
{
"url": "https://git.kernel.org/stable/c/94b8a47f45f19c537964355fa539670631882b20"
},
{
"url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"
},
{
"url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"
},
{
"url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"
}
],
"title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72009",
"datePublished": "2026-08-15T05:51:39.019Z",
"dateReserved": "2026-08-09T03:40:39.899Z",
"dateUpdated": "2026-10-30T12:28:44.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89757 (GCVE-0-2026-89757)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-30 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/mglru: fix and remove redundant unevictable folio handling
sort_folio() has a shortcut for moving folios that are no longer evictable
but are still sitting on a generation list. However, this shortcut is
buggy. It does not follow the PG_lru usage convention, and it has a more
serious issue.
Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that
folio->lru can be reused to hold folio->mlock_count (see the comment in
lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them,
and every other place that turns a folio unevictable initialises
mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and
__mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio()
sets nothing, and the lru_gen_del_folio() right above it may have already
poisoned folio->lru via list_del(), so mlock_count ends up aliasing
LIST_POISON2, which reads as 0x122, i.e. 290. The result is user
visible. On munlock, __munlock_folio() decrements that bogus count, finds
it still non-zero and bails out before clearing PG_mlocked, so the folio
remains unevictable and the Mlocked accounting stays inflated until the
folio is freed.
The shortcut also touches the LRU flags in the wrong order. It calls
lru_gen_del_folio() while PG_lru is still set, so a concurrent
folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed
on a folio that has already been taken off the generation list, which may
lead to unexpected behavior.
So fix it by isolating them as common folios and letting the generic
shrink path cull them. This matches the classical LRU behavior, and there
should be no visible effect on the generic eviction or isolation behavior.
There is no performance concern either, such a folio goes through this
once, and then it is off the generation lists for good.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ac35a490237446b71e3b4b782b1596967edd0aa8 Version: ac35a490237446b71e3b4b782b1596967edd0aa8 Version: ac35a490237446b71e3b4b782b1596967edd0aa8 Version: ac35a490237446b71e3b4b782b1596967edd0aa8 Version: ac35a490237446b71e3b4b782b1596967edd0aa8 Version: ac35a490237446b71e3b4b782b1596967edd0aa8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9f2160081a1e3ebb285bd71be3382abaeb8390a",
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"versionType": "git"
},
{
"lessThan": "b1d7c69e6c7d3ec47513b911ce7529e56d183dad",
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"versionType": "git"
},
{
"lessThan": "49193dac48d30eee2a21da88a7262d52a7feefae",
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"versionType": "git"
},
{
"lessThan": "54a58d6656dd403b686b247f0bad8507cbfb45df",
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"versionType": "git"
},
{
"lessThan": "15d3a2a71c8bf7333d019d249ee33669e69e4275",
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"versionType": "git"
},
{
"lessThan": "f7e698e326b239a91ea15844817551921209e826",
"status": "affected",
"version": "ac35a490237446b71e3b4b782b1596967edd0aa8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/vmscan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mglru: fix and remove redundant unevictable folio handling\n\nsort_folio() has a shortcut for moving folios that are no longer evictable\nbut are still sitting on a generation list. However, this shortcut is\nbuggy. It does not follow the PG_lru usage convention, and it has a more\nserious issue.\n\nUnevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that\nfolio-\u003elru can be reused to hold folio-\u003emlock_count (see the comment in\nlruvec_init()). Hence lruvec_add_folio() skips the list_add() for them,\nand every other place that turns a folio unevictable initialises\nmlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and\n__mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio()\nsets nothing, and the lru_gen_del_folio() right above it may have already\npoisoned folio-\u003elru via list_del(), so mlock_count ends up aliasing\nLIST_POISON2, which reads as 0x122, i.e. 290. The result is user\nvisible. On munlock, __munlock_folio() decrements that bogus count, finds\nit still non-zero and bails out before clearing PG_mlocked, so the folio\nremains unevictable and the Mlocked accounting stays inflated until the\nfolio is freed.\n\nThe shortcut also touches the LRU flags in the wrong order. It calls\nlru_gen_del_folio() while PG_lru is still set, so a concurrent\nfolio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed\non a folio that has already been taken off the generation list, which may\nlead to unexpected behavior.\n\nSo fix it by isolating them as common folios and letting the generic\nshrink path cull them. This matches the classical LRU behavior, and there\nshould be no visible effect on the generic eviction or isolation behavior.\n\nThere is no performance concern either, such a folio goes through this\nonce, and then it is off the generation lists for good."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:56.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9f2160081a1e3ebb285bd71be3382abaeb8390a"
},
{
"url": "https://git.kernel.org/stable/c/b1d7c69e6c7d3ec47513b911ce7529e56d183dad"
},
{
"url": "https://git.kernel.org/stable/c/49193dac48d30eee2a21da88a7262d52a7feefae"
},
{
"url": "https://git.kernel.org/stable/c/54a58d6656dd403b686b247f0bad8507cbfb45df"
},
{
"url": "https://git.kernel.org/stable/c/15d3a2a71c8bf7333d019d249ee33669e69e4275"
},
{
"url": "https://git.kernel.org/stable/c/f7e698e326b239a91ea15844817551921209e826"
}
],
"title": "mm/mglru: fix and remove redundant unevictable folio handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89757",
"datePublished": "2026-09-11T19:46:59.830Z",
"dateReserved": "2026-09-11T19:38:34.763Z",
"dateUpdated": "2026-10-30T12:32:56.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98019 (GCVE-0-2026-98019)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: mark a NULL call argument precise
check_func_arg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.
check_helper_call() enforces second parameter of the
bpf_get_local_storage() to be zero, w/o marking the underlying scalar
register precise. Hence a checkpoint created on such a path would
prune against arbitrary scalar value.
Grouping these two into one patch, as they share the same fixes tag.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c",
"tools/testing/selftests/bpf/progs/verifier_subprog_precision.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "febbb66e682d8328f7c5bcbdd5e4291abab2e858",
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"versionType": "git"
},
{
"lessThan": "627089c278df58749f25686c6a3caf7e181b5951",
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"versionType": "git"
},
{
"lessThan": "b1fe6379e401b8ce0f561cb4d84af2b70b4343c3",
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"versionType": "git"
},
{
"lessThan": "69a9ad004ccf5d45e534c7d503f47f643abe64b7",
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"versionType": "git"
},
{
"lessThan": "1a3a10b030c96ea88868ccc060a16827c01eaa5a",
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c",
"tools/testing/selftests/bpf/progs/verifier_subprog_precision.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: mark a NULL call argument precise\n\ncheck_func_arg() allows bpf_register_is_null() for nullable arguments\nw/o marking the underlying scalar register precise. Hence a checkpoint\ncreated on such a path would prune against arbitrary scalar value.\n\ncheck_helper_call() enforces second parameter of the\nbpf_get_local_storage() to be zero, w/o marking the underlying scalar\nregister precise. Hence a checkpoint created on such a path would\nprune against arbitrary scalar value.\n\nGrouping these two into one patch, as they share the same fixes tag."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:04.100Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/febbb66e682d8328f7c5bcbdd5e4291abab2e858"
},
{
"url": "https://git.kernel.org/stable/c/627089c278df58749f25686c6a3caf7e181b5951"
},
{
"url": "https://git.kernel.org/stable/c/b1fe6379e401b8ce0f561cb4d84af2b70b4343c3"
},
{
"url": "https://git.kernel.org/stable/c/69a9ad004ccf5d45e534c7d503f47f643abe64b7"
},
{
"url": "https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a"
}
],
"title": "bpf: mark a NULL call argument precise",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98019",
"datePublished": "2026-09-25T10:23:40.303Z",
"dateReserved": "2026-09-25T10:19:56.069Z",
"dateUpdated": "2026-10-21T12:54:04.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98975 (GCVE-0-2026-98975)
Vulnerability from cvelistv5
Published
2026-10-23 12:19
Modified
2026-10-24 14:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to i_disk_size,
xmi_can_exchange_reflink_flags() assumes every mapping moved and hands
the reflink flag over to the other file.
That assumption is wrong. A file can still own shared blocks past
i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size
without unmapping anything. The flag is cleared anyway, and the next
write to such a block happens in place instead of CoW, corrupting the
other file that shares it.
Commit a23eca88448e ("xfs: fix exchange-range reflink flag clearing
issue with INO1_WRITTEN") fixed one instance of this. Rather than add
another special case, stop moving the flags.
xfs_exchmaps_ensure_reflink() already sets the flag on both inodes
before the exchange, so both just keep it.
Nothing sets CLEAR_INO{1,2}_REFLINK anymore. Intents logged by older
kernels may still carry them; recovery already masks them off, so they
stay in the log format mask and are ignored.
XFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from
one inode to the other along with the extents. Just removing that is
not enough here: the exchange path flags both inodes up front in
xfs_exchmaps_ensure_reflink(), but swapext has no such step, so the
inode receiving the shared extents would be left without the flag.
Set it on both inodes instead, and make sure both have a CoW fork,
since an inode with the reflink flag is expected to have one.
The flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a
truncate to zero removes it.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c",
"fs/xfs/libxfs/xfs_log_format.h",
"fs/xfs/xfs_bmap_util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1fa2f3a7ef7ee0f2503a4b0afe24bc8c9d0820be",
"status": "affected",
"version": "f0bc4d134b46607967bda1205ce3226a1bd95f42",
"versionType": "git"
},
{
"lessThan": "7d3b9b2c9dc57f93f36c716ab752548cb4db9900",
"status": "affected",
"version": "f0bc4d134b46607967bda1205ce3226a1bd95f42",
"versionType": "git"
},
{
"lessThan": "4756c94260e69ce42612b8220c3614f02f7a11d5",
"status": "affected",
"version": "f0bc4d134b46607967bda1205ce3226a1bd95f42",
"versionType": "git"
},
{
"lessThan": "d84d6c1a7f1e2de9e601703a326a4c1b7b421943",
"status": "affected",
"version": "f0bc4d134b46607967bda1205ce3226a1bd95f42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c",
"fs/xfs/libxfs/xfs_log_format.h",
"fs/xfs/xfs_bmap_util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong. A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything. The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this. Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore. Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents. Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - `ioctl(2)` runs `do_vfs_ioctl()`/`vfs_ioctl()` \u2192 `xfs_file_ioctl()` \u2192 `xfs_ioc_exchange_range()` \u2192 `xfs_exchange_mappings()` \u2192 patched `xfs_exchmaps_init_intent()`; all causal file descriptors, offsets, and flags are supplied locally.\nAC:L - On a reflink/exchange-range XFS, the attacker can clone a target block, use chosen `TO_EOF` offsets to strand it past `i_disk_size`, perform a full-range exchange so `xmi_can_exchange_reflink_flags()` clears the flag, and `pwrite` the shared block; no race or external event is required.\nPR:L - `xfs_exchange_range()` requires only read-write scratch-file descriptors and `remap_verify_area(..., true)`, with no `capable()` check; FICLONE requires only read access to the protected source and write access to an attacker-owned destination.\nUI:N - The attacker personally performs FICLONERANGE, the crafted `XFS_IOC_EXCHANGE_RANGE` operations, and the final `pwrite`; no victim must mount media, open a file, or take another action.\nS:U - `xfs_exchmaps_clear_reflink()` breaks CoW isolation between inodes on the same XFS host; using the resulting protected-file overwrite for root access is a standard local privilege escalation, not a VM, IOMMU, or other security-authority escape.\nC:H - The attacker can clone a readable SUID-root binary, then make the faulty non-CoW write alter its physical block without modifying its inode or clearing SUID metadata; executing the corrupted binary can yield root and unrestricted access to host-confidential data.\nI:H - After `xfs_exchmaps_clear_reflink()` removes the flag, `xfs_is_cow_inode()` is false and the iomap write path updates the still-shared block in place, permitting persistent attacker-controlled modification of readable protected files without write permission.\nA:H - The same in-place primitive can corrupt readable boot-critical executables, and overwriting a SUID-root binary can provide root control capable of stopping the host, supporting complete availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:09:45.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1fa2f3a7ef7ee0f2503a4b0afe24bc8c9d0820be"
},
{
"url": "https://git.kernel.org/stable/c/7d3b9b2c9dc57f93f36c716ab752548cb4db9900"
},
{
"url": "https://git.kernel.org/stable/c/4756c94260e69ce42612b8220c3614f02f7a11d5"
},
{
"url": "https://git.kernel.org/stable/c/d84d6c1a7f1e2de9e601703a326a4c1b7b421943"
}
],
"title": "xfs: stop exchanging reflink flags when exchanging mappings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98975",
"datePublished": "2026-10-23T12:19:48.379Z",
"dateReserved": "2026-09-25T10:25:14.383Z",
"dateUpdated": "2026-10-24T14:09:45.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89813 (GCVE-0-2026-89813)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: force complete the KIQ ring fences on reset
Like the MES scheduler ring, the KIQ ring sets no_scheduler = true and uses a
polling fence, so it is skipped by the force-completion loop in
amdgpu_device_pre_asic_reset(). Its hw fence value lives in wb (GTT) memory and
survives a MODE1 reset while fence_drv.sync_seq keeps advancing, so after a
reset the first KIQ submission can poll forever on a seq that is never written
back.
Force complete the KIQ ring fences too so their hw fence is realigned to
sync_seq.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 65781c78ad74e4260fbec92c0ecc05738044e177 Version: 65781c78ad74e4260fbec92c0ecc05738044e177 Version: 65781c78ad74e4260fbec92c0ecc05738044e177 Version: 65781c78ad74e4260fbec92c0ecc05738044e177 Version: 65781c78ad74e4260fbec92c0ecc05738044e177 Version: 65781c78ad74e4260fbec92c0ecc05738044e177 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83c54ed3be2f71a21e0f12ce5ca64435e33ba440",
"status": "affected",
"version": "65781c78ad74e4260fbec92c0ecc05738044e177",
"versionType": "git"
},
{
"lessThan": "11adb2bae30a3155395594e5c9bc0daf0c4ffa15",
"status": "affected",
"version": "65781c78ad74e4260fbec92c0ecc05738044e177",
"versionType": "git"
},
{
"lessThan": "9944329e409b04d71fa22f39b38a4bd78b75bcd9",
"status": "affected",
"version": "65781c78ad74e4260fbec92c0ecc05738044e177",
"versionType": "git"
},
{
"lessThan": "c26cbd5c33cd72daa03079235de60688a3c97c52",
"status": "affected",
"version": "65781c78ad74e4260fbec92c0ecc05738044e177",
"versionType": "git"
},
{
"lessThan": "bdd6a58743e00ebc6d52b9cdf9aafb4e535e0b71",
"status": "affected",
"version": "65781c78ad74e4260fbec92c0ecc05738044e177",
"versionType": "git"
},
{
"lessThan": "fd65d1742992361fc2201ecb4e43411e6e417fcb",
"status": "affected",
"version": "65781c78ad74e4260fbec92c0ecc05738044e177",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: force complete the KIQ ring fences on reset\n\nLike the MES scheduler ring, the KIQ ring sets no_scheduler = true and uses a\npolling fence, so it is skipped by the force-completion loop in\namdgpu_device_pre_asic_reset(). Its hw fence value lives in wb (GTT) memory and\nsurvives a MODE1 reset while fence_drv.sync_seq keeps advancing, so after a\nreset the first KIQ submission can poll forever on a seq that is never written\nback.\n\nForce complete the KIQ ring fences too so their hw fence is realigned to\nsync_seq."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:09.910Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83c54ed3be2f71a21e0f12ce5ca64435e33ba440"
},
{
"url": "https://git.kernel.org/stable/c/11adb2bae30a3155395594e5c9bc0daf0c4ffa15"
},
{
"url": "https://git.kernel.org/stable/c/9944329e409b04d71fa22f39b38a4bd78b75bcd9"
},
{
"url": "https://git.kernel.org/stable/c/c26cbd5c33cd72daa03079235de60688a3c97c52"
},
{
"url": "https://git.kernel.org/stable/c/bdd6a58743e00ebc6d52b9cdf9aafb4e535e0b71"
},
{
"url": "https://git.kernel.org/stable/c/fd65d1742992361fc2201ecb4e43411e6e417fcb"
}
],
"title": "drm/amdgpu: force complete the KIQ ring fences on reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89813",
"datePublished": "2026-09-16T10:30:46.201Z",
"dateReserved": "2026-09-11T19:38:34.768Z",
"dateUpdated": "2026-10-30T12:33:09.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100076 (GCVE-0-2026-100076)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).
Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "973a629f19c226c8f6080badea7ccf59cc04233f",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "17260b5215d4ced17a733e2c027a76290e476fad",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "2f5e2752c2b4bad01df4523cfe2b41b702c60f00",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6c9f6a3b9fdd31a0836b681053155b5997c0156e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c48e5aa01525577d6b6e782962a5bfb0e1535cb5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41b8209376dffbd7b0b85c8bc4697d9166ac62ef",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver\u0027s fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n - issue_beacon(): beacon larger than 512 bytes\n - issue_probersp(): cur_network-\u003eie_length \u003e MAX_IE_SZ\n - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:38.744Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/973a629f19c226c8f6080badea7ccf59cc04233f"
},
{
"url": "https://git.kernel.org/stable/c/17260b5215d4ced17a733e2c027a76290e476fad"
},
{
"url": "https://git.kernel.org/stable/c/2f5e2752c2b4bad01df4523cfe2b41b702c60f00"
},
{
"url": "https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e"
},
{
"url": "https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5"
},
{
"url": "https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef"
}
],
"title": "staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100076",
"datePublished": "2026-09-25T13:06:48.057Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-10-30T12:23:38.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99182 (GCVE-0-2026-99182)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono
capture stream, such as a SmartMic, aggregated across multiple SDW
links), step = ch_count / blob->alh_cfg.device_count truncates to 0.
The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to
UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds
exponent:
UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13
shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'
Treat ch_count < device_count the same way as the existing "channels
equal to output reference channels" case: apply the same ch_mask to
every aggregated device instead of trying to split channels that
can't be evenly divided.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef9342fa7433643f54de19b980e2aac0fae7201c",
"status": "affected",
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
"versionType": "git"
},
{
"lessThan": "a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e",
"status": "affected",
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
"versionType": "git"
},
{
"lessThan": "cad63a7798d6a6cac1fc68732595f0a3278ff6f0",
"status": "affected",
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
"versionType": "git"
},
{
"lessThan": "5e1322787c5e424a570e87c8c2c25e37552cbe3b",
"status": "affected",
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
"versionType": "git"
},
{
"lessThan": "746de48c3a250f0c264105dcbfcdf0c5001e970b",
"status": "affected",
"version": "0390a102cc18cb7456d6c1f15ac51f1af90fcf9c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture\n\nWhen ch_count is smaller than blob-\u003ealh_cfg.device_count (e.g. a mono\ncapture stream, such as a SmartMic, aggregated across multiple SDW\nlinks), step = ch_count / blob-\u003ealh_cfg.device_count truncates to 0.\nThe subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to\nUINT_MAX, causing GENMASK()\u0027s internal shift to use an out-of-bounds\nexponent:\n\n UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13\n shift exponent 18446744069414584384 is too large for 64-bit type \u0027long unsigned int\u0027\n\nTreat ch_count \u003c device_count the same way as the existing \"channels\nequal to output reference channels\" case: apply the same ch_mask to\nevery aggregated device instead of trying to split channels that\ncan\u0027t be evenly divided."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:45.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef9342fa7433643f54de19b980e2aac0fae7201c"
},
{
"url": "https://git.kernel.org/stable/c/a92dee3a2a5e1ef05d13731b2f5e2eb9a3125e4e"
},
{
"url": "https://git.kernel.org/stable/c/cad63a7798d6a6cac1fc68732595f0a3278ff6f0"
},
{
"url": "https://git.kernel.org/stable/c/5e1322787c5e424a570e87c8c2c25e37552cbe3b"
},
{
"url": "https://git.kernel.org/stable/c/746de48c3a250f0c264105dcbfcdf0c5001e970b"
}
],
"title": "ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99182",
"datePublished": "2026-10-28T10:35:35.193Z",
"dateReserved": "2026-09-25T10:25:14.399Z",
"dateUpdated": "2026-10-30T12:42:45.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53285 (GCVE-0-2026-53285)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
[Why]
dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with
DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),
which disables local softirqs.
The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to
allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,
which calls BUG_ON(in_interrupt()) because it's invoked within the
FPU-enabled (softirq disabled) region, leading to a kernel crash.
[How]
Wrap the dc_state_create_phantom_plane() call with the
DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during
this memory allocation.
(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:25:10.350550Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:17.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "19e82047cb68bcde55791ee20178acd431609b8d",
"status": "affected",
"version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
"versionType": "git"
},
{
"lessThan": "a8c1480bb066cf0f6e79129b7292e1c99ff68b9b",
"status": "affected",
"version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
"versionType": "git"
},
{
"lessThan": "30bb2ec6695d62f63db4aa6179c4626834ed0cd6",
"status": "affected",
"version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
"versionType": "git"
},
{
"lessThan": "183182235f6d53bac62c6c39014738a54a68dfa6",
"status": "affected",
"version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n\n[Why]\ndcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with\nDC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),\nwhich disables local softirqs.\n\nThe DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to\nallocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,\nwhich calls BUG_ON(in_interrupt()) because it\u0027s invoked within the\nFPU-enabled (softirq disabled) region, leading to a kernel crash.\n\n[How]\nWrap the dc_state_create_phantom_plane() call with the\nDC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during\nthis memory allocation.\n\n(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:26.186Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/19e82047cb68bcde55791ee20178acd431609b8d"
},
{
"url": "https://git.kernel.org/stable/c/a8c1480bb066cf0f6e79129b7292e1c99ff68b9b"
},
{
"url": "https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6"
},
{
"url": "https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"
}
],
"title": "drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53285",
"datePublished": "2026-06-26T19:40:46.328Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-11-06T16:34:17.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90363 (GCVE-0-2026-90363)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-21 12:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: don't tear down KMS twice when KMS init fails
When priv->kms_init() (mdp4_kms_init() / mdp5_kms_init()) fails partway
through, both display drivers already tear their KMS state down via
mdp4_destroy() / mdp5_kms_destroy() before returning the error. The
common error path in msm_drm_init() then runs msm_drm_uninit() ->
msm_drm_kms_uninit(), which tries to destroy the very same KMS a second
time, which causes a use-after-free crash.
Bring MDP4/MDP5 in line with the DPU driver whose dpu_kms_init() doesn't
perform error cleanup on the failure. Let the common path own the
cleanup, instead of freeing the KMS from their error paths.
The crash trace for the reference:
__lock_acquire from lock_acquire (kernel/locking/lockdep.c:5906 kernel/locking/lockdep.c:5863)
lock_acquire from touch_wq_lockdep_map (kernel/workqueue.c:4094 (discriminator 1))
touch_wq_lockdep_map from __flush_workqueue (kernel/workqueue.c:4136)
__flush_workqueue from msm_drm_kms_uninit (drivers/gpu/drm/msm/msm_kms.c:243 (discriminator 33))
msm_drm_kms_uninit from msm_drm_uninit (drivers/gpu/drm/msm/msm_drv.c:93)
msm_drm_uninit from msm_drm_init (drivers/gpu/drm/msm/msm_drv.c:184)
msm_drm_init from try_to_bring_up_aggregate_device (drivers/base/component.c:249 drivers/base/component.c:227)
try_to_bring_up_aggregate_device from __component_add (drivers/base/component.c:269 drivers/base/component.c:748)
__component_add from dsi_host_attach (drivers/gpu/drm/msm/dsi/dsi_host.c:1739)
dsi_host_attach from mipi_dsi_attach (drivers/gpu/drm/drm_mipi_dsi.c:383)
mipi_dsi_attach from sharp_nt_panel_probe (drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c:247)
Patchwork: https://patchwork.freedesktop.org/patch/742068/
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c",
"drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54437ace956dc7b758c0219d6f76654b3ead8d69",
"status": "affected",
"version": "506efcba31296e9cbc4f8f148eec1e4b29039931",
"versionType": "git"
},
{
"lessThan": "08827aa40f0ee9d37dcff8d6acb340b970051486",
"status": "affected",
"version": "506efcba31296e9cbc4f8f148eec1e4b29039931",
"versionType": "git"
},
{
"lessThan": "e2a99fa93b400dfbb9598103249f71969501094a",
"status": "affected",
"version": "506efcba31296e9cbc4f8f148eec1e4b29039931",
"versionType": "git"
},
{
"lessThan": "93c125e4ea98fb25f927ba5a334d85845127d667",
"status": "affected",
"version": "506efcba31296e9cbc4f8f148eec1e4b29039931",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c",
"drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: don\u0027t tear down KMS twice when KMS init fails\n\nWhen priv-\u003ekms_init() (mdp4_kms_init() / mdp5_kms_init()) fails partway\nthrough, both display drivers already tear their KMS state down via\nmdp4_destroy() / mdp5_kms_destroy() before returning the error. The\ncommon error path in msm_drm_init() then runs msm_drm_uninit() -\u003e\nmsm_drm_kms_uninit(), which tries to destroy the very same KMS a second\ntime, which causes a use-after-free crash.\n\nBring MDP4/MDP5 in line with the DPU driver whose dpu_kms_init() doesn\u0027t\nperform error cleanup on the failure. Let the common path own the\ncleanup, instead of freeing the KMS from their error paths.\n\nThe crash trace for the reference:\n\n __lock_acquire from lock_acquire (kernel/locking/lockdep.c:5906 kernel/locking/lockdep.c:5863)\n lock_acquire from touch_wq_lockdep_map (kernel/workqueue.c:4094 (discriminator 1))\n touch_wq_lockdep_map from __flush_workqueue (kernel/workqueue.c:4136)\n __flush_workqueue from msm_drm_kms_uninit (drivers/gpu/drm/msm/msm_kms.c:243 (discriminator 33))\n msm_drm_kms_uninit from msm_drm_uninit (drivers/gpu/drm/msm/msm_drv.c:93)\n msm_drm_uninit from msm_drm_init (drivers/gpu/drm/msm/msm_drv.c:184)\n msm_drm_init from try_to_bring_up_aggregate_device (drivers/base/component.c:249 drivers/base/component.c:227)\n try_to_bring_up_aggregate_device from __component_add (drivers/base/component.c:269 drivers/base/component.c:748)\n __component_add from dsi_host_attach (drivers/gpu/drm/msm/dsi/dsi_host.c:1739)\n dsi_host_attach from mipi_dsi_attach (drivers/gpu/drm/drm_mipi_dsi.c:383)\n mipi_dsi_attach from sharp_nt_panel_probe (drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c:247)\n\nPatchwork: https://patchwork.freedesktop.org/patch/742068/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:51:17.907Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54437ace956dc7b758c0219d6f76654b3ead8d69"
},
{
"url": "https://git.kernel.org/stable/c/08827aa40f0ee9d37dcff8d6acb340b970051486"
},
{
"url": "https://git.kernel.org/stable/c/e2a99fa93b400dfbb9598103249f71969501094a"
},
{
"url": "https://git.kernel.org/stable/c/93c125e4ea98fb25f927ba5a334d85845127d667"
}
],
"title": "drm/msm: don\u0027t tear down KMS twice when KMS init fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90363",
"datePublished": "2026-09-17T16:09:06.817Z",
"dateReserved": "2026-09-11T19:38:34.807Z",
"dateUpdated": "2026-10-21T12:51:17.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38137 (GCVE-0-2025-38137)
Vulnerability from cvelistv5
Published
2025-07-03 08:35
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl: Cancel outstanding rescan work when unregistering
It's possible to trigger use-after-free here by:
(a) forcing rescan_work_func() to take a long time and
(b) utilizing a pwrctrl driver that may be unloaded for some reason
Cancel outstanding work to ensure it is finished before we allow our data
structures to be cleaned up.
[bhelgaas: tidy commit log]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/pwrctrl/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a63ed775f476ba81558bba24d7538836e1ffb823",
"status": "affected",
"version": "8f62819aaace77dd85037ae766eb767f8c4417ce",
"versionType": "git"
},
{
"lessThan": "b3ad6d23fec23fbef382ce9ea640c37446593cf5",
"status": "affected",
"version": "8f62819aaace77dd85037ae766eb767f8c4417ce",
"versionType": "git"
},
{
"lessThan": "8b926f237743f020518162c62b93cb7107a2b5eb",
"status": "affected",
"version": "8f62819aaace77dd85037ae766eb767f8c4417ce",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/pwrctrl/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/pwrctrl: Cancel outstanding rescan work when unregistering\n\nIt\u0027s possible to trigger use-after-free here by:\n\n (a) forcing rescan_work_func() to take a long time and\n (b) utilizing a pwrctrl driver that may be unloaded for some reason\n\nCancel outstanding work to ensure it is finished before we allow our data\nstructures to be cleaned up.\n\n[bhelgaas: tidy commit log]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:46.881Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a63ed775f476ba81558bba24d7538836e1ffb823"
},
{
"url": "https://git.kernel.org/stable/c/b3ad6d23fec23fbef382ce9ea640c37446593cf5"
},
{
"url": "https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb"
}
],
"title": "PCI/pwrctrl: Cancel outstanding rescan work when unregistering",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38137",
"datePublished": "2025-07-03T08:35:39.849Z",
"dateReserved": "2025-04-16T04:51:23.987Z",
"dateUpdated": "2026-10-21T12:36:46.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43022 (GCVE-0-2026-43022)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
hci_cmd_sync_queue_once() needs to indicate whether a queue item was
added, so caller can know if callbacks are called, so it can avoid
leaking resources.
Change the function to return -EEXIST if queue item already exists.
Modify all callsites to handle that.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f00f36db76eb8fd10d13e80e2590f23b5beaa54d Version: 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 Version: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 Version: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 Version: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 Version: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 Version: 357603f4d396d85fbf0045512efaf1d7f7394ed7 Version: 6.1.120 ≤ Version: 6.6.51 ≤ Version: 6.8.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43022",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:26:13.839442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:26.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "da531f7108218ab6a779861e4646562fc769c9b3",
"status": "affected",
"version": "f00f36db76eb8fd10d13e80e2590f23b5beaa54d",
"versionType": "git"
},
{
"lessThan": "dfee8da127bafa46530b72347bce3ccae736296d",
"status": "affected",
"version": "1499f79995c7ee58e3bfeeff75f6d1b37dcda881",
"versionType": "git"
},
{
"lessThan": "799e2e5fbf3f14874b5c6cc289a0dd68b2ca1979",
"status": "affected",
"version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
"versionType": "git"
},
{
"lessThan": "5cfa4f537a056c91ac6c09bc3ab58a4455217df7",
"status": "affected",
"version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
"versionType": "git"
},
{
"lessThan": "0ad2ce230b38cd4b3f6732cc609e270461e626e5",
"status": "affected",
"version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
"versionType": "git"
},
{
"lessThan": "2969554bcfccb5c609f6b6cd4a014933f3a66dd0",
"status": "affected",
"version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
"versionType": "git"
},
{
"status": "affected",
"version": "357603f4d396d85fbf0045512efaf1d7f7394ed7",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.51",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists\n\nhci_cmd_sync_queue_once() needs to indicate whether a queue item was\nadded, so caller can know if callbacks are called, so it can avoid\nleaking resources.\n\nChange the function to return -EEXIST if queue item already exists.\n\nModify all callsites to handle that."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:48.669Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/da531f7108218ab6a779861e4646562fc769c9b3"
},
{
"url": "https://git.kernel.org/stable/c/dfee8da127bafa46530b72347bce3ccae736296d"
},
{
"url": "https://git.kernel.org/stable/c/799e2e5fbf3f14874b5c6cc289a0dd68b2ca1979"
},
{
"url": "https://git.kernel.org/stable/c/5cfa4f537a056c91ac6c09bc3ab58a4455217df7"
},
{
"url": "https://git.kernel.org/stable/c/0ad2ce230b38cd4b3f6732cc609e270461e626e5"
},
{
"url": "https://git.kernel.org/stable/c/2969554bcfccb5c609f6b6cd4a014933f3a66dd0"
}
],
"title": "Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43022",
"datePublished": "2026-05-01T14:15:25.059Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-11-06T15:32:26.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46044 (GCVE-0-2026-46044)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi:ssif: Clean up kthread on errors
If an error occurs after the ssif kthread is created, but before the
main IPMI code starts the ssif interface, the ssif kthread will not
be stopped.
So make sure the kthread is stopped on an error condition if it is
running.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 259307074bfcf1ff88016e12c68f057aee6cb694 Version: 259307074bfcf1ff88016e12c68f057aee6cb694 Version: 259307074bfcf1ff88016e12c68f057aee6cb694 Version: 259307074bfcf1ff88016e12c68f057aee6cb694 Version: 259307074bfcf1ff88016e12c68f057aee6cb694 Version: 259307074bfcf1ff88016e12c68f057aee6cb694 Version: 259307074bfcf1ff88016e12c68f057aee6cb694 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:10.309Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_ssif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "549607af66a0efdb41307ba6343eed31de8b133e",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
},
{
"lessThan": "f2d0a3ede5ebf404d4c334a1f04ef439e0086857",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
},
{
"lessThan": "e662be2d0d05253d0fd7deda9771aa036c23393e",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
},
{
"lessThan": "d6855a3b15851061c817506492b6aa0b605cff1e",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
},
{
"lessThan": "858bc8b9edb6eaf0522900128bb9053e2df6b0f6",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
},
{
"lessThan": "800febc637d1c1974b1e899dea8a07e115d60766",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
},
{
"lessThan": "75c486cb1bcaa1a3ec3a6438498176a3a4998ae4",
"status": "affected",
"version": "259307074bfcf1ff88016e12c68f057aee6cb694",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_ssif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi:ssif: Clean up kthread on errors\n\nIf an error occurs after the ssif kthread is created, but before the\nmain IPMI code starts the ssif interface, the ssif kthread will not\nbe stopped.\n\nSo make sure the kthread is stopped on an error condition if it is\nrunning."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:13.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/549607af66a0efdb41307ba6343eed31de8b133e"
},
{
"url": "https://git.kernel.org/stable/c/f2d0a3ede5ebf404d4c334a1f04ef439e0086857"
},
{
"url": "https://git.kernel.org/stable/c/e662be2d0d05253d0fd7deda9771aa036c23393e"
},
{
"url": "https://git.kernel.org/stable/c/d6855a3b15851061c817506492b6aa0b605cff1e"
},
{
"url": "https://git.kernel.org/stable/c/858bc8b9edb6eaf0522900128bb9053e2df6b0f6"
},
{
"url": "https://git.kernel.org/stable/c/800febc637d1c1974b1e899dea8a07e115d60766"
},
{
"url": "https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4"
}
],
"title": "ipmi:ssif: Clean up kthread on errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46044",
"datePublished": "2026-05-27T12:56:59.663Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-10-21T12:41:13.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80643 (GCVE-0-2026-80643)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
EDAC/igen6: Fix call trace due to missing release()
When unloading the igen6_edac driver, there is a call trace:
Device '(null)' does not have a release() function, it is broken and must be fixed.
See Documentation/core-api/kobject.rst.
WARNING: drivers/base/core.c:2567 at device_release+0x84/0x90, CPU#5: rmmod/127209
...
RIP: 0010:device_release+0x84/0x90
Call Trace:
<TASK>
kobject_put+0x8c/0x220
put_device+0x17/0x30
igen6_unregister_mcis+0xa2/0xe0 [igen6_edac]
igen6_remove+0x82/0xb0 [igen6_edac]
...
Fix the call trace by providing empty release() functions for the
memory controller devices.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 10590a9d4f23e0a519730d79d39331df60ad2079 Version: 10590a9d4f23e0a519730d79d39331df60ad2079 Version: 10590a9d4f23e0a519730d79d39331df60ad2079 Version: 10590a9d4f23e0a519730d79d39331df60ad2079 Version: 10590a9d4f23e0a519730d79d39331df60ad2079 Version: 10590a9d4f23e0a519730d79d39331df60ad2079 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/edac/igen6_edac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be6059b0552d73a0b5430bc7a71a9c74f4d944e5",
"status": "affected",
"version": "10590a9d4f23e0a519730d79d39331df60ad2079",
"versionType": "git"
},
{
"lessThan": "fa9560b6d3f665eddf7a625adfc9af8c6980c3f5",
"status": "affected",
"version": "10590a9d4f23e0a519730d79d39331df60ad2079",
"versionType": "git"
},
{
"lessThan": "449ba210e6bee9ef6e69c6ab58198ffa5aa479ae",
"status": "affected",
"version": "10590a9d4f23e0a519730d79d39331df60ad2079",
"versionType": "git"
},
{
"lessThan": "9a84ced0243c74aa431ec287555054c69e6167d1",
"status": "affected",
"version": "10590a9d4f23e0a519730d79d39331df60ad2079",
"versionType": "git"
},
{
"lessThan": "a341302c5126ef96bb45286224d67ef60a24281e",
"status": "affected",
"version": "10590a9d4f23e0a519730d79d39331df60ad2079",
"versionType": "git"
},
{
"lessThan": "ab1f9d466c7d83ab0d2a529e07984e53b5960dcd",
"status": "affected",
"version": "10590a9d4f23e0a519730d79d39331df60ad2079",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/edac/igen6_edac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/igen6: Fix call trace due to missing release()\n\nWhen unloading the igen6_edac driver, there is a call trace:\n\n Device \u0027(null)\u0027 does not have a release() function, it is broken and must be fixed.\n See Documentation/core-api/kobject.rst.\n WARNING: drivers/base/core.c:2567 at device_release+0x84/0x90, CPU#5: rmmod/127209\n ...\n RIP: 0010:device_release+0x84/0x90\n Call Trace:\n \u003cTASK\u003e\n kobject_put+0x8c/0x220\n put_device+0x17/0x30\n igen6_unregister_mcis+0xa2/0xe0 [igen6_edac]\n igen6_remove+0x82/0xb0 [igen6_edac]\n ...\n\nFix the call trace by providing empty release() functions for the\nmemory controller devices."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:51.067Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be6059b0552d73a0b5430bc7a71a9c74f4d944e5"
},
{
"url": "https://git.kernel.org/stable/c/fa9560b6d3f665eddf7a625adfc9af8c6980c3f5"
},
{
"url": "https://git.kernel.org/stable/c/449ba210e6bee9ef6e69c6ab58198ffa5aa479ae"
},
{
"url": "https://git.kernel.org/stable/c/9a84ced0243c74aa431ec287555054c69e6167d1"
},
{
"url": "https://git.kernel.org/stable/c/a341302c5126ef96bb45286224d67ef60a24281e"
},
{
"url": "https://git.kernel.org/stable/c/ab1f9d466c7d83ab0d2a529e07984e53b5960dcd"
}
],
"title": "EDAC/igen6: Fix call trace due to missing release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80643",
"datePublished": "2026-08-28T06:48:54.439Z",
"dateReserved": "2026-08-26T14:34:25.778Z",
"dateUpdated": "2026-10-30T12:30:51.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99098 (GCVE-0-2026-99098)
Vulnerability from cvelistv5
Published
2026-10-26 14:52
Modified
2026-10-26 14:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix buffer overflow in inline mode with large tag size
In inline mode, dm_integrity_check and dm_integrity_inline_recheck
compute the checksum of each block into an on-stack buffer of
HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result
with zeroes up to the tag size, so if the tag size is larger than
HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With
CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the
first read.
Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5
("dm integrity: fix a crash with unusually large tag size") did for
integrity_metadata.
Note that this is not a security bug because the buffer overflow can only
be triggered by root.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c7aad85aeb9e28386672e3a009aa2e61f751b86",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
},
{
"lessThan": "4f0ee735dc68e3e6c4dd9a666d7f7047163c4165",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
},
{
"lessThan": "f49cd7820cd0a96f20e1aa2708adb002124e38a7",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
},
{
"lessThan": "764b683a6180fd72c931c13fea98d383506a3475",
"status": "affected",
"version": "fb0987682c629c1d2c476f35f6fde405a5e304a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix buffer overflow in inline mode with large tag size\n\nIn inline mode, dm_integrity_check and dm_integrity_inline_recheck\ncompute the checksum of each block into an on-stack buffer of\nHASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result\nwith zeroes up to the tag size, so if the tag size is larger than\nHASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With\nCONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the\nfirst read.\n\nEnlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5\n(\"dm integrity: fix a crash with unusually large tag size\") did for\nintegrity_metadata.\n\nNote that this is not a security bug because the buffer overflow can only\nbe triggered by root."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:52:04.416Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c7aad85aeb9e28386672e3a009aa2e61f751b86"
},
{
"url": "https://git.kernel.org/stable/c/4f0ee735dc68e3e6c4dd9a666d7f7047163c4165"
},
{
"url": "https://git.kernel.org/stable/c/f49cd7820cd0a96f20e1aa2708adb002124e38a7"
},
{
"url": "https://git.kernel.org/stable/c/764b683a6180fd72c931c13fea98d383506a3475"
}
],
"title": "dm-integrity: fix buffer overflow in inline mode with large tag size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99098",
"datePublished": "2026-10-26T14:52:04.416Z",
"dateReserved": "2026-09-25T10:25:14.391Z",
"dateUpdated": "2026-10-26T14:52:04.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43346 (GCVE-0-2026-43346)
Vulnerability from cvelistv5
Published
2026-05-08 13:39
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: ptp: don't WARN when controlling PF is unavailable
In VFIO passthrough setups, it is possible to pass through only a PF
which doesn't own the source timer. In that case the PTP controlling PF
(adapter->ctrl_pf) is never initialized in the VM, so ice_get_ctrl_ptp()
returns NULL and triggers WARN_ON() in ice_ptp_setup_pf().
Since this is an expected behavior in that configuration, replace
WARN_ON() with an informational message and return -EOPNOTSUPP.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:36:13.070535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:49.943Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "228497715a162d040df1617e62c3b7d0df54b235",
"status": "affected",
"version": "2f59743be4d9568cad2d9cf697d1b897975421ed",
"versionType": "git"
},
{
"lessThan": "e19675b384e9dcaca1bd5e4a67b8ad136eccfbe8",
"status": "affected",
"version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
"versionType": "git"
},
{
"lessThan": "c73f365707d3b1b78b7d16e1f029020d1ae50d0f",
"status": "affected",
"version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
"versionType": "git"
},
{
"lessThan": "bb3f21edc7056cdf44a7f7bd7ba65af40741838c",
"status": "affected",
"version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: ptp: don\u0027t WARN when controlling PF is unavailable\n\nIn VFIO passthrough setups, it is possible to pass through only a PF\nwhich doesn\u0027t own the source timer. In that case the PTP controlling PF\n(adapter-\u003ectrl_pf) is never initialized in the VM, so ice_get_ctrl_ptp()\nreturns NULL and triggers WARN_ON() in ice_ptp_setup_pf().\n\nSince this is an expected behavior in that configuration, replace\nWARN_ON() with an informational message and return -EOPNOTSUPP."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:41.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/228497715a162d040df1617e62c3b7d0df54b235"
},
{
"url": "https://git.kernel.org/stable/c/e19675b384e9dcaca1bd5e4a67b8ad136eccfbe8"
},
{
"url": "https://git.kernel.org/stable/c/c73f365707d3b1b78b7d16e1f029020d1ae50d0f"
},
{
"url": "https://git.kernel.org/stable/c/bb3f21edc7056cdf44a7f7bd7ba65af40741838c"
}
],
"title": "ice: ptp: don\u0027t WARN when controlling PF is unavailable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43346",
"datePublished": "2026-05-08T13:39:31.930Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-11-06T15:42:49.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98043 (GCVE-0-2026-98043)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't infer non-NULL from a pointer with an unbounded offset
reg_not_null() decides that a register holds a non-NULL value by
looking at its type alone. For pointer types that allow arithmetic the
type only guarantees a non-NULL base, in case of an unbound offset
the runtime offset value might still add up to NULL.
Consider the followng program:
r6 = bpf_map_lookup_elem(map, &0); /* present */
if (r6 == 0) return 0;
r7 = bpf_map_lookup_elem(map, &1); /* absent, NULL at runtime */
r8 = r7;
r8 -= r6; /* pointer - pointer: unknown scalar, -r6 */
r8 <<= 1;
r8 >>= 1; /* any non-negative offset is accepted by */
/* check_reg_sane_offset_ptr() */
r6 += r8; /* verifier: map value; runtime: zero */
if (r7 != r6) return 0;
*(u8 *)(r7 + 0); /* r7 is inferred non-NULL, both are zero */
At runtime both registers are zero, the comparison is true and the
load faults with NULL pointer dereference.
Require the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8b414dbe97fcefd116e5a620c3bd9993014aa4ce",
"status": "affected",
"version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
"versionType": "git"
},
{
"lessThan": "019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae",
"status": "affected",
"version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
"versionType": "git"
},
{
"lessThan": "65bea674f43c09c0eda033a140dfac6a2842a19f",
"status": "affected",
"version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
"versionType": "git"
},
{
"lessThan": "cb6642048739bf4ee5aa09fe465511f1e87caa63",
"status": "affected",
"version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
"versionType": "git"
},
{
"lessThan": "67b529f521a6676cdfc78b91b0217d7eaa84216b",
"status": "affected",
"version": "cac616db39c207dc63465a4e05c6ce0e60b2cce4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don\u0027t infer non-NULL from a pointer with an unbounded offset\n\nreg_not_null() decides that a register holds a non-NULL value by\nlooking at its type alone. For pointer types that allow arithmetic the\ntype only guarantees a non-NULL base, in case of an unbound offset\nthe runtime offset value might still add up to NULL.\nConsider the followng program:\n\n r6 = bpf_map_lookup_elem(map, \u00260); /* present */\n if (r6 == 0) return 0;\n r7 = bpf_map_lookup_elem(map, \u00261); /* absent, NULL at runtime */\n r8 = r7;\n r8 -= r6; /* pointer - pointer: unknown scalar, -r6 */\n r8 \u003c\u003c= 1;\n r8 \u003e\u003e= 1; /* any non-negative offset is accepted by */\n /* check_reg_sane_offset_ptr() */\n r6 += r8; /* verifier: map value; runtime: zero */\n if (r7 != r6) return 0;\n *(u8 *)(r7 + 0); /* r7 is inferred non-NULL, both are zero */\n\nAt runtime both registers are zero, the comparison is true and the\nload faults with NULL pointer dereference.\n\nRequire the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:11.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b414dbe97fcefd116e5a620c3bd9993014aa4ce"
},
{
"url": "https://git.kernel.org/stable/c/019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae"
},
{
"url": "https://git.kernel.org/stable/c/65bea674f43c09c0eda033a140dfac6a2842a19f"
},
{
"url": "https://git.kernel.org/stable/c/cb6642048739bf4ee5aa09fe465511f1e87caa63"
},
{
"url": "https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b"
}
],
"title": "bpf: Don\u0027t infer non-NULL from a pointer with an unbounded offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98043",
"datePublished": "2026-09-25T10:23:54.865Z",
"dateReserved": "2026-09-25T10:19:56.071Z",
"dateUpdated": "2026-10-21T12:54:11.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68426 (GCVE-0-2026-68426)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix stale skb->prev after async crypto steals a GSO segment
skb_gso_segment() leaves the segment list head with ->prev pointing at
the last segment, an invariant validate_xmit_skb_list() relies on when
it sets its tail pointer (tail = skb->prev).
When validate_xmit_xfrm() walks a GSO list and some segments are stolen
by async crypto (->xmit() returns -EINPROGRESS), those segments are
unlinked from the list but the head ->prev is never updated. If the
last segment is the one stolen, the returned head still has ->prev
pointing at it, even though it is now owned by the crypto engine and may
be freed. validate_xmit_skb_list() later does tail->next = skb, writing
through that stale pointer -- a use-after-free.
Repoint skb->prev at the last retained segment before returning.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e Version: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e Version: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e Version: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e Version: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e Version: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:46.371818Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e695742396be18d5291c310a3d7c450959d647a",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "4927ab8a8acc8db4fad33e803d1d35e0b16cef83",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "b58731e0570bfd3989999fc2baf9ee4fecd5bec6",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "33e1b0d25ca0d2818c635ff80e6aa0d295e08a98",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "bbca7cc3b2b4b10afbfee99b81d9ee78f5423046",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "3f4c3919baf0944ad96580467c302bc6c7758b00",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated. If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed. validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer\u0027s packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so -\u003exmit() returns -EINPROGRESS routinely, and packet volume advances xo-\u003eseq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb-\u003eprev, and the subsequent tail-\u003enext write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders \u2014 no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker\u0027s packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale -\u003eprev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail-\u003enext = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:35.226Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e695742396be18d5291c310a3d7c450959d647a"
},
{
"url": "https://git.kernel.org/stable/c/4927ab8a8acc8db4fad33e803d1d35e0b16cef83"
},
{
"url": "https://git.kernel.org/stable/c/b58731e0570bfd3989999fc2baf9ee4fecd5bec6"
},
{
"url": "https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98"
},
{
"url": "https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046"
},
{
"url": "https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00"
}
],
"title": "xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68426",
"datePublished": "2026-08-10T12:04:46.945Z",
"dateReserved": "2026-07-30T09:28:09.392Z",
"dateUpdated": "2026-10-30T12:28:35.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99121 (GCVE-0-2026-99121)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: avoid divide by zero in fib_rebalance
fib_rebalance() computes the total eligible nexthop weight in one pass
and programs upper bounds in a second pass. A concurrent change to
ignore_routes_with_linkdown can make the first pass return zero while
the second pass sees an eligible nexthop, resulting in division by zero.
If the first pass reports a zero total, set each nexthop upper bound to
-1 and skip the division. This matches the IPv6 fix in commit
d2c26c2911dd ("ipv6: avoid divide by zero in rt6_multipath_rebalance")
and preserves the lock-free rebalance path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 Version: 0e884c78ee19e902f300ed147083c28a0c6302f0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "baf3a767b2845eb8e68f056ee4aa5b41b151e990",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "f655a26490e705ec76a79db7f412847fda342b39",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "7c68f4de5090b17b63b9a0a3b01b3807e01a296a",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "226a974054acbd892560bfa67f0ae8ffe271a736",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "0800c92ca5d1983df6843a5435299978901d1d02",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "5dac5c7ba8f5f3fb4bf29f2a2c3cb552f5b83c8f",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "d5520e815c4b1427104ce1428ee23821f2aa824d",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
},
{
"lessThan": "5046d2880fec7d49ebed2fd2866747ee1d06ad71",
"status": "affected",
"version": "0e884c78ee19e902f300ed147083c28a0c6302f0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_semantics.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: avoid divide by zero in fib_rebalance\n\nfib_rebalance() computes the total eligible nexthop weight in one pass\nand programs upper bounds in a second pass. A concurrent change to\nignore_routes_with_linkdown can make the first pass return zero while\nthe second pass sees an eligible nexthop, resulting in division by zero.\n\nIf the first pass reports a zero total, set each nexthop upper bound to\n-1 and skip the division. This matches the IPv6 fix in commit\nd2c26c2911dd (\"ipv6: avoid divide by zero in rt6_multipath_rebalance\")\nand preserves the lock-free rebalance path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:56.754Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/baf3a767b2845eb8e68f056ee4aa5b41b151e990"
},
{
"url": "https://git.kernel.org/stable/c/f655a26490e705ec76a79db7f412847fda342b39"
},
{
"url": "https://git.kernel.org/stable/c/7c68f4de5090b17b63b9a0a3b01b3807e01a296a"
},
{
"url": "https://git.kernel.org/stable/c/226a974054acbd892560bfa67f0ae8ffe271a736"
},
{
"url": "https://git.kernel.org/stable/c/0800c92ca5d1983df6843a5435299978901d1d02"
},
{
"url": "https://git.kernel.org/stable/c/5dac5c7ba8f5f3fb4bf29f2a2c3cb552f5b83c8f"
},
{
"url": "https://git.kernel.org/stable/c/d5520e815c4b1427104ce1428ee23821f2aa824d"
},
{
"url": "https://git.kernel.org/stable/c/5046d2880fec7d49ebed2fd2866747ee1d06ad71"
}
],
"title": "ipv4: avoid divide by zero in fib_rebalance",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99121",
"datePublished": "2026-10-28T10:34:37.082Z",
"dateReserved": "2026-09-25T10:25:14.393Z",
"dateUpdated": "2026-10-30T12:41:56.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74559 (GCVE-0-2026-74559)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: drain continuation descs after overflow in xsk_build_skb()
Fix generic xmit path multi-buffer logic when packets are either too big
(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is
included in fragmented packet. Introduce xdp_sock::drain_cont and act
upon this flag - when it is set, keep on consuming descriptors from
AF_XDP Tx ring and put them directly onto Cq. Previously these
descriptors were silently lost and could never be reached again.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecd0d1cde0478c232a867f14ec99cf97aff5eb30",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "ceb00cb87a22c42d20c39336213db2b843ca9e34",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "5e94d74e4f3baebaa083288f33b4be7ce0a34982",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
},
{
"lessThan": "bd44a6dcd4248883de90f5dad53ae80066e27096",
"status": "affected",
"version": "cf24f5a5feeaae34c1a34d1e04f8ac697290427a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/xdp_sock.h",
"net/xdp/xsk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: drain continuation descs after overflow in xsk_build_skb()\n\nFix generic xmit path multi-buffer logic when packets are either too big\n(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is\nincluded in fragmented packet. Introduce xdp_sock::drain_cont and act\nupon this flag - when it is set, keep on consuming descriptors from\nAF_XDP Tx ring and put them directly onto Cq. Previously these\ndescriptors were silently lost and could never be reached again."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:57.288Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecd0d1cde0478c232a867f14ec99cf97aff5eb30"
},
{
"url": "https://git.kernel.org/stable/c/ceb00cb87a22c42d20c39336213db2b843ca9e34"
},
{
"url": "https://git.kernel.org/stable/c/5e94d74e4f3baebaa083288f33b4be7ce0a34982"
},
{
"url": "https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096"
}
],
"title": "xsk: drain continuation descs after overflow in xsk_build_skb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74559",
"datePublished": "2026-08-15T12:28:03.279Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-10-21T12:45:57.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97424 (GCVE-0-2026-97424)
Vulnerability from cvelistv5
Published
2026-09-24 16:03
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
cp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but
released in gfx_v9_0_hw_fini(), so the put site has to query
amdgpu_irq_enabled() because the get is skipped on SR-IOV VF.
ras_late_init / ras_fini have no suspend counterpart, so move the
put to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a
matching ras_suspend callback that is invoked from
amdgpu_ras_suspend() before disable_all_features(). The get and
put now sit in the same place and check the same condition (not
VF, funcs registered), no refcount querying needed.
An active flag gates ras_fini so the
suspend-then-unload-without-resume path falls into
amdgpu_ras_block_late_fini_default() instead of double-releasing
what ras_suspend already cleaned up.
Drop the cp_ecc_error_irq put from gfx_v9_0_hw_fini(). gfx_v8_0
manages cp_ecc_error_irq locally and is unaffected; no other GFX
generation has this IRQ.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h",
"drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h",
"drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c1f2f34d681a0b354e1218b83245d1f2d2139a8d",
"status": "affected",
"version": "760a1d55344d823287850466db893ed77e948803",
"versionType": "git"
},
{
"lessThan": "5b761927dbb170df4716d9c0ef85e178a1856e64",
"status": "affected",
"version": "760a1d55344d823287850466db893ed77e948803",
"versionType": "git"
},
{
"lessThan": "001824103f2fe6ffd2380afddf81f43b446035b2",
"status": "affected",
"version": "760a1d55344d823287850466db893ed77e948803",
"versionType": "git"
},
{
"lessThan": "e3829992dd9fa0a82511af4f01733fc854cd15a5",
"status": "affected",
"version": "760a1d55344d823287850466db893ed77e948803",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h",
"drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h",
"drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq\n\ncp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but\nreleased in gfx_v9_0_hw_fini(), so the put site has to query\namdgpu_irq_enabled() because the get is skipped on SR-IOV VF.\n\nras_late_init / ras_fini have no suspend counterpart, so move the\nput to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a\nmatching ras_suspend callback that is invoked from\namdgpu_ras_suspend() before disable_all_features(). The get and\nput now sit in the same place and check the same condition (not\nVF, funcs registered), no refcount querying needed.\n\nAn active flag gates ras_fini so the\nsuspend-then-unload-without-resume path falls into\namdgpu_ras_block_late_fini_default() instead of double-releasing\nwhat ras_suspend already cleaned up.\n\nDrop the cp_ecc_error_irq put from gfx_v9_0_hw_fini(). gfx_v8_0\nmanages cp_ecc_error_irq locally and is unaffected; no other GFX\ngeneration has this IRQ."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:45.222Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c1f2f34d681a0b354e1218b83245d1f2d2139a8d"
},
{
"url": "https://git.kernel.org/stable/c/5b761927dbb170df4716d9c0ef85e178a1856e64"
},
{
"url": "https://git.kernel.org/stable/c/001824103f2fe6ffd2380afddf81f43b446035b2"
},
{
"url": "https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5"
}
],
"title": "drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97424",
"datePublished": "2026-09-24T16:03:37.028Z",
"dateReserved": "2026-09-24T14:53:16.868Z",
"dateUpdated": "2026-10-21T12:52:45.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68211 (GCVE-0-2026-68211)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: stm32-dcmipp: Return queued buffers on start_streaming() failure
The vb2 framework hands buffers to the driver via buf_queue() before
calling start_streaming(). If start_streaming() returns an error
without first returning those buffers via vb2_buffer_done(),
vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
buffers leak.
dcmipp_bytecap_start_streaming() returned -EINVAL when the source
subdevice could not be resolved from the media graph, before
pm_runtime_resume_and_get() and media_pipeline_start() had been called.
The remaining error paths already converge on the err_buffer_done
label, which calls dcmipp_bytecap_all_buffers_done(...,
VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate
err_pm_put / err_media_pipeline_stop labels are skipped, which is
correct because nothing they would undo has happened yet.
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
Return queued buffers on start_streaming() failure").
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c1800238a60b0584b1924f11ce38ec8aba533238",
"status": "affected",
"version": "28e0f37722965fa150af31d82101c95fd21aef60",
"versionType": "git"
},
{
"lessThan": "ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f",
"status": "affected",
"version": "28e0f37722965fa150af31d82101c95fd21aef60",
"versionType": "git"
},
{
"lessThan": "624af2d4b5e9d3dd366538e4fb4a2a037792a7e3",
"status": "affected",
"version": "28e0f37722965fa150af31d82101c95fd21aef60",
"versionType": "git"
},
{
"lessThan": "ffc8eec06378a340d708c889184ab3e14b57d540",
"status": "affected",
"version": "28e0f37722965fa150af31d82101c95fd21aef60",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stm32-dcmipp: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming(). If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\ndcmipp_bytecap_start_streaming() returned -EINVAL when the source\nsubdevice could not be resolved from the media graph, before\npm_runtime_resume_and_get() and media_pipeline_start() had been called.\nThe remaining error paths already converge on the err_buffer_done\nlabel, which calls dcmipp_bytecap_all_buffers_done(...,\nVB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate\nerr_pm_put / err_media_pipeline_stop labels are skipped, which is\ncorrect because nothing they would undo has happened yet.\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:33.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c1800238a60b0584b1924f11ce38ec8aba533238"
},
{
"url": "https://git.kernel.org/stable/c/ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f"
},
{
"url": "https://git.kernel.org/stable/c/624af2d4b5e9d3dd366538e4fb4a2a037792a7e3"
},
{
"url": "https://git.kernel.org/stable/c/ffc8eec06378a340d708c889184ab3e14b57d540"
}
],
"title": "media: stm32-dcmipp: Return queued buffers on start_streaming() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68211",
"datePublished": "2026-08-10T12:00:30.502Z",
"dateReserved": "2026-07-30T09:28:09.375Z",
"dateUpdated": "2026-10-21T12:43:33.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68291 (GCVE-0-2026-68291)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix max_vport related crash on allocation error during init
Set adapter->max_vports only after successful allocation of vports, netdevs
and vport_config buffers. This fixes possible crashes on reset or rmmod,
following failed allocation on init
[ 305.981402] idpf 0000:83:00.0: enabling device (0100 -> 0102)
[ 305.994464] idpf 0000:83:00.0: Device HW Reset initiated
[ 320.416872] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 320.416918] #PF: supervisor read access in kernel mode
[ 320.416942] #PF: error_code(0x0000) - not-present page
[ 320.416963] PGD 2099657067 P4D 0
[ 320.416983] Oops: Oops: 0000 [#1] SMP NOPTI
...
[ 320.417093] RIP: 0010:idpf_remove+0x118/0x200 [idpf]
[ 320.417130] Code: 8b bb 98 09 00 00 e8 17 0f 5b e5 48 8b bb e8 08 00 00 e8 0b 0f 5b e5 66 83 bb 28 06 00 00 00 48 8b bb 20 06 00 00 74 49 31 ed <48> 8b 04 ef 48 85 c0 74 2f 48 8b 78 20 e8 66 58 91 e5 48 8b 83 20
[ 320.417183] RSP: 0018:ff7322212903fdb8 EFLAGS: 00010246
[ 320.417205] RAX: 0000000000000000 RBX: ff4463de40300000 RCX: ff7322212903fd4c
[ 320.417228] RDX: 0000000000000001 RSI: ffffffffa7f7d100 RDI: 0000000000000000
[ 320.417250] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 320.417272] R10: 0000000000000001 R11: ff4463de3a638f58 R12: ff4463be89ac7000
[ 320.417294] R13: ff4463be89ac7198 R14: ff4463be94fc7198 R15: ffffffffc0f10f20
[ 320.417317] FS: 00007f963c0e6740(0000) GS:ff4463fdd65d8000(0000) knlGS:0000000000000000
[ 320.417342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 320.417362] CR2: 0000000000000000 CR3: 00000020ba674002 CR4: 0000000000773ef0
[ 320.417385] PKRU: 55555554
[ 320.417398] Call Trace:
[ 320.417412] <TASK>
[ 320.417429] pci_device_remove+0x42/0xb0
[ 320.417459] device_release_driver_internal+0x1a9/0x210
[ 320.417492] driver_detach+0x4b/0x90
[ 320.417516] bus_remove_driver+0x70/0x100
[ 320.417539] pci_unregister_driver+0x2e/0xb0
[ 320.417564] __do_sys_delete_module.constprop.0+0x190/0x2f0
[ 320.417592] ? kmem_cache_free+0x31e/0x550
[ 320.417619] ? lockdep_hardirqs_on_prepare+0xde/0x190
[ 320.417644] ? do_syscall_64+0x38/0x6b0
[ 320.417665] do_syscall_64+0xc8/0x6b0
[ 320.417683] ? clear_bhb_loop+0x30/0x80
[ 320.417706] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 320.417727] RIP: 0033:0x7f963bb30beb
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "993571d207f5f4775b92df89788570468ffb9cdd",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
},
{
"lessThan": "08fffd2881e2804d55bc74f178e2843e8832b396",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
},
{
"lessThan": "9fbe22b7aff0a65984d78ee6b93e2f8179abd1f5",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
},
{
"lessThan": "237f1f7653b8729169af11fae79f01b90d00b87e",
"status": "affected",
"version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix max_vport related crash on allocation error during init\n\nSet adapter-\u003emax_vports only after successful allocation of vports, netdevs\nand vport_config buffers. This fixes possible crashes on reset or rmmod,\nfollowing failed allocation on init\n\n[ 305.981402] idpf 0000:83:00.0: enabling device (0100 -\u003e 0102)\n[ 305.994464] idpf 0000:83:00.0: Device HW Reset initiated\n[ 320.416872] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 320.416918] #PF: supervisor read access in kernel mode\n[ 320.416942] #PF: error_code(0x0000) - not-present page\n[ 320.416963] PGD 2099657067 P4D 0\n[ 320.416983] Oops: Oops: 0000 [#1] SMP NOPTI\n...\n[ 320.417093] RIP: 0010:idpf_remove+0x118/0x200 [idpf]\n[ 320.417130] Code: 8b bb 98 09 00 00 e8 17 0f 5b e5 48 8b bb e8 08 00 00 e8 0b 0f 5b e5 66 83 bb 28 06 00 00 00 48 8b bb 20 06 00 00 74 49 31 ed \u003c48\u003e 8b 04 ef 48 85 c0 74 2f 48 8b 78 20 e8 66 58 91 e5 48 8b 83 20\n[ 320.417183] RSP: 0018:ff7322212903fdb8 EFLAGS: 00010246\n[ 320.417205] RAX: 0000000000000000 RBX: ff4463de40300000 RCX: ff7322212903fd4c\n[ 320.417228] RDX: 0000000000000001 RSI: ffffffffa7f7d100 RDI: 0000000000000000\n[ 320.417250] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n[ 320.417272] R10: 0000000000000001 R11: ff4463de3a638f58 R12: ff4463be89ac7000\n[ 320.417294] R13: ff4463be89ac7198 R14: ff4463be94fc7198 R15: ffffffffc0f10f20\n[ 320.417317] FS: 00007f963c0e6740(0000) GS:ff4463fdd65d8000(0000) knlGS:0000000000000000\n[ 320.417342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 320.417362] CR2: 0000000000000000 CR3: 00000020ba674002 CR4: 0000000000773ef0\n[ 320.417385] PKRU: 55555554\n[ 320.417398] Call Trace:\n[ 320.417412] \u003cTASK\u003e\n[ 320.417429] pci_device_remove+0x42/0xb0\n[ 320.417459] device_release_driver_internal+0x1a9/0x210\n[ 320.417492] driver_detach+0x4b/0x90\n[ 320.417516] bus_remove_driver+0x70/0x100\n[ 320.417539] pci_unregister_driver+0x2e/0xb0\n[ 320.417564] __do_sys_delete_module.constprop.0+0x190/0x2f0\n[ 320.417592] ? kmem_cache_free+0x31e/0x550\n[ 320.417619] ? lockdep_hardirqs_on_prepare+0xde/0x190\n[ 320.417644] ? do_syscall_64+0x38/0x6b0\n[ 320.417665] do_syscall_64+0xc8/0x6b0\n[ 320.417683] ? clear_bhb_loop+0x30/0x80\n[ 320.417706] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 320.417727] RIP: 0033:0x7f963bb30beb"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:45.336Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/993571d207f5f4775b92df89788570468ffb9cdd"
},
{
"url": "https://git.kernel.org/stable/c/08fffd2881e2804d55bc74f178e2843e8832b396"
},
{
"url": "https://git.kernel.org/stable/c/9fbe22b7aff0a65984d78ee6b93e2f8179abd1f5"
},
{
"url": "https://git.kernel.org/stable/c/237f1f7653b8729169af11fae79f01b90d00b87e"
}
],
"title": "idpf: fix max_vport related crash on allocation error during init",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68291",
"datePublished": "2026-08-10T12:02:24.402Z",
"dateReserved": "2026-07-30T09:28:09.380Z",
"dateUpdated": "2026-10-21T12:43:45.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46148 (GCVE-0-2026-46148)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: microchip-core-qspi: control built-in cs manually
The coreQSPI IP supports only a single chip select, which is
automagically operated by the hardware - set low when the transmit
buffer first gets written to and set high when the number of bytes
written to the TOTALBYTES field of the FRAMES register have been sent on
the bus. Additional devices must use GPIOs for their chip selects.
It was reported to me that if there are two devices attached to this
QSPI controller that the in-built chip select is set low while linux
tries to access the device attached to the GPIO.
This went undetected as the boards that connected multiple devices to
the SPI controller all exclusively used GPIOs for chip selects, not
relying on the built-in chip select at all. It turns out that this was
because the built-in chip select, when controlled automagically, is set
low when active and high when inactive, thereby ruling out its use for
active-high devices or devices that need to transmit with the chip
select disabled.
Modify the driver so that it controls chip select directly, retaining
the behaviour for mem_ops of setting the chip select active for the
entire duration of the transfer in the exec_op callback. For regular
transfers, implement the set_cs callback for the core to use.
As part of this, the existing setup callback, mchp_coreqspi_setup_op(),
is removed. Modifying the CLKIDLE field is not safe to do during
operation when there are multiple devices, so this code is removed
entirely. Setting the MASTER and ENABLE fields is something that can be
done once at probe, it doesn't need to be re-run for each device.
Instead the new setup callback sets the built-in chip select to its
inactive state for active-low devices, as the reset value of the chip
select in software controlled mode is low.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8596124c4c1bc7561454cee0463c16eca70b5d25 Version: 8596124c4c1bc7561454cee0463c16eca70b5d25 Version: 8596124c4c1bc7561454cee0463c16eca70b5d25 Version: 8596124c4c1bc7561454cee0463c16eca70b5d25 Version: 8596124c4c1bc7561454cee0463c16eca70b5d25 Version: 8596124c4c1bc7561454cee0463c16eca70b5d25 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-microchip-core-qspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06b14dd2393933e8cd574157369e551bd615b52a",
"status": "affected",
"version": "8596124c4c1bc7561454cee0463c16eca70b5d25",
"versionType": "git"
},
{
"lessThan": "783dc000b8be6d18713bde4d2705e168f2a61782",
"status": "affected",
"version": "8596124c4c1bc7561454cee0463c16eca70b5d25",
"versionType": "git"
},
{
"lessThan": "244fc8942123afe753ae8962407fb312a1d96a07",
"status": "affected",
"version": "8596124c4c1bc7561454cee0463c16eca70b5d25",
"versionType": "git"
},
{
"lessThan": "998f43196d732f20f9b71eb6ebd973736c9fa911",
"status": "affected",
"version": "8596124c4c1bc7561454cee0463c16eca70b5d25",
"versionType": "git"
},
{
"lessThan": "ee3c99aa102212ad59dc2c19595515c4a6729307",
"status": "affected",
"version": "8596124c4c1bc7561454cee0463c16eca70b5d25",
"versionType": "git"
},
{
"lessThan": "7672749e1496215e8683ce57cf323119033954cf",
"status": "affected",
"version": "8596124c4c1bc7561454cee0463c16eca70b5d25",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-microchip-core-qspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: microchip-core-qspi: control built-in cs manually\n\nThe coreQSPI IP supports only a single chip select, which is\nautomagically operated by the hardware - set low when the transmit\nbuffer first gets written to and set high when the number of bytes\nwritten to the TOTALBYTES field of the FRAMES register have been sent on\nthe bus. Additional devices must use GPIOs for their chip selects.\nIt was reported to me that if there are two devices attached to this\nQSPI controller that the in-built chip select is set low while linux\ntries to access the device attached to the GPIO.\n\nThis went undetected as the boards that connected multiple devices to\nthe SPI controller all exclusively used GPIOs for chip selects, not\nrelying on the built-in chip select at all. It turns out that this was\nbecause the built-in chip select, when controlled automagically, is set\nlow when active and high when inactive, thereby ruling out its use for\nactive-high devices or devices that need to transmit with the chip\nselect disabled.\n\nModify the driver so that it controls chip select directly, retaining\nthe behaviour for mem_ops of setting the chip select active for the\nentire duration of the transfer in the exec_op callback. For regular\ntransfers, implement the set_cs callback for the core to use.\n\nAs part of this, the existing setup callback, mchp_coreqspi_setup_op(),\nis removed. Modifying the CLKIDLE field is not safe to do during\noperation when there are multiple devices, so this code is removed\nentirely. Setting the MASTER and ENABLE fields is something that can be\ndone once at probe, it doesn\u0027t need to be re-run for each device.\nInstead the new setup callback sets the built-in chip select to its\ninactive state for active-low devices, as the reset value of the chip\nselect in software controlled mode is low."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:00.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06b14dd2393933e8cd574157369e551bd615b52a"
},
{
"url": "https://git.kernel.org/stable/c/783dc000b8be6d18713bde4d2705e168f2a61782"
},
{
"url": "https://git.kernel.org/stable/c/244fc8942123afe753ae8962407fb312a1d96a07"
},
{
"url": "https://git.kernel.org/stable/c/998f43196d732f20f9b71eb6ebd973736c9fa911"
},
{
"url": "https://git.kernel.org/stable/c/ee3c99aa102212ad59dc2c19595515c4a6729307"
},
{
"url": "https://git.kernel.org/stable/c/7672749e1496215e8683ce57cf323119033954cf"
}
],
"title": "spi: microchip-core-qspi: control built-in cs manually",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46148",
"datePublished": "2026-05-28T09:36:04.805Z",
"dateReserved": "2026-05-13T15:03:33.101Z",
"dateUpdated": "2026-10-30T12:26:00.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99123 (GCVE-0-2026-99123)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: validate packet source for connected sockets
virtio_transport_recv_pkt() looks up sockets first by the full source and
destination tuple, then by destination only in the bound table. The
fallback is needed for listening and connecting sockets, but sockets remain
in the bound table after connect(), so it can also return a non-listening
socket.
The fallback does not validate the source address. In TCP_SYN_SENT, a
RESPONSE from an unrelated source can transition the victim socket to
TCP_ESTABLISHED while its stored remote address remains unchanged.
Subsequent RW packets from that source are delivered through the same
destination-only fallback.
This was reproduced with capability-empty processes under different UIDs.
The attacker discovered the target tuple through unprivileged AF_VSOCK
sock_diag and caused the victim socket to read 16 attacker-chosen bytes;
the intended peer-side socket read 0 of those 16 bytes.
Add vsock_check_source() to validate the transport, source port and source
CID against the peer stored in a non-listening socket. The local transport
is the CID exception because its packets are generated internally with
VMADDR_CID_LOCAL as their source, including connections using CID aliases.
Use the helper after lock_sock() in the virtio receive path.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06a8fc78367d070720af960dcecec917d3ae5f3b Version: 06a8fc78367d070720af960dcecec917d3ae5f3b Version: 06a8fc78367d070720af960dcecec917d3ae5f3b Version: 06a8fc78367d070720af960dcecec917d3ae5f3b Version: 06a8fc78367d070720af960dcecec917d3ae5f3b Version: 06a8fc78367d070720af960dcecec917d3ae5f3b Version: 06a8fc78367d070720af960dcecec917d3ae5f3b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/af_vsock.h",
"net/vmw_vsock/af_vsock.c",
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bda841af86cdfe7fcf4a2f4db22e27f1b852b1ff",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
},
{
"lessThan": "c0a3a786a5e8b5007d6a3c34721ab052399ab2ad",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
},
{
"lessThan": "f77fb90edca5385d0eecbfd6d2c8ef60afff24a9",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
},
{
"lessThan": "ec231dd3b14e541ba1c4f842a7d152fb61037333",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
},
{
"lessThan": "6cd829de69efd9ed3a53aa2421004a0396eb2bd7",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
},
{
"lessThan": "e9bf92de436ba55f33eaa55d7008e68551123cfd",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
},
{
"lessThan": "dee44f41f206becb41c492899c1996cfd7f82a1b",
"status": "affected",
"version": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/af_vsock.h",
"net/vmw_vsock/af_vsock.c",
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: validate packet source for connected sockets\n\nvirtio_transport_recv_pkt() looks up sockets first by the full source and\ndestination tuple, then by destination only in the bound table. The\nfallback is needed for listening and connecting sockets, but sockets remain\nin the bound table after connect(), so it can also return a non-listening\nsocket.\n\nThe fallback does not validate the source address. In TCP_SYN_SENT, a\nRESPONSE from an unrelated source can transition the victim socket to\nTCP_ESTABLISHED while its stored remote address remains unchanged.\nSubsequent RW packets from that source are delivered through the same\ndestination-only fallback.\n\nThis was reproduced with capability-empty processes under different UIDs.\nThe attacker discovered the target tuple through unprivileged AF_VSOCK\nsock_diag and caused the victim socket to read 16 attacker-chosen bytes;\nthe intended peer-side socket read 0 of those 16 bytes.\n\nAdd vsock_check_source() to validate the transport, source port and source\nCID against the peer stored in a non-listening socket. The local transport\nis the CID exception because its packets are generated internally with\nVMADDR_CID_LOCAL as their source, including connections using CID aliases.\n\nUse the helper after lock_sock() in the virtio receive path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The demonstrated attacker is a local capability-empty AF_VSOCK process: SOCK_DIAG_BY_FAMILY reveals the tuple, and its loopback skb reaches the patched virtio_transport_recv_pkt() through vsock_loopback_work(). No routable network protocol carries the trigger.\nAC:L - virtio_transport_recv_pkt() deterministically falls from vsock_find_connected_socket_net() to destination-only vsock_find_bound_socket_net(); RESPONSE establishes a SYN_SENT socket and later RW packets are queued. No race or memory-layout condition is needed, and established sockets are directly vulnerable.\nPR:L - vsock_create() and the SOCK_DIAG_BY_FAMILY dump impose no capability check, while vsock_auto_bind() selects a non-reserved port without CAP_NET_BIND_SERVICE. The commit reproduced exploitation between capability-empty processes under different UIDs.\nUI:N - After the target process has a connecting or connected vsock, the attacker independently enumerates its tuple and injects RESPONSE and RW packets. No victim user must approve, open, or mount attacker-supplied content.\nS:U - The flaw changes another socket\u0027s state and receive queue within the same host kernel authority; crossing a UID boundary is ordinary same-kernel access-control impact. The demonstrated path does not escape a VM or bypass an IOMMU or sandbox boundary.\nC:N - The accepted RESPONSE does not change vsk-\u003eremote_addr, and virtio_transport_send_pkt_info() continues directing victim transmissions to the stored intended peer. The unrelated source receives no victim data, and no kernel-memory read exists.\nI:H - virtio_transport_recv_connected() passes unrelated RW packets to virtio_transport_recv_enqueue(), and recvmsg later copies their attacker-chosen payload into the victim process. This permits arbitrary injection into the victim\u0027s inbound stream, as demonstrated by the 16 chosen bytes.\nA:H - The same fallback lets an unrelated VIRTIO_VSOCK_OP_RST reach virtio_transport_recv_connected(), which calls virtio_transport_do_close(); SHUTDOWN can likewise remove the socket. Unprivileged tuple enumeration lets the attacker repeat this against new connections and deny the vsock service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:28.598Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bda841af86cdfe7fcf4a2f4db22e27f1b852b1ff"
},
{
"url": "https://git.kernel.org/stable/c/c0a3a786a5e8b5007d6a3c34721ab052399ab2ad"
},
{
"url": "https://git.kernel.org/stable/c/f77fb90edca5385d0eecbfd6d2c8ef60afff24a9"
},
{
"url": "https://git.kernel.org/stable/c/ec231dd3b14e541ba1c4f842a7d152fb61037333"
},
{
"url": "https://git.kernel.org/stable/c/6cd829de69efd9ed3a53aa2421004a0396eb2bd7"
},
{
"url": "https://git.kernel.org/stable/c/e9bf92de436ba55f33eaa55d7008e68551123cfd"
},
{
"url": "https://git.kernel.org/stable/c/dee44f41f206becb41c492899c1996cfd7f82a1b"
}
],
"title": "vsock/virtio: validate packet source for connected sockets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99123",
"datePublished": "2026-10-28T10:34:38.600Z",
"dateReserved": "2026-09-25T10:25:14.393Z",
"dateUpdated": "2026-10-31T12:43:28.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64388 (GCVE-0-2026-64388)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix chown/chgrp with SMB3 POSIX Extensions
Ownership (chown) and group (chgrp) modifications were being ignored when
mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or
CIFS_MOUNT_MODE_FROM_SID were also explicitly set.
Fix this by checking for posix_extensions in cifs_setattr_nounix() when
updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map
and set the ownership/group information on the server.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b326614ea2159ea5c835d320f261d05d080cd201 Version: b326614ea2159ea5c835d320f261d05d080cd201 Version: b326614ea2159ea5c835d320f261d05d080cd201 Version: b326614ea2159ea5c835d320f261d05d080cd201 Version: b326614ea2159ea5c835d320f261d05d080cd201 Version: b326614ea2159ea5c835d320f261d05d080cd201 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:40:07.284651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-682",
"description": "CWE-682 Incorrect Calculation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:26.851Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0fe1118a1471d459f76c3e70ff2abbf784ce6bf",
"status": "affected",
"version": "b326614ea2159ea5c835d320f261d05d080cd201",
"versionType": "git"
},
{
"lessThan": "6825a45f6b8ef76b0ee32649ec3d6e39ca143a18",
"status": "affected",
"version": "b326614ea2159ea5c835d320f261d05d080cd201",
"versionType": "git"
},
{
"lessThan": "27ead8c5418af6bfab711079fecb9414d78d4cae",
"status": "affected",
"version": "b326614ea2159ea5c835d320f261d05d080cd201",
"versionType": "git"
},
{
"lessThan": "3eaec47518e126e6dcd1a48521d740278073f0ec",
"status": "affected",
"version": "b326614ea2159ea5c835d320f261d05d080cd201",
"versionType": "git"
},
{
"lessThan": "550cfb8a81181331d4d0f76ab75ee58a0bf41e3e",
"status": "affected",
"version": "b326614ea2159ea5c835d320f261d05d080cd201",
"versionType": "git"
},
{
"lessThan": "760ef2c579c2609cf17fb1cd5392f64d42d43d33",
"status": "affected",
"version": "b326614ea2159ea5c835d320f261d05d080cd201",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix chown/chgrp with SMB3 POSIX Extensions\n\nOwnership (chown) and group (chgrp) modifications were being ignored when\nmounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or\nCIFS_MOUNT_MODE_FROM_SID were also explicitly set.\n\nFix this by checking for posix_extensions in cifs_setattr_nounix() when\nupdating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map\nand set the ownership/group information on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable branch is reached through local chown/chgrp syscalls on an already mounted SMB3 POSIX share; unsolicited SMB traffic cannot invoke it.\nAC:L - With the affected mount configuration, the client deterministically skips the ownership update and returns success; no race, heap layout, or uncontrollable timing is required.\nPR:L - A basic local user can exercise the path on accessible share objects, and noperm deliberately defers authorization to the server whose ownership check is bypassed because no request is sent. The attacker need not create the mount.\nUI:N - The attacker can invoke the syscall directly and exploit continued rights or falsely cached ownership through automated services without human action.\nS:U - The defect affects resources governed through the vulnerable kernel and mounted share without escaping a VM, sandbox, or other distinct security authority.\nC:H - Because the intended ownership change never reaches the server, the prior owner or group can retain read access to an entire data tree believed to have been transferred or revoked.\nI:H - The prior owner can retain arbitrary modification rights, while falsely cached privileged ownership can cause privileged consumers to trust or execute attacker-controlled content.\nA:H - Retained ownership of writable files or directories can permit truncation or deletion of an entire service data tree, and privileged execution through false ownership can cause a complete outage."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:49.236Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0fe1118a1471d459f76c3e70ff2abbf784ce6bf"
},
{
"url": "https://git.kernel.org/stable/c/6825a45f6b8ef76b0ee32649ec3d6e39ca143a18"
},
{
"url": "https://git.kernel.org/stable/c/27ead8c5418af6bfab711079fecb9414d78d4cae"
},
{
"url": "https://git.kernel.org/stable/c/3eaec47518e126e6dcd1a48521d740278073f0ec"
},
{
"url": "https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e"
},
{
"url": "https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33"
}
],
"title": "smb/client: fix chown/chgrp with SMB3 POSIX Extensions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64388",
"datePublished": "2026-07-25T08:50:36.202Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-10-30T12:27:49.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74530 (GCVE-0-2026-74530)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
There is theoretical UAF if the conn is freed while the hci_sync task is
running.
Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to
match the previous behavior.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 620810ac1f7f1133a9ac403e132b3ad6995ddf39 Version: 024421cf39923927ab2b5fe895d1d922b9abe67f Version: 024421cf39923927ab2b5fe895d1d922b9abe67f Version: 024421cf39923927ab2b5fe895d1d922b9abe67f Version: ee0586ad64a805eaf1a9a10100e908627a561e34 Version: 6.12.28 ≤ Version: 6.14.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:16.031043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:53.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "117d8bcaf1abc348185e8ab6a4ba9f8f516849a0",
"status": "affected",
"version": "620810ac1f7f1133a9ac403e132b3ad6995ddf39",
"versionType": "git"
},
{
"lessThan": "ff5625d27415ace5667bf87ebc16c3a0a98db22f",
"status": "affected",
"version": "024421cf39923927ab2b5fe895d1d922b9abe67f",
"versionType": "git"
},
{
"lessThan": "2d91e6244b69d752503b2d44020d8b0e323dbd38",
"status": "affected",
"version": "024421cf39923927ab2b5fe895d1d922b9abe67f",
"versionType": "git"
},
{
"lessThan": "56e78b670356caab0b607e8aad4cf819a1909d07",
"status": "affected",
"version": "024421cf39923927ab2b5fe895d1d922b9abe67f",
"versionType": "git"
},
{
"status": "affected",
"version": "ee0586ad64a805eaf1a9a10100e908627a561e34",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.28",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_big_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to\nmatch the previous behavior."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in Bluetooth LE ISO BIG Create Sync handling (hci_connect_big_sync), reachable via adjacent BLE traffic that drives HCI events (e.g. HCI_EVT_LE_BIG_INFO_ADV_REPORT through iso_connect_ind) and via local ISO sockets; Bluetooth kernel bugs are scored as Adjacent, not Network.\nAC:L - After 024421cf3992 the path blocks in __hci_cmd_sync_status_sk for up to conn_timeout while only holding a bare hci_conn pointer; an attacker who can open/close an ISO broadcast socket (or race teardown during that wait) controls both sides of the race and can reliably trigger the UAF.\nPR:N - Exploitation does not require root or CAP_NET_ADMIN; adjacent attackers can trigger the vulnerable code through unauthenticated over-the-air BLE broadcasts processed by the kernel HCI layer, and local exploitation only needs standard Bluetooth/ISO socket access available to unprivileged users/apps with Bluetooth permission.\nUI:N - No victim interaction is required beyond attacker-controlled actions such as creating an ISO broadcast listener socket, starting BIG sync, and concurrently closing the socket to free hci_conn while hci_sync work is still running; exploitation does not depend on another user opening files or mounting resources.\nS:U - The use-after-free corrupts kernel heap memory within the Bluetooth/hci_conn subsystem and can lead to local privilege escalation, but it does not cross a VM, IOMMU, or sandbox security boundary into another authority domain.\nC:H - This is a kernel heap use-after-free of struct hci_conn; freed connection objects can be reallocated and read through subsequent dereferences in create_big_complete and hci_le_big_create_sync, providing a standard path to arbitrary kernel memory disclosure.\nI:H - UAF on struct hci_conn allows corrupting connection flags and adjacent heap contents; the structure contains function pointers (cleanup, connect_cfm_cb, disconn_cfm_cb) and is large enough to support heap grooming toward arbitrary write or control-flow hijack.\nA:H - Use-after-free during clear_bit on conn-\u003eflags in create_big_complete, or accessing conn fields after teardown during the blocking BIG sync command, can cause kernel oops/panic and repeated disruption; UAF availability impact is rated High per kernel guidance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:48.364Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/117d8bcaf1abc348185e8ab6a4ba9f8f516849a0"
},
{
"url": "https://git.kernel.org/stable/c/ff5625d27415ace5667bf87ebc16c3a0a98db22f"
},
{
"url": "https://git.kernel.org/stable/c/2d91e6244b69d752503b2d44020d8b0e323dbd38"
},
{
"url": "https://git.kernel.org/stable/c/56e78b670356caab0b607e8aad4cf819a1909d07"
}
],
"title": "Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74530",
"datePublished": "2026-08-15T12:27:45.381Z",
"dateReserved": "2026-08-15T05:44:03.912Z",
"dateUpdated": "2026-10-21T12:45:48.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90417 (GCVE-0-2026-90417)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
When the device is in the fatal error state, write_tpt_entry() returns -EIO
before handing the caller's preallocated skb to the transmit path; its
allocation-failure returns do the same. c4iw_dereg_mr() ignores the error
and frees mhp, leaking mhp->dereg_skb. c4iw_get_dma_mr() instead frees the
skb a second time after dereg_mem() already consumed it, a double free.
Make write_tpt_entry() the sole owner of a non-NULL skb, freeing it on
every return preceding handoff to c4iw_ofld_send(): fatal error, tpt and
stag allocation failure. c4iw_ofld_send() consumes the skb on success and
error alike, so drop the redundant kfree_skb() in c4iw_get_dma_mr() after
dereg_mem().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0f8ab0b6e91b4d5302ceee5ec12ce54d81297635 Version: 0f8ab0b6e91b4d5302ceee5ec12ce54d81297635 Version: 0f8ab0b6e91b4d5302ceee5ec12ce54d81297635 Version: 0f8ab0b6e91b4d5302ceee5ec12ce54d81297635 Version: 0f8ab0b6e91b4d5302ceee5ec12ce54d81297635 Version: 0f8ab0b6e91b4d5302ceee5ec12ce54d81297635 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/cxgb4/mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "26c6e9bc0b907b880c5d8486291f0452c8227fbe",
"status": "affected",
"version": "0f8ab0b6e91b4d5302ceee5ec12ce54d81297635",
"versionType": "git"
},
{
"lessThan": "68c1d2c085f205e8a5338bc3d3304f897deca4d9",
"status": "affected",
"version": "0f8ab0b6e91b4d5302ceee5ec12ce54d81297635",
"versionType": "git"
},
{
"lessThan": "379cf06e6fe34af980064c6ccaf15d8e26ec4a42",
"status": "affected",
"version": "0f8ab0b6e91b4d5302ceee5ec12ce54d81297635",
"versionType": "git"
},
{
"lessThan": "2fcd26f4680143e9ec477069530548dbe20fce6f",
"status": "affected",
"version": "0f8ab0b6e91b4d5302ceee5ec12ce54d81297635",
"versionType": "git"
},
{
"lessThan": "6b15fc9bc117fb6597fa1c2cc30284aafe71101c",
"status": "affected",
"version": "0f8ab0b6e91b4d5302ceee5ec12ce54d81297635",
"versionType": "git"
},
{
"lessThan": "373f3716a2de7adc739269ebb4d87e5bf4dc180c",
"status": "affected",
"version": "0f8ab0b6e91b4d5302ceee5ec12ce54d81297635",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/cxgb4/mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()\n\nWhen the device is in the fatal error state, write_tpt_entry() returns -EIO\nbefore handing the caller\u0027s preallocated skb to the transmit path; its\nallocation-failure returns do the same. c4iw_dereg_mr() ignores the error\nand frees mhp, leaking mhp-\u003edereg_skb. c4iw_get_dma_mr() instead frees the\nskb a second time after dereg_mem() already consumed it, a double free.\n\nMake write_tpt_entry() the sole owner of a non-NULL skb, freeing it on\nevery return preceding handoff to c4iw_ofld_send(): fatal error, tpt and\nstag allocation failure. c4iw_ofld_send() consumes the skb on success and\nerror alike, so drop the redundant kfree_skb() in c4iw_get_dma_mr() after\ndereg_mem()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:32.436Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/26c6e9bc0b907b880c5d8486291f0452c8227fbe"
},
{
"url": "https://git.kernel.org/stable/c/68c1d2c085f205e8a5338bc3d3304f897deca4d9"
},
{
"url": "https://git.kernel.org/stable/c/379cf06e6fe34af980064c6ccaf15d8e26ec4a42"
},
{
"url": "https://git.kernel.org/stable/c/2fcd26f4680143e9ec477069530548dbe20fce6f"
},
{
"url": "https://git.kernel.org/stable/c/6b15fc9bc117fb6597fa1c2cc30284aafe71101c"
},
{
"url": "https://git.kernel.org/stable/c/373f3716a2de7adc739269ebb4d87e5bf4dc180c"
}
],
"title": "RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90417",
"datePublished": "2026-09-17T16:09:42.342Z",
"dateReserved": "2026-09-11T19:38:34.813Z",
"dateUpdated": "2026-10-30T12:35:32.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98079 (GCVE-0-2026-98079)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zstd: fix lost wakeup when waiting for a workspace
A writer can sleep forever in zstd_get_workspace() even though a workspace
is free. When zstd_alloc_workspace() fails, the task is queued on
zwsm->wait and schedules unconditionally, never re-testing the pool.
zstd_put_workspace() publishes the workspace and then calls cond_wake_up(),
which only wakes when a sleeper is already visible, so a workspace returned
between the failed allocation and prepare_to_wait() wakes nobody. The
window is wide: zstd_alloc_workspace() goes through kvmalloc() and may
enter reclaim.
Only a max level workspace triggers the wakeup and one is deliberately kept
allocated as the fallback every waiter waits for, so once its wakeup is
lost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens
to return one. Re-check the pool after prepare_to_wait() has published the
waiter, and use the workspace if one turned up.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/zstd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14d982762945d9945c60bbd48b77df194dd8e28d",
"status": "affected",
"version": "3f93aef535c8ea03e40cd8acf0753b3e6ed33e96",
"versionType": "git"
},
{
"lessThan": "844603cf842ee67640d33f350e3fa60f3de7fad3",
"status": "affected",
"version": "3f93aef535c8ea03e40cd8acf0753b3e6ed33e96",
"versionType": "git"
},
{
"lessThan": "d8f57049521948df5f50797141472fbbed3b0723",
"status": "affected",
"version": "3f93aef535c8ea03e40cd8acf0753b3e6ed33e96",
"versionType": "git"
},
{
"lessThan": "0de9f31d447ae71ab08c7850a321682f8d2907c3",
"status": "affected",
"version": "3f93aef535c8ea03e40cd8acf0753b3e6ed33e96",
"versionType": "git"
},
{
"lessThan": "2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7",
"status": "affected",
"version": "3f93aef535c8ea03e40cd8acf0753b3e6ed33e96",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/zstd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zstd: fix lost wakeup when waiting for a workspace\n\nA writer can sleep forever in zstd_get_workspace() even though a workspace\nis free. When zstd_alloc_workspace() fails, the task is queued on\nzwsm-\u003ewait and schedules unconditionally, never re-testing the pool.\nzstd_put_workspace() publishes the workspace and then calls cond_wake_up(),\nwhich only wakes when a sleeper is already visible, so a workspace returned\nbetween the failed allocation and prepare_to_wait() wakes nobody. The\nwindow is wide: zstd_alloc_workspace() goes through kvmalloc() and may\nenter reclaim.\n\nOnly a max level workspace triggers the wakeup and one is deliberately kept\nallocated as the fallback every waiter waits for, so once its wakeup is\nlost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens\nto return one. Re-check the pool after prepare_to_wait() has published the\nwaiter, and use the workspace if one turned up."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:23.769Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14d982762945d9945c60bbd48b77df194dd8e28d"
},
{
"url": "https://git.kernel.org/stable/c/844603cf842ee67640d33f350e3fa60f3de7fad3"
},
{
"url": "https://git.kernel.org/stable/c/d8f57049521948df5f50797141472fbbed3b0723"
},
{
"url": "https://git.kernel.org/stable/c/0de9f31d447ae71ab08c7850a321682f8d2907c3"
},
{
"url": "https://git.kernel.org/stable/c/2acb9f3d1cc8f65dc81ed55e238cbf8e5b60bff7"
}
],
"title": "btrfs: zstd: fix lost wakeup when waiting for a workspace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98079",
"datePublished": "2026-09-25T10:24:16.892Z",
"dateReserved": "2026-09-25T10:19:56.074Z",
"dateUpdated": "2026-10-21T12:54:23.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74368 (GCVE-0-2026-74368)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to
ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the
NWIFI header length is invalid, causing the function to abort early with
-EINVAL.
When this happens, the error propagates to
ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it
to NULL. As a result, the corresponding MSDU is no longer referenced
by the defragmentation path and is never freed.
This leads to a memory leak for the affected MSDU on this error path.
Proper cleanup is required to ensure the MSDU is released when header
validation fails during TKIP MIC verification.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c Version: 3abe15e756481c45f6acba3d476cb3ca4afc3b61 Version: 9a0dddfb30f120db3851627935851d262e4e7acb Version: 9a0dddfb30f120db3851627935851d262e4e7acb Version: 9a0dddfb30f120db3851627935851d262e4e7acb Version: 6ee653194ddb83674913fd2727b8ecfae0597ade Version: 50be1fb76556e80af9f5da80f28168b6c71bce58 Version: 6.6.88 ≤ Version: 6.12.24 ≤ Version: 6.13.12 ≤ Version: 6.14.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d960cd5dbcc6a01f49cc304b724f6b18a63a172d",
"status": "affected",
"version": "7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c",
"versionType": "git"
},
{
"lessThan": "779ab501dc8f1148b3f10740a68335741bdc5ffe",
"status": "affected",
"version": "3abe15e756481c45f6acba3d476cb3ca4afc3b61",
"versionType": "git"
},
{
"lessThan": "55c6f05b667726d2da5fd011d646fb48ce5b6b9c",
"status": "affected",
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"versionType": "git"
},
{
"lessThan": "5187a92099778501f21af76ed6c8415d128e7298",
"status": "affected",
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"versionType": "git"
},
{
"lessThan": "98d4f92ab6a1af2ea2ab590d7e2801b203110981",
"status": "affected",
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"versionType": "git"
},
{
"status": "affected",
"version": "6ee653194ddb83674913fd2727b8ecfae0597ade",
"versionType": "git"
},
{
"status": "affected",
"version": "50be1fb76556e80af9f5da80f28168b6c71bce58",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()\n\nIn ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to\nath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the\nNWIFI header length is invalid, causing the function to abort early with\n-EINVAL.\n\nWhen this happens, the error propagates to\nath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it\nto NULL. As a result, the corresponding MSDU is no longer referenced\nby the defragmentation path and is never freed.\n\nThis leads to a memory leak for the affected MSDU on this error path.\nProper cleanup is required to ensure the MSDU is released when header\nvalidation fails during TKIP MIC verification.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:29.473Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d960cd5dbcc6a01f49cc304b724f6b18a63a172d"
},
{
"url": "https://git.kernel.org/stable/c/779ab501dc8f1148b3f10740a68335741bdc5ffe"
},
{
"url": "https://git.kernel.org/stable/c/55c6f05b667726d2da5fd011d646fb48ce5b6b9c"
},
{
"url": "https://git.kernel.org/stable/c/5187a92099778501f21af76ed6c8415d128e7298"
},
{
"url": "https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981"
}
],
"title": "wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74368",
"datePublished": "2026-08-15T05:58:49.619Z",
"dateReserved": "2026-08-15T05:44:03.888Z",
"dateUpdated": "2026-10-21T12:45:29.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74723 (GCVE-0-2026-74723)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: lzo: reject inline extents without valid headers
[BUG]
For a crafted btrfs image, the following KASAN can be triggered when
reading an inline lzo compressed file extent:
BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700
Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77
Call Trace:
<TASK>
dump_stack_lvl+0x5b/0x70
print_report+0xd1/0x610
kasan_report+0xe0/0x110
__asan_report_load_n_noabort+0x13/0x20
lzo_decompress+0x57d/0x700
btrfs_decompress+0x140/0x1c0
uncompress_inline+0x147/0x1b0
btrfs_get_extent+0xb23/0x10a0
btrfs_do_readpage.constprop.0+0x538/0x1ac0
btrfs_readahead+0x32f/0x5f0
read_pages+0x16f/0x850
page_cache_ra_unbounded+0x296/0x490
do_page_cache_ra+0xd9/0x130
page_cache_sync_ra+0x3ee/0x6f0
filemap_get_pages+0x306/0x15c0
filemap_read+0x329/0xd00
btrfs_file_read_iter+0x1f8/0x2b0
vfs_read+0x4ef/0x720
ksys_read+0xf8/0x1d0
__x64_sys_read+0x71/0xb0
x64_sys_call+0x1ab0/0x1b70
do_syscall_64+0x61/0x470
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
[CAUSE]
For an inline lzo compressed file extent, there should always be one lzo
header, recording the total length of the compressed data, followed by
one segment header, recording the compressed lzo payload.
But if a crafted inline lzo compressed file extent contains only an lzo
header, without the segment header or payload, lzo_decompress() will
still try to read the segment header, causing a read beyond the item
boundary.
Furthermore if the inline lzo compressed file extent is the first item
of the leaf, it will be at the extent buffer boundary. The above
out-of-boundary read will go beyond the extent buffer boundary,
triggering the above KASAN report.
[FIX]
Validate the total length of the inlined lzo compressed file extent, to
make sure there is at least one LZO header and one segment header, and a
non-zero payload.
[ Rework the commit message to remove slop ]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a6fa6fae40ec336c7df6155255ae64ebef43a8bc Version: a6fa6fae40ec336c7df6155255ae64ebef43a8bc Version: a6fa6fae40ec336c7df6155255ae64ebef43a8bc Version: a6fa6fae40ec336c7df6155255ae64ebef43a8bc Version: a6fa6fae40ec336c7df6155255ae64ebef43a8bc Version: a6fa6fae40ec336c7df6155255ae64ebef43a8bc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b824d657d2403e8dbe4257d62825e66f79dcf8c",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
},
{
"lessThan": "5d00c9c1c951ae82d498eabbdfff973252a05c50",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
},
{
"lessThan": "fd150d7c8e0ad9d721c011cfd4cc0f3c65bd6834",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
},
{
"lessThan": "056876c9db1e969bfcf7d8583c7696cc0dd080df",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
},
{
"lessThan": "fc50b475ad27f50b4dcc98fc4c44e8802bc1b248",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
},
{
"lessThan": "0fa78ef637deb5dbe341582f88553a4bce496de0",
"status": "affected",
"version": "a6fa6fae40ec336c7df6155255ae64ebef43a8bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lzo: reject inline extents without valid headers\n\n[BUG]\nFor a crafted btrfs image, the following KASAN can be triggered when\nreading an inline lzo compressed file extent:\n\n BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700\n Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77\n\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5b/0x70\n print_report+0xd1/0x610\n kasan_report+0xe0/0x110\n __asan_report_load_n_noabort+0x13/0x20\n lzo_decompress+0x57d/0x700\n btrfs_decompress+0x140/0x1c0\n uncompress_inline+0x147/0x1b0\n btrfs_get_extent+0xb23/0x10a0\n btrfs_do_readpage.constprop.0+0x538/0x1ac0\n btrfs_readahead+0x32f/0x5f0\n read_pages+0x16f/0x850\n page_cache_ra_unbounded+0x296/0x490\n do_page_cache_ra+0xd9/0x130\n page_cache_sync_ra+0x3ee/0x6f0\n filemap_get_pages+0x306/0x15c0\n filemap_read+0x329/0xd00\n btrfs_file_read_iter+0x1f8/0x2b0\n vfs_read+0x4ef/0x720\n ksys_read+0xf8/0x1d0\n __x64_sys_read+0x71/0xb0\n x64_sys_call+0x1ab0/0x1b70\n do_syscall_64+0x61/0x470\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n\n[CAUSE]\nFor an inline lzo compressed file extent, there should always be one lzo\nheader, recording the total length of the compressed data, followed by\none segment header, recording the compressed lzo payload.\n\nBut if a crafted inline lzo compressed file extent contains only an lzo\nheader, without the segment header or payload, lzo_decompress() will\nstill try to read the segment header, causing a read beyond the item\nboundary.\n\nFurthermore if the inline lzo compressed file extent is the first item\nof the leaf, it will be at the extent buffer boundary. The above\nout-of-boundary read will go beyond the extent buffer boundary,\ntriggering the above KASAN report.\n\n[FIX]\nValidate the total length of the inlined lzo compressed file extent, to\nmake sure there is at least one LZO header and one segment header, and a\nnon-zero payload.\n\n[ Rework the commit message to remove slop ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On storage servers exporting a btrfs volume via nfsd or ksmbd, remote client read I/O reaches uncompress_inline\u2192lzo_decompress on the server kernel; crafted inline LZO extents in a mounted image are parsed without local syscall access.\nAC:L - A btrfs image with an inline LZO extent containing only the 4-byte total header deterministically drives get_unaligned_le32 past the kmalloc copy in lzo_decompress(); tree-checker skips compressed-inline validation so mount succeeds and a normal read triggers the slab OOB.\nPR:N - Triggering requires only read access to exported btrfs content (nfsd/ksmbd read, loop-mount with CAP_SYS_ADMIN in a user namespace, or udisks-assisted mount); creating the malformed metadata needs offline image crafting, not init-namespace root on the victim.\nUI:N - Exploitation is the attacker\u0027s own read against an already-mounted/exported btrfs volume containing the crafted extent; no separate victim must mount media, click a dialog, or perform other interaction beyond the attacker\u0027s read/open.\nS:U - The slab out-of-bounds read and any resulting kernel memory misuse stay within the host kernel security domain; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - get_unaligned_le32 reads up to four bytes past the kmalloc buffer holding the inline extent, leaking adjacent slab contents that can include kernel pointers and enable further kernel memory disclosure.\nI:H - Slab-out-of-bounds access is kernel memory corruption; adjacent kmalloc objects can be groomed and the disclosed pointers chained into arbitrary write or control-flow hijack primitives during repeated reads.\nA:H - KASAN reports slab-out-of-bounds in lzo_decompress on read; the invalid access can fault into adjacent slab objects and oops the kernel, and repeated reads can destabilize or hang the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:23.837Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b824d657d2403e8dbe4257d62825e66f79dcf8c"
},
{
"url": "https://git.kernel.org/stable/c/5d00c9c1c951ae82d498eabbdfff973252a05c50"
},
{
"url": "https://git.kernel.org/stable/c/fd150d7c8e0ad9d721c011cfd4cc0f3c65bd6834"
},
{
"url": "https://git.kernel.org/stable/c/056876c9db1e969bfcf7d8583c7696cc0dd080df"
},
{
"url": "https://git.kernel.org/stable/c/fc50b475ad27f50b4dcc98fc4c44e8802bc1b248"
},
{
"url": "https://git.kernel.org/stable/c/0fa78ef637deb5dbe341582f88553a4bce496de0"
}
],
"title": "btrfs: lzo: reject inline extents without valid headers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74723",
"datePublished": "2026-08-22T15:33:15.196Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-10-30T12:30:23.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68399 (GCVE-0-2026-68399)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in sock clone early bailouts
Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage
before bailouts that access it"), sk_clone() performs an initial
shallow copy of the socket field ->sk_bpf_storage via sock_copy()
for the cloned socket newsk.
If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior
to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points
to the parent socket's BPF local storage. When newsk is subsequently
freed via sk_free(), the deallocation path (__sk_destruct() ->
bpf_sk_storage_free()) destroys the parent socket's BPF local storage,
leading to a use-after-free (UAF) on the parent socket.
Fix this by resetting newsk->sk_bpf_storage to NULL immediately after
sock_copy() in sk_clone(), and remove the now redundant initialization
from bpf_sk_storage_clone().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d Version: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d Version: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d Version: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d Version: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d Version: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68399",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:12.954788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:08.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/bpf_sk_storage.c",
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac855efc6bb216b262b672af68219e5b731f42a4",
"status": "affected",
"version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
"versionType": "git"
},
{
"lessThan": "f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01",
"status": "affected",
"version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
"versionType": "git"
},
{
"lessThan": "24139461545e44442df9b80deace26b2eb3e103d",
"status": "affected",
"version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
"versionType": "git"
},
{
"lessThan": "01f8a354497ba739f81b691b3702bc4c46500a4d",
"status": "affected",
"version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
"versionType": "git"
},
{
"lessThan": "14b49b5ab29979552c219a09e569b424fbbf4a6e",
"status": "affected",
"version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
"versionType": "git"
},
{
"lessThan": "7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f",
"status": "affected",
"version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/bpf_sk_storage.c",
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe -\u003ebpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field -\u003esk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk-\u003esk_bpf_storage still points\nto the parent socket\u0027s BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() -\u003e\nbpf_sk_storage_free()) destroys the parent socket\u0027s BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk-\u003esk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable clone path and its early-bailout condition are driven through the BPF sk_storage subsystem and local socket setup (attaching sk_storage, attaching a socket filter, adjusting optmem_max). Per kernel guidance BPF is Local; a remote peer cannot control the bailout conditions.\nAC:L - An attacker who controls the local setup can deterministically force the early bailout by attaching a filter and lowering net.core.optmem_max below the filter size, exactly the sysctl-change scenario the code documents, making sk_filter_charge fail on every clone.\nPR:L - Reaching the bug requires attaching BPF sk_storage and manipulating socket/net settings; these capabilities (CAP_BPF/CAP_NET_ADMIN) can be reachable via user namespaces in some configurations, so the lower-privilege value is chosen per the higher-severity rule.\nUI:N - The clone is triggered by connection acceptance or association creation with no victim action; no user interaction is needed.\nS:U - The UAF corrupts kernel socket/BPF-storage objects within the kernel\u0027s own security authority; no crossing into a separate security scope (no VM/IOMMU boundary).\nC:H - The use-after-free lets the attacker reclaim the freed bpf_local_storage object with controlled contents, enabling disclosure of kernel memory; per guidance UAF is High.\nI:H - UAF on a live socket\u0027s BPF storage enables heap grooming and arbitrary-write primitives, giving control-flow hijack potential; per guidance UAF is High.\nA:H - Destroying the parent socket\u0027s still-referenced BPF local storage reliably causes memory corruption, oops, and kernel panic; per guidance any UAF/crash is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:27.786Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac855efc6bb216b262b672af68219e5b731f42a4"
},
{
"url": "https://git.kernel.org/stable/c/f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01"
},
{
"url": "https://git.kernel.org/stable/c/24139461545e44442df9b80deace26b2eb3e103d"
},
{
"url": "https://git.kernel.org/stable/c/01f8a354497ba739f81b691b3702bc4c46500a4d"
},
{
"url": "https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e"
},
{
"url": "https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f"
}
],
"title": "bpf: Fix UAF in sock clone early bailouts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68399",
"datePublished": "2026-08-10T12:04:18.837Z",
"dateReserved": "2026-07-30T09:28:09.389Z",
"dateUpdated": "2026-10-30T12:28:27.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64213 (GCVE-0-2026-64213)
Vulnerability from cvelistv5
Published
2026-07-24 15:23
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (lm90) Add lock protection to lm90_alert
Sashiko reports:
lm90_alert() executes in the smbus alert context and calls
lm90_update_confreg() to disable the hardware alert line, without
acquiring hwmon_lock.
Concurrently, sysfs write operations (such as lm90_write_convrate) hold
the hwmon_lock, temporarily modify data->config, and then restore it.
If an alert interrupt occurs concurrently with a sysfs write, the sysfs
path will overwrite the alert handler's modifications to data->config
and the hardware register.
This unintentionally re-enables the hardware alert line while the alarm is
still active, causing an interrupt storm.
Add the missing lock to lm90_alert() to solve the problem.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f Version: 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f Version: 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f Version: 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f Version: 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f Version: 7a1d220ccb0cc2b808eb176fb05bf55a38179f3f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:32:16.692361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:30.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/lm90.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1dc6a3469b5427e3bfd19010d7755ebc6019abc1",
"status": "affected",
"version": "7a1d220ccb0cc2b808eb176fb05bf55a38179f3f",
"versionType": "git"
},
{
"lessThan": "02b88fa993582b4fe228b4143b330b0bb9f28353",
"status": "affected",
"version": "7a1d220ccb0cc2b808eb176fb05bf55a38179f3f",
"versionType": "git"
},
{
"lessThan": "165ef777ec6f634a5e4b8d9b0dadca8ef91fa90e",
"status": "affected",
"version": "7a1d220ccb0cc2b808eb176fb05bf55a38179f3f",
"versionType": "git"
},
{
"lessThan": "bed1fc32e0eb653806fa98afcf55f9a311fc4ce2",
"status": "affected",
"version": "7a1d220ccb0cc2b808eb176fb05bf55a38179f3f",
"versionType": "git"
},
{
"lessThan": "b0b66aae8a94c3663d47e4000b0e81b89ce32186",
"status": "affected",
"version": "7a1d220ccb0cc2b808eb176fb05bf55a38179f3f",
"versionType": "git"
},
{
"lessThan": "873e919e3101063a7a75989510ccfc125a4391cf",
"status": "affected",
"version": "7a1d220ccb0cc2b808eb176fb05bf55a38179f3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/lm90.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Add lock protection to lm90_alert\n\nSashiko reports:\n\nlm90_alert() executes in the smbus alert context and calls\nlm90_update_confreg() to disable the hardware alert line, without\nacquiring hwmon_lock.\n\nConcurrently, sysfs write operations (such as lm90_write_convrate) hold\nthe hwmon_lock, temporarily modify data-\u003econfig, and then restore it.\n\nIf an alert interrupt occurs concurrently with a sysfs write, the sysfs\npath will overwrite the alert handler\u0027s modifications to data-\u003econfig\nand the hardware register.\n\nThis unintentionally re-enables the hardware alert line while the alarm is\nstill active, causing an interrupt storm.\n\nAdd the missing lock to lm90_alert() to solve the problem."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:41.554Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc6a3469b5427e3bfd19010d7755ebc6019abc1"
},
{
"url": "https://git.kernel.org/stable/c/02b88fa993582b4fe228b4143b330b0bb9f28353"
},
{
"url": "https://git.kernel.org/stable/c/165ef777ec6f634a5e4b8d9b0dadca8ef91fa90e"
},
{
"url": "https://git.kernel.org/stable/c/bed1fc32e0eb653806fa98afcf55f9a311fc4ce2"
},
{
"url": "https://git.kernel.org/stable/c/b0b66aae8a94c3663d47e4000b0e81b89ce32186"
},
{
"url": "https://git.kernel.org/stable/c/873e919e3101063a7a75989510ccfc125a4391cf"
}
],
"title": "hwmon: (lm90) Add lock protection to lm90_alert",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64213",
"datePublished": "2026-07-24T15:23:02.987Z",
"dateReserved": "2026-07-19T15:36:31.770Z",
"dateUpdated": "2026-11-06T16:34:30.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97538 (GCVE-0-2026-97538)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-11-06 17:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (asus_rog_ryujin) Validate HID report lengths
rog_ryujin_raw_event() parses response headers and payload fields without
first checking that they are present in the received report. A short report
can therefore make the driver consume uninitialized bytes from the HID
transport buffer and expose them as sensor values through sysfs.
Validate the response header and the fields used by each response type
before parsing them.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/asus_rog_ryujin.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "995f22b2881835b518b3f99240d00781c9df0235",
"status": "affected",
"version": "ed3e03790c5c9f29f032dde9bb784e198984a759",
"versionType": "git"
},
{
"lessThan": "49cc6d5c00a7f75540d1a4324e01be4067ee652c",
"status": "affected",
"version": "ed3e03790c5c9f29f032dde9bb784e198984a759",
"versionType": "git"
},
{
"lessThan": "1caa5f9399ff107a8fa221b1eaca0a9e729d3758",
"status": "affected",
"version": "ed3e03790c5c9f29f032dde9bb784e198984a759",
"versionType": "git"
},
{
"lessThan": "8042312e73c50de82634ce63eae7cf219464b481",
"status": "affected",
"version": "ed3e03790c5c9f29f032dde9bb784e198984a759",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/asus_rog_ryujin.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.61",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (asus_rog_ryujin) Validate HID report lengths\n\nrog_ryujin_raw_event() parses response headers and payload fields without\nfirst checking that they are present in the received report. A short report\ncan therefore make the driver consume uninitialized bytes from the HID\ntransport buffer and expose them as sensor values through sysfs.\n\nValidate the response header and the fields used by each response type\nbefore parsing them."
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:14:58.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/995f22b2881835b518b3f99240d00781c9df0235"
},
{
"url": "https://git.kernel.org/stable/c/49cc6d5c00a7f75540d1a4324e01be4067ee652c"
},
{
"url": "https://git.kernel.org/stable/c/1caa5f9399ff107a8fa221b1eaca0a9e729d3758"
},
{
"url": "https://git.kernel.org/stable/c/8042312e73c50de82634ce63eae7cf219464b481"
}
],
"title": "hwmon: (asus_rog_ryujin) Validate HID report lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97538",
"datePublished": "2026-09-25T10:21:36.208Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-11-06T17:14:58.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53024 (GCVE-0-2026-53024)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
greybus: raw: fix use-after-free if write is called after disconnect
If a user writes to the chardev after disconnect has been called, the
kernel panics with the following trace (with
CONFIG_INIT_ON_FREE_DEFAULT_ON=y):
BUG: kernel NULL pointer dereference, address: 0000000000000218
...
Call Trace:
<TASK>
gb_operation_create_common+0x61/0x180
gb_operation_create_flags+0x28/0xa0
gb_operation_sync_timeout+0x6f/0x100
raw_write+0x7b/0xc7 [gb_raw]
vfs_write+0xcf/0x420
? task_mm_cid_work+0x136/0x220
ksys_write+0x63/0xe0
do_syscall_64+0xa4/0x290
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Disconnect calls gb_connection_destroy, which ends up freeing the
connection object. When gb_operation_sync is called in the write file
operations, its gets a freed connection as parameter and the kernel
panics.
The gb_connection_destroy cannot be moved out of the disconnect
function, as the Greybus subsystem expect all connections belonging to a
bundle to be destroyed when disconnect returns.
To prevent this bug, use a rw lock to synchronize access between write
and disconnect. This guarantees that the write function doesn't try
to use a disconnected connection.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/greybus/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5a6ce05ccd9eca653b09d67eb59026821ffaf61b",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "966b941ca469fb794637a0803670454f68515e40",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "2b46f07913a80521ecfe60b229c84bdd7dfb15ab",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "48d6c32bc049abd114e8f0836c0e7d7cbfba7827",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
},
{
"lessThan": "84265cbd96b97058ef67e3f8be3933667a000835",
"status": "affected",
"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/greybus/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free if write is called after disconnect\n\nIf a user writes to the chardev after disconnect has been called, the\nkernel panics with the following trace (with\nCONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000218\n ...\n Call Trace:\n \u003cTASK\u003e\n gb_operation_create_common+0x61/0x180\n gb_operation_create_flags+0x28/0xa0\n gb_operation_sync_timeout+0x6f/0x100\n raw_write+0x7b/0xc7 [gb_raw]\n vfs_write+0xcf/0x420\n ? task_mm_cid_work+0x136/0x220\n ksys_write+0x63/0xe0\n do_syscall_64+0xa4/0x290\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nDisconnect calls gb_connection_destroy, which ends up freeing the\nconnection object. When gb_operation_sync is called in the write file\noperations, its gets a freed connection as parameter and the kernel\npanics.\n\nThe gb_connection_destroy cannot be moved out of the disconnect\nfunction, as the Greybus subsystem expect all connections belonging to a\nbundle to be destroyed when disconnect returns.\n\nTo prevent this bug, use a rw lock to synchronize access between write\nand disconnect. This guarantees that the write function doesn\u0027t try\nto use a disconnected connection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local `write(2)` to the Greybus raw character device, not by network packets. Although disconnect can be caused by Greybus hotplug/removal events, the crashing UAF is triggered from the local file operation.\nAC:L - After a process keeps the raw chardev open across disconnect, a subsequent write reliably uses the destroyed `gb_connection`; no hard race or attacker-uncontrolled memory layout is required to trigger the bug. Under the conservative rule, the UAF exploitation complexity is Low.\nPR:L - The raw driver has no capability, ioctl, or authentication checks in open/write; access is gated by ordinary permission to the created chardev. A basic local user with write access to that device can reach the vulnerable path.\nUI:N - The attacker can open the device, keep the fd, and issue the write after disconnect without requiring another user to perform an action. No victim interaction is inherent to the vulnerable syscall path.\nS:U - The impact is within the kernel/host security authority. This is not a guest-to-host, IOMMU, or separate-scope boundary crossing.\nC:H - The bug is a use-after-free of `struct gb_connection`, and the stale object is dereferenced by Greybus operation creation and transport paths. As a kernel UAF, it is conservatively treated as capable of enabling kernel memory disclosure.\nI:H - The freed connection contains pointers used to reach host-device and driver operation paths, so heap reuse could plausibly turn the stale pointer into control-flow or write primitives. Under the required conservative UAF guidance, integrity impact is High.\nA:H - The upstream report shows a kernel panic/NULL dereference when writing after disconnect, and UAFs can repeatedly crash the kernel. Availability impact is therefore High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:31.167Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5a6ce05ccd9eca653b09d67eb59026821ffaf61b"
},
{
"url": "https://git.kernel.org/stable/c/966b941ca469fb794637a0803670454f68515e40"
},
{
"url": "https://git.kernel.org/stable/c/2b46f07913a80521ecfe60b229c84bdd7dfb15ab"
},
{
"url": "https://git.kernel.org/stable/c/48d6c32bc049abd114e8f0836c0e7d7cbfba7827"
},
{
"url": "https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835"
}
],
"title": "greybus: raw: fix use-after-free if write is called after disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53024",
"datePublished": "2026-06-24T16:29:33.184Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-10-30T12:26:31.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74388 (GCVE-0-2026-74388)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
The OSS sequencer processes the input MIDI bytes into a sequencer
event to be dispatched later (in snd_seq_oss_midi_putc() called from
snd_seq_oss_process_event()). When it's a SysEx data, the event
record contains data.ext.ptr pointer to the original SysEx bytes, and
the referred data is copied into the pool afterwards at dispatching.
The problem is that, if the sequencer port gets closed concurrently
before the dispatch, the OSS sequencer core also releases the
resources (in snd_seq_oss_midi_check_exit_port()), while the pending
event may hold a stale pointer, eventually leading to a UAF at a later
dispatch.
Fortunately, there is already a refcounting mechanism (snd_use_lock_t)
for the OSS MIDI device access, and for addressing the issue above, we
just need to extend the refcount until the event gets dispatched.
This patch extends snd_seq_oss_process_event() to give back the
refcount object, which is in turn released after calling the sequencer
dispatcher with the given event in the caller side.
According to the original report, KASAN report as below:
KASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470
RIP: 0033:0x7f2cb66a6340
Read of size 6
Call trace:
dump_stack_lvl+0x73/0xb0 (?:?)
print_report+0xd1/0x650 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
__virt_addr_valid+0x1a7/0x340 (?:?)
kasan_complete_mode_report_info+0x64/0x200 (?:?)
kasan_report+0xf7/0x130 (?:?)
snd_seq_event_dup+0x40c/0x470 (?:?)
kasan_check_range+0x10c/0x1c0 (?:?)
__asan_memcpy+0x27/0x70 (?:?)
snd_seq_event_dup+0x9/0x470 (?:?)
snd_seq_client_enqueue_event+0x139/0x240 (?:?)
_raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)
snd_seq_kernel_client_enqueue+0x102/0x120 (?:?)
snd_seq_oss_write+0x416/0x4e0 (?:?)
apparmor_file_permission+0x20/0x30 (?:?)
odev_write+0x3b/0x60 (?:?)
vfs_write+0x1ce/0x850 (?:?)
lock_release+0xc8/0x2a0 (?:?)
__kasan_check_write+0x18/0x20 (?:?)
__mutex_unlock_slowpath+0x129/0x510 (?:?)
ksys_write+0xe1/0x180 (?:?)
mutex_unlock+0x16/0x20 (?:?)
odev_ioctl+0x65/0xc0 (?:?)
__x64_sys_write+0x46/0x60 (?:?)
x64_sys_call+0x7d/0x20d0 (?:?)
do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:11.498813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:40.548Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/oss/seq_oss_event.c",
"sound/core/seq/oss/seq_oss_event.h",
"sound/core/seq/oss/seq_oss_ioctl.c",
"sound/core/seq/oss/seq_oss_midi.c",
"sound/core/seq/oss/seq_oss_midi.h",
"sound/core/seq/oss/seq_oss_rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e85e690e787fa42f35e1bd9d18a7979c201d165",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bc963e193b314f1441082e8b1ffe15eb255d0a44",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e96824274239ae4cd2f7b712644441cdc72c81a3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6dc781778b595be94c31395b2cb167f65145d91f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7aad70cabd8f34cf11a9593fcd3f2ac3f5496943",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7c349b4f2a603202fb8c363bd2774a22ac2fddf3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/oss/seq_oss_event.c",
"sound/core/seq/oss/seq_oss_event.h",
"sound/core/seq/oss/seq_oss_ioctl.c",
"sound/core/seq/oss/seq_oss_midi.c",
"sound/core/seq/oss/seq_oss_midi.h",
"sound/core/seq/oss/seq_oss_rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Fix UAF at handling events with embedded SysEx data\n\nThe OSS sequencer processes the input MIDI bytes into a sequencer\nevent to be dispatched later (in snd_seq_oss_midi_putc() called from\nsnd_seq_oss_process_event()). When it\u0027s a SysEx data, the event\nrecord contains data.ext.ptr pointer to the original SysEx bytes, and\nthe referred data is copied into the pool afterwards at dispatching.\nThe problem is that, if the sequencer port gets closed concurrently\nbefore the dispatch, the OSS sequencer core also releases the\nresources (in snd_seq_oss_midi_check_exit_port()), while the pending\nevent may hold a stale pointer, eventually leading to a UAF at a later\ndispatch.\n\nFortunately, there is already a refcounting mechanism (snd_use_lock_t)\nfor the OSS MIDI device access, and for addressing the issue above, we\njust need to extend the refcount until the event gets dispatched.\n\nThis patch extends snd_seq_oss_process_event() to give back the\nrefcount object, which is in turn released after calling the sequencer\ndispatcher with the given event in the caller side.\n\nAccording to the original report, KASAN report as below:\n\nKASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470\nRIP: 0033:0x7f2cb66a6340\nRead of size 6\nCall trace:\n dump_stack_lvl+0x73/0xb0 (?:?)\n print_report+0xd1/0x650 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x1a7/0x340 (?:?)\n kasan_complete_mode_report_info+0x64/0x200 (?:?)\n kasan_report+0xf7/0x130 (?:?)\n snd_seq_event_dup+0x40c/0x470 (?:?)\n kasan_check_range+0x10c/0x1c0 (?:?)\n __asan_memcpy+0x27/0x70 (?:?)\n snd_seq_event_dup+0x9/0x470 (?:?)\n snd_seq_client_enqueue_event+0x139/0x240 (?:?)\n _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)\n snd_seq_kernel_client_enqueue+0x102/0x120 (?:?)\n snd_seq_oss_write+0x416/0x4e0 (?:?)\n apparmor_file_permission+0x20/0x30 (?:?)\n odev_write+0x3b/0x60 (?:?)\n vfs_write+0x1ce/0x850 (?:?)\n lock_release+0xc8/0x2a0 (?:?)\n __kasan_check_write+0x18/0x20 (?:?)\n __mutex_unlock_slowpath+0x129/0x510 (?:?)\n ksys_write+0xe1/0x180 (?:?)\n mutex_unlock+0x16/0x20 (?:?)\n odev_ioctl+0x65/0xc0 (?:?)\n __x64_sys_write+0x46/0x60 (?:?)\n x64_sys_call+0x7d/0x20d0 (?:?)\n do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only via local OSS sequencer character devices (/dev/sequencer, /dev/music) through write(2) or SNDCTL_SEQ_OUTOFBAND ioctl into snd_seq_oss_write(); there is no network, Bluetooth, or physical-device input path to this OSS sequencer code.\nAC:L - The attacker controls both sides of the race: one thread streams SysEx MIDI bytes (SEQ_MIDIPUTC) while another concurrently deletes the backing ALSA sequencer port via /dev/snd/seq or triggers PORT_EXIT teardown, and the window is freely repeatable.\nPR:L - Exploitation requires only a local unprivileged account with access to OSS sequencer and ALSA sequencer device nodes, routinely granted via the audio group or seat ACLs on desktop, studio, and kiosk systems; no capability or init-namespace root is checked on this path.\nUI:N - The attacker\u0027s own process(es) perform the SysEx write and concurrent port-close/delete sequence; no separate victim action such as opening files, mounting filesystems, or plugging in hardware is required beyond the attacker\u0027s own device access.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, enabling local privilege escalation or denial of service, but does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a slab use-after-free where snd_seq_event_dup() memcpy-reads from a freed MIDI coder buffer (KASAN: read of size 6); UAF on kernel heap objects enables controlled reuse and arbitrary kernel memory disclosure via heap grooming.\nI:H - Freed seq_oss_midi/coder objects can be reallocated and corrupted through continued SysEx traffic, providing standard kernel heap overwrite primitives that can be leveraged for arbitrary write and local privilege escalation.\nA:H - The UAF is observed as a KASAN slab-use-after-free during event enqueue and reliably causes kernel oops or panic on the vulnerable path; even without full exploitation, triggering the bug causes high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:53.196Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e85e690e787fa42f35e1bd9d18a7979c201d165"
},
{
"url": "https://git.kernel.org/stable/c/bc963e193b314f1441082e8b1ffe15eb255d0a44"
},
{
"url": "https://git.kernel.org/stable/c/e96824274239ae4cd2f7b712644441cdc72c81a3"
},
{
"url": "https://git.kernel.org/stable/c/6dc781778b595be94c31395b2cb167f65145d91f"
},
{
"url": "https://git.kernel.org/stable/c/7aad70cabd8f34cf11a9593fcd3f2ac3f5496943"
},
{
"url": "https://git.kernel.org/stable/c/7c349b4f2a603202fb8c363bd2774a22ac2fddf3"
}
],
"title": "ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74388",
"datePublished": "2026-08-15T05:59:03.147Z",
"dateReserved": "2026-08-15T05:44:03.891Z",
"dateUpdated": "2026-10-30T12:29:53.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68359 (GCVE-0-2025-68359)
Vulnerability from cvelistv5
Published
2025-12-24 10:32
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix double free of qgroup record after failure to add delayed ref head
In the previous code it was possible to incur into a double kfree()
scenario when calling add_delayed_ref_head(). This could happen if the
record was reported to already exist in the
btrfs_qgroup_trace_extent_nolock() call, but then there was an error
later on add_delayed_ref_head(). In this case, since
add_delayed_ref_head() returned an error, the caller went to free the
record. Since add_delayed_ref_head() couldn't set this kfree'd pointer
to NULL, then kfree() would have acted on a non-NULL 'record' object
which was pointing to memory already freed by the callee.
The problem comes from the fact that the responsibility to kfree the
object is on both the caller and the callee at the same time. Hence, the
fix for this is to shift the ownership of the 'qrecord' object out of
the add_delayed_ref_head(). That is, we will never attempt to kfree()
the given object inside of this function, and will expect the caller to
act on the 'qrecord' object on its own. The only exception where the
'qrecord' object cannot be kfree'd is if it was inserted into the
tracing logic, for which we already have the 'qrecord_inserted_ret'
boolean to account for this. Hence, the caller has to kfree the object
only if add_delayed_ref_head() reports not to have inserted it on the
tracing logic.
As a side-effect of the above, we must guarantee that
'qrecord_inserted_ret' is properly initialized at the start of the
function, not at the end, and then set when an actual insert
happens. This way we avoid 'qrecord_inserted_ret' having an invalid
value on an early exit.
The documentation from the add_delayed_ref_head() has also been updated
to reflect on the exact ownership of the 'qrecord' object.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/delayed-ref.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82d46660ebd94c269e3f25a77eb563621d8e67e3",
"status": "affected",
"version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845",
"versionType": "git"
},
{
"lessThan": "7617680769e3119dfb3b43a2b7c287ce2242211c",
"status": "affected",
"version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845",
"versionType": "git"
},
{
"lessThan": "364685c4c2d9c9f4408d95451bcf42fdeebc3ebb",
"status": "affected",
"version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845",
"versionType": "git"
},
{
"lessThan": "725e46298876a2cc1f1c3fb22ba69d29102c3ddf",
"status": "affected",
"version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/delayed-ref.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free of qgroup record after failure to add delayed ref head\n\nIn the previous code it was possible to incur into a double kfree()\nscenario when calling add_delayed_ref_head(). This could happen if the\nrecord was reported to already exist in the\nbtrfs_qgroup_trace_extent_nolock() call, but then there was an error\nlater on add_delayed_ref_head(). In this case, since\nadd_delayed_ref_head() returned an error, the caller went to free the\nrecord. Since add_delayed_ref_head() couldn\u0027t set this kfree\u0027d pointer\nto NULL, then kfree() would have acted on a non-NULL \u0027record\u0027 object\nwhich was pointing to memory already freed by the callee.\n\nThe problem comes from the fact that the responsibility to kfree the\nobject is on both the caller and the callee at the same time. Hence, the\nfix for this is to shift the ownership of the \u0027qrecord\u0027 object out of\nthe add_delayed_ref_head(). That is, we will never attempt to kfree()\nthe given object inside of this function, and will expect the caller to\nact on the \u0027qrecord\u0027 object on its own. The only exception where the\n\u0027qrecord\u0027 object cannot be kfree\u0027d is if it was inserted into the\ntracing logic, for which we already have the \u0027qrecord_inserted_ret\u0027\nboolean to account for this. Hence, the caller has to kfree the object\nonly if add_delayed_ref_head() reports not to have inserted it on the\ntracing logic.\n\nAs a side-effect of the above, we must guarantee that\n\u0027qrecord_inserted_ret\u0027 is properly initialized at the start of the\nfunction, not at the end, and then set when an actual insert\nhappens. This way we avoid \u0027qrecord_inserted_ret\u0027 having an invalid\nvalue on an early exit.\n\nThe documentation from the add_delayed_ref_head() has also been updated\nto reflect on the exact ownership of the \u0027qrecord\u0027 object."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - NFSv4.2 DEALLOCATE and ksmbd FSCTL_SET_ZERO_DATA can remotely invoke hole punching on exported Btrfs files, reaching the vulnerable delayed-reference path.\nAC:L - An attacker can repeatedly manipulate shared extents, issue concurrent deallocations, and drive delayed-reference processing and memory pressure; both sides of the required race are attacker-influenceable.\nPR:N - An anonymous writable NFS export or writable ksmbd guest share permits the required operations without credentials or kernel capabilities.\nUI:N - Once qgroup accounting and the writable export are configured, exploitation requires no action by another user.\nS:U - The corruption compromises the same host-kernel security authority and does not cross a virtualization or other security-scope boundary.\nC:H - The double free can corrupt the slab freelist and produce overlapping allocations, enabling kernel-memory disclosure and arbitrary reads.\nI:H - Freelist corruption and overlapping allocations can provide attacker-controlled kernel writes and control-flow hijacking.\nA:H - Freelist hardening can immediately trigger a BUG, while unhardened allocators suffer freelist corruption that can crash or panic the kernel repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:17.109Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82d46660ebd94c269e3f25a77eb563621d8e67e3"
},
{
"url": "https://git.kernel.org/stable/c/7617680769e3119dfb3b43a2b7c287ce2242211c"
},
{
"url": "https://git.kernel.org/stable/c/364685c4c2d9c9f4408d95451bcf42fdeebc3ebb"
},
{
"url": "https://git.kernel.org/stable/c/725e46298876a2cc1f1c3fb22ba69d29102c3ddf"
}
],
"title": "btrfs: fix double free of qgroup record after failure to add delayed ref head",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68359",
"datePublished": "2025-12-24T10:32:48.456Z",
"dateReserved": "2025-12-16T14:48:05.305Z",
"dateUpdated": "2026-10-21T12:38:17.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99156 (GCVE-0-2026-99156)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-31 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: st: Fix use-after-free race between st_remove() and st_open()
st_remove() drops the probe reference on the scsi_tape with kref_put()
and only afterwards removes its index from st_index_idr. If that was the
last reference, scsi_tape_release() frees the structure while it is
still published in the idr.
scsi_tape_get(), called from st_open(), looks up the tape in
st_index_idr and takes a reference under st_ref_mutex and
st_index_lock. remove_cdevs() does not wait for opens that are already
past chrdev_open(), so an open that is blocked on st_ref_mutex while
st_remove() holds it can take the mutex as soon as st_remove() drops it,
find the freed tpnt in the idr and call kref_get() on it:
BUG: KASAN: slab-use-after-free in st_open
Write of size 4 ...
st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)
chrdev_open
...
Freed by task ...:
kfree
st_remove (drivers/scsi/st.c:4512)
Remove the index from the idr before dropping the reference, all under
st_ref_mutex. A concurrent scsi_tape_get() now either runs first and
holds a valid reference that keeps the tape alive, or runs afterwards
and finds nothing, so st_open() fails with -ENXIO.
This restores the ordering st_remove() had before the conversion to
st_index_idr, where the tape was unpublished from scsi_tapes[] before
the final kref_put().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 Version: 6c648d95a6af4a79241a916871df17c84c68ea20 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/st.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d7f9d2ee4b0841f3eba9fa3627044ad329428de",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "d9517fc39ec3ee13eadefdc17f45300f7d23ed8c",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "00ff1128123d4bdfacd28d68fb4b6e6f657a3648",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "5ef230f734e0d23db007c8405f38b7e226740084",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "a1647b653549ff29f0422a63eabf329b842f3822",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "18a0e3733ce38718688e813e5e2d1106bd4830e5",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
},
{
"lessThan": "71caf7f84bd62a4bf91cc95abd2de690afb8d15f",
"status": "affected",
"version": "6c648d95a6af4a79241a916871df17c84c68ea20",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/st.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n BUG: KASAN: slab-use-after-free in st_open\n Write of size 4 ...\n st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n chrdev_open\n ...\n Freed by task ...:\n kfree\n st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local openat() reaches st_open() through chrdev_open(), then scsi_tape_get(); concurrent hot-unplug reaches the patched st_remove() through __scsi_remove_device(), with no network-supplied input.\nAC:L - A tape-device user controlling a hotpluggable TYPE_TAPE device can flood /dev/stN opens while disconnecting it, controlling both st_open() and st_remove() and retrying the race at will.\nPR:L - st_open() and scsi_tape_get() perform no capability check; may_open() applies device-node DAC and device-cgroup policy, so a tape-group user controlling an external tape needs no init-namespace administrative privilege.\nUI:N - The attacker performs both the /dev/stN open flood and device disconnect; no separate victim must open the tape, remove it, or mount attacker-supplied content.\nS:U - The freed scsi_tape object and subsequent corruption remain within the host kernel\u0027s SCSI-tape authority, without crossing a VM, IOMMU, or sandbox security boundary.\nC:H - st_remove() leaves a freed kmalloc-1k scsi_tape in st_index_idr; scsi_tape_get() reads its device pointer and st_open() follows buffer and mode pointers from reclaimable storage, enabling kernel-memory disclosure.\nI:H - kref_get() performs a confirmed four-byte write into the freed scsi_tape, and successful reclamation exposes further st_open() writes through in_use, state, and buffer fields, supporting control-flow hijacking.\nA:H - The stale device and buffer pointers are subsequently dereferenced by scsi_device_get() and st_open() buffer handling; the reported UAF proceeds to unrelated corruption, oops/GPF, and kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:44:14.895Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d7f9d2ee4b0841f3eba9fa3627044ad329428de"
},
{
"url": "https://git.kernel.org/stable/c/d9517fc39ec3ee13eadefdc17f45300f7d23ed8c"
},
{
"url": "https://git.kernel.org/stable/c/e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7"
},
{
"url": "https://git.kernel.org/stable/c/00ff1128123d4bdfacd28d68fb4b6e6f657a3648"
},
{
"url": "https://git.kernel.org/stable/c/5ef230f734e0d23db007c8405f38b7e226740084"
},
{
"url": "https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822"
},
{
"url": "https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5"
},
{
"url": "https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"
}
],
"title": "scsi: st: Fix use-after-free race between st_remove() and st_open()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99156",
"datePublished": "2026-10-28T10:35:10.493Z",
"dateReserved": "2026-09-25T10:25:14.397Z",
"dateUpdated": "2026-10-31T12:44:14.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74537 (GCVE-0-2026-74537)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-30 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: hold sk properly in iso_conn_ready
sk deref in iso_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk is currently
accessed without either:
[Task 1] [Task 2]
iso_sock_release
iso_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
iso_sock_kill(sk)
UAF on sk deref
Fix possible UAF by holding sk refcount in iso_conn_ready(). Also
recheck after lock_sock that the socket is still valid. Adjust locking
so conn->sk is cleared only under lock_sock.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 27c24fda62b601d6f9ca5e992502578c4310876f Version: 27c24fda62b601d6f9ca5e992502578c4310876f Version: 27c24fda62b601d6f9ca5e992502578c4310876f Version: 27c24fda62b601d6f9ca5e992502578c4310876f Version: 27c24fda62b601d6f9ca5e992502578c4310876f Version: 27c24fda62b601d6f9ca5e992502578c4310876f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:33.051138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:54.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "622180fe44fb52d4d7bafcd67922959823fec263",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "44590dc53c9e949d2fed399a571a89c3d7d0b245",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "99b65f0ea3370c13687ff870330c425b6ca44e89",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "1308d72903d792d10b82bc4ef08b8a4452308b04",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "0d255e63fcf3f13a570d7ac11678fa1164ac015c",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: hold sk properly in iso_conn_ready\n\nsk deref in iso_conn_ready must be done either under conn-\u003elock, or\nholding a refcount, to avoid concurrent close. conn-\u003esk is currently\naccessed without either:\n\n [Task 1] [Task 2]\n iso_sock_release\n iso_conn_ready\n sk = conn-\u003esk\n lock_sock(sk)\n conn-\u003esk = NULL\n lock_sock(sk)\n release_sock(sk)\n iso_sock_kill(sk)\n UAF on sk deref\n\nFix possible UAF by holding sk refcount in iso_conn_ready(). Also\nrecheck after lock_sock that the socket is still valid. Adjust locking\nso conn-\u003esk is cleared only under lock_sock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk-\u003esk_state and sk-\u003esk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:30:07.803Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/622180fe44fb52d4d7bafcd67922959823fec263"
},
{
"url": "https://git.kernel.org/stable/c/44590dc53c9e949d2fed399a571a89c3d7d0b245"
},
{
"url": "https://git.kernel.org/stable/c/99b65f0ea3370c13687ff870330c425b6ca44e89"
},
{
"url": "https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5"
},
{
"url": "https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04"
},
{
"url": "https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c"
}
],
"title": "Bluetooth: ISO: hold sk properly in iso_conn_ready",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74537",
"datePublished": "2026-08-15T12:27:49.668Z",
"dateReserved": "2026-08-15T05:44:03.913Z",
"dateUpdated": "2026-10-30T12:30:07.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90337 (GCVE-0-2026-90337)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: core: do fallible allocations before the console can be registered
serial_core_add_one_port() allocates uport->tty_groups after
uart_configure_port(), which may register the console. If the allocation
fails, the driver unwinds the port while its console remains registered.
The earlier uport->name allocation has a related failure path that leaves
state->uart_port linked to a port being freed.
Failslab reproduced a NULL dereference in PL011 console output and a KASAN
use-after-free in i.MX console output after failed binds.
Allocate the name and tty_groups before linking the port and configuring
it. Reserve space for the optional driver attribute group because
config_port() may populate uport->attr_group during configuration.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 266dcff03eed0050b6af11aaf2a61ab837d7ba3f Version: 266dcff03eed0050b6af11aaf2a61ab837d7ba3f Version: 266dcff03eed0050b6af11aaf2a61ab837d7ba3f Version: 266dcff03eed0050b6af11aaf2a61ab837d7ba3f Version: 266dcff03eed0050b6af11aaf2a61ab837d7ba3f Version: 266dcff03eed0050b6af11aaf2a61ab837d7ba3f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/serial_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be61f56c4f0ed1cbf16c5f7b0dec6d6414993dd4",
"status": "affected",
"version": "266dcff03eed0050b6af11aaf2a61ab837d7ba3f",
"versionType": "git"
},
{
"lessThan": "e2ddbfd826836cba1b7a25ee4eb512f7d752b703",
"status": "affected",
"version": "266dcff03eed0050b6af11aaf2a61ab837d7ba3f",
"versionType": "git"
},
{
"lessThan": "8c7c75bfa7b84d6999de2100ce9c09e3779249a0",
"status": "affected",
"version": "266dcff03eed0050b6af11aaf2a61ab837d7ba3f",
"versionType": "git"
},
{
"lessThan": "9260a92ce90e6a95ce2ffdf1441c5216bf3f9552",
"status": "affected",
"version": "266dcff03eed0050b6af11aaf2a61ab837d7ba3f",
"versionType": "git"
},
{
"lessThan": "c2aec15f78b2e6ccd9b94216a901248511355982",
"status": "affected",
"version": "266dcff03eed0050b6af11aaf2a61ab837d7ba3f",
"versionType": "git"
},
{
"lessThan": "1a0e4fbce5d9c1bc179a35a2fd9ed142664299e3",
"status": "affected",
"version": "266dcff03eed0050b6af11aaf2a61ab837d7ba3f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/serial_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: do fallible allocations before the console can be registered\n\nserial_core_add_one_port() allocates uport-\u003etty_groups after\nuart_configure_port(), which may register the console. If the allocation\nfails, the driver unwinds the port while its console remains registered.\nThe earlier uport-\u003ename allocation has a related failure path that leaves\nstate-\u003euart_port linked to a port being freed.\n\nFailslab reproduced a NULL dereference in PL011 console output and a KASAN\nuse-after-free in i.MX console output after failed binds.\n\nAllocate the name and tty_groups before linking the port and configuring\nit. Reserve space for the optional driver attribute group because\nconfig_port() may populate uport-\u003eattr_group during configuration."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:15.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be61f56c4f0ed1cbf16c5f7b0dec6d6414993dd4"
},
{
"url": "https://git.kernel.org/stable/c/e2ddbfd826836cba1b7a25ee4eb512f7d752b703"
},
{
"url": "https://git.kernel.org/stable/c/8c7c75bfa7b84d6999de2100ce9c09e3779249a0"
},
{
"url": "https://git.kernel.org/stable/c/9260a92ce90e6a95ce2ffdf1441c5216bf3f9552"
},
{
"url": "https://git.kernel.org/stable/c/c2aec15f78b2e6ccd9b94216a901248511355982"
},
{
"url": "https://git.kernel.org/stable/c/1a0e4fbce5d9c1bc179a35a2fd9ed142664299e3"
}
],
"title": "serial: core: do fallible allocations before the console can be registered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90337",
"datePublished": "2026-09-17T16:08:49.687Z",
"dateReserved": "2026-09-11T19:38:34.804Z",
"dateUpdated": "2026-10-30T12:35:15.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72073 (GCVE-0-2026-72073)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-11-06 16:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix use-after-free on probe failure
The vub300 driver lifetime-manages its controller state using
vub300->kref, with vub300_delete() freeing the mmc host when the last
reference is dropped. The probe error path after the inactivity timer has
been armed still bypasses that lifetime rule, however, and falls through
to mmc_free_host() directly if mmc_add_host() fails.
The race window is between arming the inactivity timer and reaching the
probe error unwind after mmc_add_host() fails:
probe thread timer/workqueue
------------ ---------------
kref_init(&vub300->kref) ref = 1
kref_get(&vub300->kref) ref = 2, timer ref
add_timer(inactivity_timer) fires after one second
|
| race window
|<---------------------------------------------------->
|
mmc_add_host(mmc)
inactivity timer fires
vub300_queue_dead_work()
kref_get() ref = 3
queue_work(deadwork)
mmc_add_host() fails
timer_delete_sync()
mmc_free_host(mmc)
frees vub300
deadwork runs
use-after-free
The inactivity timeout is one second, so this would require
mmc_add_host() to both fail and take more than one second to do so. This
is unlikely to happen in practice, but the error path is still wrong.
timer_delete_sync() only waits for the timer callback itself. It does
not flush deadwork that the callback may already have queued. As a
result, queued deadwork can still hold a kref while the probe error path
directly frees the backing mmc host, including the vub300 storage.
Fix this by using the same lifetime mechanism as disconnect. Clear
vub300->interface so that the timer callback and any queued deadwork
return early and drop their references, then drop the initial probe
reference and return without falling through to err_free_host.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0613ad2401f88bdeae5594c30afe318e93b14676 Version: 0613ad2401f88bdeae5594c30afe318e93b14676 Version: 0613ad2401f88bdeae5594c30afe318e93b14676 Version: 0613ad2401f88bdeae5594c30afe318e93b14676 Version: 0613ad2401f88bdeae5594c30afe318e93b14676 Version: 41ed46bdbd2878cd6567abe0974a445f8b1b8ec8 Version: 25f05d762ca5e1c685002a53dd44f68e78ca3feb Version: a46e681151bbdacdf6b89ee8c4e5bad0555142bb Version: 3b29f8769d32016b2d89183db4d80c7a71b7e35e Version: 3049a3b927a40d89d4582ff1033cd7953be773c7 Version: afc898019e7bf18c5eb7a0ac19852fcb1b341b3c Version: c9e85979b59cb86f0a15defa8199d740e2b36b90 Version: 2044b2ea77945f372ef161d1bbf814e471767ff2 Version: 4.9.337 ≤ Version: 4.14.303 ≤ Version: 4.19.270 ≤ Version: 5.4.229 ≤ Version: 5.10.163 ≤ Version: 5.15.86 ≤ Version: 6.0.16 ≤ Version: 6.1.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:51:15.978631Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:55:19.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/vub300.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "face65f80c6946c631ca3490b4ebd2c016a4fd2c",
"status": "affected",
"version": "0613ad2401f88bdeae5594c30afe318e93b14676",
"versionType": "git"
},
{
"lessThan": "6c66653dac9b25272d5fd4ed42a34aa5249e16df",
"status": "affected",
"version": "0613ad2401f88bdeae5594c30afe318e93b14676",
"versionType": "git"
},
{
"lessThan": "5b82af744e06cd741938c3da54fdbe564a7e52d9",
"status": "affected",
"version": "0613ad2401f88bdeae5594c30afe318e93b14676",
"versionType": "git"
},
{
"lessThan": "618cf6b139503ec18ef93ffd663396aaf99b763a",
"status": "affected",
"version": "0613ad2401f88bdeae5594c30afe318e93b14676",
"versionType": "git"
},
{
"lessThan": "a3b5f242997a3be7404112fd48784881560aea57",
"status": "affected",
"version": "0613ad2401f88bdeae5594c30afe318e93b14676",
"versionType": "git"
},
{
"status": "affected",
"version": "41ed46bdbd2878cd6567abe0974a445f8b1b8ec8",
"versionType": "git"
},
{
"status": "affected",
"version": "25f05d762ca5e1c685002a53dd44f68e78ca3feb",
"versionType": "git"
},
{
"status": "affected",
"version": "a46e681151bbdacdf6b89ee8c4e5bad0555142bb",
"versionType": "git"
},
{
"status": "affected",
"version": "3b29f8769d32016b2d89183db4d80c7a71b7e35e",
"versionType": "git"
},
{
"status": "affected",
"version": "3049a3b927a40d89d4582ff1033cd7953be773c7",
"versionType": "git"
},
{
"status": "affected",
"version": "afc898019e7bf18c5eb7a0ac19852fcb1b341b3c",
"versionType": "git"
},
{
"status": "affected",
"version": "c9e85979b59cb86f0a15defa8199d740e2b36b90",
"versionType": "git"
},
{
"status": "affected",
"version": "2044b2ea77945f372ef161d1bbf814e471767ff2",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/vub300.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.303",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix use-after-free on probe failure\n\nThe vub300 driver lifetime-manages its controller state using\nvub300-\u003ekref, with vub300_delete() freeing the mmc host when the last\nreference is dropped. The probe error path after the inactivity timer has\nbeen armed still bypasses that lifetime rule, however, and falls through\nto mmc_free_host() directly if mmc_add_host() fails.\n\nThe race window is between arming the inactivity timer and reaching the\nprobe error unwind after mmc_add_host() fails:\n\n probe thread timer/workqueue\n ------------ ---------------\n kref_init(\u0026vub300-\u003ekref) ref = 1\n kref_get(\u0026vub300-\u003ekref) ref = 2, timer ref\n add_timer(inactivity_timer) fires after one second\n |\n | race window\n |\u003c----------------------------------------------------\u003e\n |\n mmc_add_host(mmc)\n inactivity timer fires\n vub300_queue_dead_work()\n kref_get() ref = 3\n queue_work(deadwork)\n mmc_add_host() fails\n timer_delete_sync()\n mmc_free_host(mmc)\n frees vub300\n deadwork runs\n use-after-free\n\nThe inactivity timeout is one second, so this would require\nmmc_add_host() to both fail and take more than one second to do so. This\nis unlikely to happen in practice, but the error path is still wrong.\n\ntimer_delete_sync() only waits for the timer callback itself. It does\nnot flush deadwork that the callback may already have queued. As a\nresult, queued deadwork can still hold a kref while the probe error path\ndirectly frees the backing mmc host, including the vub300 storage.\n\nFix this by using the same lifetime mechanism as disconnect. Clear\nvub300-\u003einterface so that the timer callback and any queued deadwork\nreturn early and drop their references, then drop the initial probe\nreference and return without falling through to err_free_host."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:20.898Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/face65f80c6946c631ca3490b4ebd2c016a4fd2c"
},
{
"url": "https://git.kernel.org/stable/c/6c66653dac9b25272d5fd4ed42a34aa5249e16df"
},
{
"url": "https://git.kernel.org/stable/c/5b82af744e06cd741938c3da54fdbe564a7e52d9"
},
{
"url": "https://git.kernel.org/stable/c/618cf6b139503ec18ef93ffd663396aaf99b763a"
},
{
"url": "https://git.kernel.org/stable/c/a3b5f242997a3be7404112fd48784881560aea57"
}
],
"title": "mmc: vub300: fix use-after-free on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72073",
"datePublished": "2026-08-15T05:52:24.676Z",
"dateReserved": "2026-08-09T03:40:39.904Z",
"dateUpdated": "2026-11-06T16:55:19.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43101 (GCVE-0-2026-43101)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-10-30 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
We need to check __in6_dev_get() for possible NULL value, as
suggested by Yiming Qian.
Also add skb_dst_dev_rcu() instead of skb_dst_dev(),
and two missing READ_ONCE().
Note that @dev can't be NULL.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 Version: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 Version: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 Version: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 Version: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 Version: 9ee11f0fff205b4b3df9750bff5e94f97c71b6a0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd0d2827b3643ff307c766865f8e31eab5cbd1f5",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "34b8390ac0ba57004b90ea568ac06f50bf896a80",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "f87aa5d1a7f56727a768757613a303b4245444a1",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "4198aab6f000b4febb18ea820fea20634dd789c7",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "3719c234fa94c37c955b1ecd3742ef280ec135e6",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "4e65a8b8daa18d63255ec58964dd192c7fdd9f8b",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()\n\nWe need to check __in6_dev_get() for possible NULL value, as\nsuggested by Yiming Qian.\n\nAlso add skb_dst_dev_rcu() instead of skb_dst_dev(),\nand two missing READ_ONCE().\n\nNote that @dev can\u0027t be NULL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable helper is reachable while processing IPv6 IOAM Hop-by-Hop options and IOAM LWT output for packets crossing an IOAM-enabled IPv6 node, so an attacker can trigger it with network traffic in a configured IOAM deployment.\nAC:L - Once IOAM is enabled/configured on the target path, triggering only requires a valid pre-allocated trace with ingress/egress interface ID fields and a route/device state where `__in6_dev_get()` returns NULL; there is no race or difficult timing requirement.\nPR:N - The attacker does not need credentials on the target to send the triggering IPv6 traffic; the administrative IOAM setup is a target deployment condition rather than an attacker privilege.\nUI:N - No victim user action is required after the vulnerable node is configured; packet processing alone reaches the dereference.\nS:U - The impact is within the same kernel/networking security authority and does not cross a VM, IOMMU, or similar boundary.\nC:N - The bug is a NULL pointer dereference of missing IPv6 device state, not an out-of-bounds read or information disclosure primitive.\nI:N - The fixed issue does not provide attacker-controlled writes or data modification; it only prevents dereferencing NULL `inet6_dev` pointers.\nA:H - A NULL pointer dereference in kernel packet processing can oops or panic the system, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:56.256Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd0d2827b3643ff307c766865f8e31eab5cbd1f5"
},
{
"url": "https://git.kernel.org/stable/c/34b8390ac0ba57004b90ea568ac06f50bf896a80"
},
{
"url": "https://git.kernel.org/stable/c/f87aa5d1a7f56727a768757613a303b4245444a1"
},
{
"url": "https://git.kernel.org/stable/c/4198aab6f000b4febb18ea820fea20634dd789c7"
},
{
"url": "https://git.kernel.org/stable/c/3719c234fa94c37c955b1ecd3742ef280ec135e6"
},
{
"url": "https://git.kernel.org/stable/c/4e65a8b8daa18d63255ec58964dd192c7fdd9f8b"
}
],
"title": "ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43101",
"datePublished": "2026-05-06T07:40:30.969Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-10-30T12:24:56.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46066 (GCVE-0-2026-46066)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix num_ops off-by-one when crypto allocation fails
move_dirty_folio_in_page_array() may fail if the file is encrypted, the
dirty folio is not the first in the batch, and it fails to allocate a
bounce buffer to hold the ciphertext. When that happens,
ceph_process_folio_batch() simply redirties the folio and flushes the
current batch -- it can retry that folio in a future batch.
However, if this failed folio is not contiguous with the last folio that
did make it into the batch, then ceph_process_folio_batch() has already
incremented `ceph_wbc->num_ops`; because it doesn't follow through and
add the discontiguous folio to the array, ceph_submit_write() -- which
expects that `ceph_wbc->num_ops` accurately reflects the number of
contiguous ranges (and therefore the required number of "write extent"
ops) in the writeback -- will panic the kernel:
BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops);
This issue can be reproduced on affected kernels by writing to
fscrypt-enabled CephFS file(s) with a 4KiB-written/4KiB-skipped/repeat
pattern (total filesize should not matter) and gradually increasing the
system's memory pressure until a bounce buffer allocation fails.
Fix this crash by decrementing `ceph_wbc->num_ops` back to the correct
value when move_dirty_folio_in_page_array() fails, but the folio already
started counting a new (i.e. still-empty) extent.
The defect corrected by this patch has existed since 2022 (see first
`Fixes:`), but another bug blocked multi-folio encrypted writeback until
recently (see second `Fixes:`). The second commit made it into 6.18.16,
6.19.6, and 7.0-rc1, unmasking the panic in those versions. This patch
therefore fixes a regression (panic) introduced by cac190c7674f.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46066",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:07:03.702613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:35.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/addr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f65a96fe2467a9b184c6ae963d95a260a202c98e",
"status": "affected",
"version": "d55207717ded95c8f2760a30e93319fa313186e6",
"versionType": "git"
},
{
"lessThan": "5dd151799d826d3736ae60c2b22cbc9d96a2a613",
"status": "affected",
"version": "d55207717ded95c8f2760a30e93319fa313186e6",
"versionType": "git"
},
{
"lessThan": "6200f41d6fcf2ac7e24866431e381cbc914560e4",
"status": "affected",
"version": "d55207717ded95c8f2760a30e93319fa313186e6",
"versionType": "git"
},
{
"lessThan": "ba12c1e578890f6337a415b7dedf476c6d455105",
"status": "affected",
"version": "d55207717ded95c8f2760a30e93319fa313186e6",
"versionType": "git"
},
{
"lessThan": "a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842",
"status": "affected",
"version": "d55207717ded95c8f2760a30e93319fa313186e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/addr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix num_ops off-by-one when crypto allocation fails\n\nmove_dirty_folio_in_page_array() may fail if the file is encrypted, the\ndirty folio is not the first in the batch, and it fails to allocate a\nbounce buffer to hold the ciphertext. When that happens,\nceph_process_folio_batch() simply redirties the folio and flushes the\ncurrent batch -- it can retry that folio in a future batch.\n\nHowever, if this failed folio is not contiguous with the last folio that\ndid make it into the batch, then ceph_process_folio_batch() has already\nincremented `ceph_wbc-\u003enum_ops`; because it doesn\u0027t follow through and\nadd the discontiguous folio to the array, ceph_submit_write() -- which\nexpects that `ceph_wbc-\u003enum_ops` accurately reflects the number of\ncontiguous ranges (and therefore the required number of \"write extent\"\nops) in the writeback -- will panic the kernel:\n\n BUG_ON(ceph_wbc-\u003eop_idx + 1 != req-\u003er_num_ops);\n\nThis issue can be reproduced on affected kernels by writing to\nfscrypt-enabled CephFS file(s) with a 4KiB-written/4KiB-skipped/repeat\npattern (total filesize should not matter) and gradually increasing the\nsystem\u0027s memory pressure until a bounce buffer allocation fails.\n\nFix this crash by decrementing `ceph_wbc-\u003enum_ops` back to the correct\nvalue when move_dirty_folio_in_page_array() fails, but the folio already\nstarted counting a new (i.e. still-empty) extent.\n\nThe defect corrected by this patch has existed since 2022 (see first\n`Fixes:`), but another bug blocked multi-folio encrypted writeback until\nrecently (see second `Fixes:`). The second commit made it into 6.18.16,\n6.19.6, and 7.0-rc1, unmasking the panic in those versions. This patch\ntherefore fixes a regression (panic) introduced by cac190c7674f."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:16.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f65a96fe2467a9b184c6ae963d95a260a202c98e"
},
{
"url": "https://git.kernel.org/stable/c/5dd151799d826d3736ae60c2b22cbc9d96a2a613"
},
{
"url": "https://git.kernel.org/stable/c/6200f41d6fcf2ac7e24866431e381cbc914560e4"
},
{
"url": "https://git.kernel.org/stable/c/ba12c1e578890f6337a415b7dedf476c6d455105"
},
{
"url": "https://git.kernel.org/stable/c/a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842"
}
],
"title": "ceph: fix num_ops off-by-one when crypto allocation fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46066",
"datePublished": "2026-05-27T12:57:41.865Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-11-06T16:13:35.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72488 (GCVE-0-2026-72488)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-30 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soundwire: fix bug in sdw_add_element_group_count found by syzkaller
The original implementation caused an out-of-bounds memory access
in the sdw_add_element_group_count for-loop when i == num.
for (i = 0; i <= num; i++) {
if (rate == group->rates[i] && lane == group->lanes[i])
...
To fix this error, the function now checks for existing rate/lane
entries in the group(a function parameter) using a for-loop before
adding them.
No functional changes apart from this fix.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9026118f20e28f202dab34f219bbb831ffb8c4dc Version: 9026118f20e28f202dab34f219bbb831ffb8c4dc Version: 9026118f20e28f202dab34f219bbb831ffb8c4dc Version: 9026118f20e28f202dab34f219bbb831ffb8c4dc Version: 9026118f20e28f202dab34f219bbb831ffb8c4dc Version: 9026118f20e28f202dab34f219bbb831ffb8c4dc |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:47.454898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:26.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soundwire/generic_bandwidth_allocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c35474cf6a7d0891ebebbeda08ce34b602885ab6",
"status": "affected",
"version": "9026118f20e28f202dab34f219bbb831ffb8c4dc",
"versionType": "git"
},
{
"lessThan": "a2275dce05e6d1cce69bf68f23ea7a63c0c54bae",
"status": "affected",
"version": "9026118f20e28f202dab34f219bbb831ffb8c4dc",
"versionType": "git"
},
{
"lessThan": "5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5",
"status": "affected",
"version": "9026118f20e28f202dab34f219bbb831ffb8c4dc",
"versionType": "git"
},
{
"lessThan": "a454f61747c97e2eadaa7a35ffc1f4b1645c6a53",
"status": "affected",
"version": "9026118f20e28f202dab34f219bbb831ffb8c4dc",
"versionType": "git"
},
{
"lessThan": "e483a406a23a92d5202e8d324f206e127eef48ff",
"status": "affected",
"version": "9026118f20e28f202dab34f219bbb831ffb8c4dc",
"versionType": "git"
},
{
"lessThan": "f772ff5a0e6758fd412803c09e03ba3bca5f5878",
"status": "affected",
"version": "9026118f20e28f202dab34f219bbb831ffb8c4dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soundwire/generic_bandwidth_allocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: fix bug in sdw_add_element_group_count found by syzkaller\n\nThe original implementation caused an out-of-bounds memory access\nin the sdw_add_element_group_count for-loop when i == num.\n\nfor (i = 0; i \u003c= num; i++) {\n if (rate == group-\u003erates[i] \u0026\u0026 lane == group-\u003elanes[i])\n ...\n\nTo fix this error, the function now checks for existing rate/lane\nentries in the group(a function parameter) using a for-loop before\nadding them.\n\nNo functional changes apart from this fix."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Vulnerable sdw_add_element_group_count is reached only via local ALSA PCM ioctl (SNDRV_PCM_IOCTL_PREPARE/HW_PARAMS) on /dev/snd/pcmC*D*, through asoc_sdw_prepare -\u003e sdw_prepare_stream -\u003e sdw_compute_params on Intel SoundWire machines; no network or adjacent-network entry point exists.\nAC:L - The off-by-one loop (i \u003c= num when num==group-\u003ecount) deterministically reads one slot past the rates/lanes arrays whenever a second distinct rate/lane group entry is added, which an attacker can trigger by preparing SoundWire streams that exercise multilane assignment or multiple active bus runtimes without races or external state.\nPR:L - Exploitation requires only the ability to open and ioctl the ALSA PCM character device (typically granted to unprivileged desktop users via the audio group or logind seat ACLs on Intel SOF/SoundWire laptops); no CAP_SYS_ADMIN, real root, or non-namespace capability is checked on this path.\nUI:N - The attacker\u0027s own process issues the PCM prepare/hw_params ioctls that drive bandwidth recomputation; no separate victim must mount filesystems, open files, or take any other action beyond the attacker already having local device access.\nS:U - The out-of-bounds access corrupts/read kernel heap memory within the SoundWire bandwidth allocator in the same kernel security domain; it does not cross VM, container, IOMMU, or sandbox boundaries.\nC:H - When i==group-\u003ecount the loop compares against group-\u003erates[i] and group-\u003elanes[i] one element beyond the allocated arrays, leaking adjacent kmalloc heap contents; per kernel guidance unbounded out-of-bounds reads in the allocator path warrant High confidentiality impact.\nI:H - Even though the immediate fault is an OOB read, the same loop guards heap-backed dynamic expansion that then writes attacker-influenced rate/lane tuples into rates[]/lanes[]; adjacent-heap corruption from the read plus controlled follow-on writes is leverageable for integrity compromise consistent with similar SoundWire CVE scoring.\nA:H - The out-of-bounds read can fault on unmapped adjacent slab memory or trip KASAN/hardened checks (as syzkaller reported), producing kernel oops/panic and aborting stream prepare, leaving audio/DSP subsystems unavailable on affected Intel SoundWire platforms."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:29:30.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c35474cf6a7d0891ebebbeda08ce34b602885ab6"
},
{
"url": "https://git.kernel.org/stable/c/a2275dce05e6d1cce69bf68f23ea7a63c0c54bae"
},
{
"url": "https://git.kernel.org/stable/c/5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5"
},
{
"url": "https://git.kernel.org/stable/c/a454f61747c97e2eadaa7a35ffc1f4b1645c6a53"
},
{
"url": "https://git.kernel.org/stable/c/e483a406a23a92d5202e8d324f206e127eef48ff"
},
{
"url": "https://git.kernel.org/stable/c/f772ff5a0e6758fd412803c09e03ba3bca5f5878"
}
],
"title": "soundwire: fix bug in sdw_add_element_group_count found by syzkaller",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72488",
"datePublished": "2026-08-15T05:57:24.146Z",
"dateReserved": "2026-08-09T03:40:39.936Z",
"dateUpdated": "2026-10-30T12:29:30.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64154 (GCVE-0-2026-64154)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
In a6xx_gpu_init(), node is obtained via of_parse_phandle().
While there was a manual of_node_put() at the end of the
common path, several early error returns would bypass this call,
resulting in a reference leak.
Fix this by using the __free(device_node) cleanup handler to
release the reference when the variable goes out of scope.
Patchwork: https://patchwork.freedesktop.org/patch/700661/
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdad77438cc2ba006b041eb02adccb0b9f8cffad",
"status": "affected",
"version": "5a903a44a98471cedf0021fac0a6a64bbe86943f",
"versionType": "git"
},
{
"lessThan": "bd750e4043bbd9e2ef69de50b11bd6f98c366cc0",
"status": "affected",
"version": "5a903a44a98471cedf0021fac0a6a64bbe86943f",
"versionType": "git"
},
{
"lessThan": "b76568c6721840a4ddb65e24e2849db0f8e83461",
"status": "affected",
"version": "5a903a44a98471cedf0021fac0a6a64bbe86943f",
"versionType": "git"
},
{
"lessThan": "2be24c945e76cd538ce5dd2e50f5d3e7d848c175",
"status": "affected",
"version": "5a903a44a98471cedf0021fac0a6a64bbe86943f",
"versionType": "git"
},
{
"lessThan": "e64bca63647db1d5518198d6c5ca2dbcc66b182b",
"status": "affected",
"version": "5a903a44a98471cedf0021fac0a6a64bbe86943f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/adreno/a6xx_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/adreno: Fix a reference leak in a6xx_gpu_init()\n\nIn a6xx_gpu_init(), node is obtained via of_parse_phandle().\nWhile there was a manual of_node_put() at the end of the\ncommon path, several early error returns would bypass this call,\nresulting in a reference leak.\nFix this by using the __free(device_node) cleanup handler to\nrelease the reference when the variable goes out of scope.\n\nPatchwork: https://patchwork.freedesktop.org/patch/700661/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:07.993Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdad77438cc2ba006b041eb02adccb0b9f8cffad"
},
{
"url": "https://git.kernel.org/stable/c/bd750e4043bbd9e2ef69de50b11bd6f98c366cc0"
},
{
"url": "https://git.kernel.org/stable/c/b76568c6721840a4ddb65e24e2849db0f8e83461"
},
{
"url": "https://git.kernel.org/stable/c/2be24c945e76cd538ce5dd2e50f5d3e7d848c175"
},
{
"url": "https://git.kernel.org/stable/c/e64bca63647db1d5518198d6c5ca2dbcc66b182b"
}
],
"title": "drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64154",
"datePublished": "2026-07-19T15:40:42.807Z",
"dateReserved": "2026-07-19T07:54:57.038Z",
"dateUpdated": "2026-10-21T12:43:07.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38605 (GCVE-0-2025-38605)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2026-11-05 21:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to
retrieve the ab pointer. In vdev delete sequence the arvif->ar could
become NULL and that would trigger kernel panic.
Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it
directly to avoid panic and unnecessary dereferencing.
PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]"
LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]".
The Backtrace obtained is as follows:
ath12k_dp_tx+0x228/0x988 [ath12k]
ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k]
ieee80211_process_measurement_req+0x320/0x348 [mac80211]
ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211]
ieee80211_tx_dequeue+0xb14/0x1518 [mac80211]
ieee80211_tx_prepare_skb+0x224/0x254 [mac80211]
ieee80211_xmit+0xec/0x100 [mac80211]
__ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211]
ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211]
netdev_start_xmit+0x150/0x18c
dev_hard_start_xmit+0x74/0xc0
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:04:47.633098Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:12:48.523Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be27a11a42b2190f817b198bf5e753e5e4ac849e",
"status": "affected",
"version": "e93bbd65547ea8073b707c9034c3f051f8018614",
"versionType": "git"
},
{
"lessThan": "d9d2a0466e981d1be95fc8bdc05806ea21def758",
"status": "affected",
"version": "e93bbd65547ea8073b707c9034c3f051f8018614",
"versionType": "git"
},
{
"lessThan": "b508f370f88f277c95e2bd3bc47217a96d668cee",
"status": "affected",
"version": "e93bbd65547ea8073b707c9034c3f051f8018614",
"versionType": "git"
},
{
"lessThan": "ee4f8e7fa578f9f28cef5f409677db25f4f83d7e",
"status": "affected",
"version": "e93bbd65547ea8073b707c9034c3f051f8018614",
"versionType": "git"
},
{
"lessThan": "05062834350f0bf7ad1abcebc2807220e90220eb",
"status": "affected",
"version": "e93bbd65547ea8073b707c9034c3f051f8018614",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()\n\nIn ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to\nretrieve the ab pointer. In vdev delete sequence the arvif-\u003ear could\nbecome NULL and that would trigger kernel panic.\nSince the caller ath12k_dp_tx() already has a valid ab pointer, pass it\ndirectly to avoid panic and unnecessary dereferencing.\n\nPC points to \"ath12k_dp_tx+0x228/0x988 [ath12k]\"\nLR points to \"ath12k_dp_tx+0xc8/0x988 [ath12k]\".\nThe Backtrace obtained is as follows:\nath12k_dp_tx+0x228/0x988 [ath12k]\nath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k]\nieee80211_process_measurement_req+0x320/0x348 [mac80211]\nieee80211_tx_dequeue+0x9ac/0x1518 [mac80211]\nieee80211_tx_dequeue+0xb14/0x1518 [mac80211]\nieee80211_tx_prepare_skb+0x224/0x254 [mac80211]\nieee80211_xmit+0xec/0x100 [mac80211]\n__ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211]\nieee80211_subif_start_xmit+0x2e8/0x308 [mac80211]\nnetdev_start_xmit+0x150/0x18c\ndev_hard_start_xmit+0x74/0xc0\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:10.261Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be27a11a42b2190f817b198bf5e753e5e4ac849e"
},
{
"url": "https://git.kernel.org/stable/c/d9d2a0466e981d1be95fc8bdc05806ea21def758"
},
{
"url": "https://git.kernel.org/stable/c/b508f370f88f277c95e2bd3bc47217a96d668cee"
},
{
"url": "https://git.kernel.org/stable/c/ee4f8e7fa578f9f28cef5f409677db25f4f83d7e"
},
{
"url": "https://git.kernel.org/stable/c/05062834350f0bf7ad1abcebc2807220e90220eb"
}
],
"title": "wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38605",
"datePublished": "2025-08-19T17:03:49.295Z",
"dateReserved": "2025-04-16T04:51:24.028Z",
"dateUpdated": "2026-11-05T21:12:48.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68404 (GCVE-0-2026-68404)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: use wiphy work for socket owner autodisconnect
nl80211_netlink_notify() walks the cfg80211 wireless device list when a
NETLINK_GENERIC socket is released. If the socket owns a connection, the
notifier queues the embedded wdev->disconnect_wk work item.
That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a
NETLINK_URELEASE notifier that already observed conn_owner_nlportid can
queue it after that cancel returns. _cfg80211_unregister_wdev() then
removes the wdev from the list and waits for RCU readers, but
synchronize_net() does not drain work queued by such a reader.
Make the autodisconnect work a wiphy_work instead. The callback already
needs the wiphy mutex, and wiphy_work runs under that mutex. This lets
teardown cancel pending autodisconnect work while holding the mutex,
without a cancel_work_sync() vs. worker locking concern.
Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any
NETLINK_URELEASE notifier that had already reached the wdev list has then
either queued the work and it is removed, or can no longer find the wdev.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bd2522b168847106c1885f0319a2833bdf88bf9a Version: bd2522b168847106c1885f0319a2833bdf88bf9a Version: bd2522b168847106c1885f0319a2833bdf88bf9a Version: bd2522b168847106c1885f0319a2833bdf88bf9a Version: bd2522b168847106c1885f0319a2833bdf88bf9a Version: bd2522b168847106c1885f0319a2833bdf88bf9a |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:20.936552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "CWE-662 Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:08.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/cfg80211.h",
"net/wireless/core.c",
"net/wireless/core.h",
"net/wireless/nl80211.c",
"net/wireless/sme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23517673b1eecaec95e61dde285220d5a980cf3f",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "c55590e4c69e0fd194df6d20bc35381c201d99e1",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "4087a9ba4ece70297a4174afaa41c0b700302b65",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "c2ddd180bbee766cf7359473d623423ea9485d93",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "6d6123fef5a4af175cc6b6b12a03dd0f3c240b79",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "0c2ed186bbe14304415476d6707b747dddcd8583",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/cfg80211.h",
"net/wireless/core.c",
"net/wireless/core.h",
"net/wireless/nl80211.c",
"net/wireless/sme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: use wiphy work for socket owner autodisconnect\n\nnl80211_netlink_notify() walks the cfg80211 wireless device list when a\nNETLINK_GENERIC socket is released. If the socket owns a connection, the\nnotifier queues the embedded wdev-\u003edisconnect_wk work item.\n\nThat work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a\nNETLINK_URELEASE notifier that already observed conn_owner_nlportid can\nqueue it after that cancel returns. _cfg80211_unregister_wdev() then\nremoves the wdev from the list and waits for RCU readers, but\nsynchronize_net() does not drain work queued by such a reader.\n\nMake the autodisconnect work a wiphy_work instead. The callback already\nneeds the wiphy mutex, and wiphy_work runs under that mutex. This lets\nteardown cancel pending autodisconnect work while holding the mutex,\nwithout a cancel_work_sync() vs. worker locking concern.\n\nAlso cancel the wiphy work after list_del_rcu() and synchronize_net(). Any\nNETLINK_URELEASE notifier that had already reached the wdev list has then\neither queued the work and it is removed, or can no longer find the wdev."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through local nl80211/generic-netlink operations: setting NL80211_ATTR_SOCKET_OWNER on a connect/join command, closing the owning netlink socket, and tearing down the wireless interface. No network or radio traffic is required, so the attack vector is Local.\nAC:L - The attacker controls both sides of the race \u2014 the NETLINK_URELEASE notification (by closing its own socket) and the wdev teardown (by downing/deleting the interface) \u2014 and can repeat the sequence in a tight loop until the work is queued after the cancel window.\nPR:L - The relevant nl80211 commands use GENL_UNS_ADMIN_PERM and the family is netnsok, and mac80211_hwsim\u0027s HWSIM_CMD_NEW_RADIO likewise creates a wiphy in the caller\u0027s netns (wiphy_net_set(genl_info_net(info))), so an unprivileged user in a user+net namespace (unshare -Urn) obtains the required CAP_NET_ADMIN.\nUI:N - The entire sequence \u2014 creating/owning the connection, closing the socket, and removing the interface \u2014 is performed by the attacker\u0027s own process with no victim action required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed wireless_dev lives in the net_device private allocation; a use-after-free on that slab lets an attacker reclaim and inspect kernel heap contents, and cfg80211_autodisconnect_wk dereferences the stale object, enabling disclosure of arbitrary kernel memory.\nI:H - Queueing writes work list pointers into freed memory, and process_one_work() later loads work-\u003efunc from the reclaimed allocation, giving an attacker who sprays the slab a controlled kernel function pointer call and thus arbitrary write/code execution.\nA:H - Running cfg80211_autodisconnect_wk against a freed wireless_dev dereferences stale pointers and drives disconnect paths on destroyed state, reliably producing an oops or panic even without successful exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:29.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23517673b1eecaec95e61dde285220d5a980cf3f"
},
{
"url": "https://git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1"
},
{
"url": "https://git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65"
},
{
"url": "https://git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93"
},
{
"url": "https://git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79"
},
{
"url": "https://git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583"
}
],
"title": "wifi: cfg80211: use wiphy work for socket owner autodisconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68404",
"datePublished": "2026-08-10T12:04:24.241Z",
"dateReserved": "2026-07-30T09:28:09.390Z",
"dateUpdated": "2026-10-30T12:28:29.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89810 (GCVE-0-2026-89810)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
If page migration from device to sys ram fails for some reasons driver needs
release and unlock allocated system pages. To do that driver should use page
physical address, or pfn, then get struct page*. Current driver uses dma
address(for adev) that is not correct with IOMMU enabled, or even in general.
The patch releases and unlocks allocated system pages based on where migration
failed by struct page* of sys ram pages. Also dma_unmap correspodent system
ram pages at error path.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda Version: 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda Version: 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda Version: 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda Version: 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda Version: 48ff079b28d82dbce000cc45c0fd35b6ae9ffbda |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_migrate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee007a238dd363ba2f3a3b01815703cfe98711c7",
"status": "affected",
"version": "48ff079b28d82dbce000cc45c0fd35b6ae9ffbda",
"versionType": "git"
},
{
"lessThan": "44cad7ea3532f14999008d899daacc4ce4b633bf",
"status": "affected",
"version": "48ff079b28d82dbce000cc45c0fd35b6ae9ffbda",
"versionType": "git"
},
{
"lessThan": "872b7427e64f3e84b16c62577cbf3cd09a3401a2",
"status": "affected",
"version": "48ff079b28d82dbce000cc45c0fd35b6ae9ffbda",
"versionType": "git"
},
{
"lessThan": "da87bcad1f781d822e7ced6d1de9dbc6d381c72e",
"status": "affected",
"version": "48ff079b28d82dbce000cc45c0fd35b6ae9ffbda",
"versionType": "git"
},
{
"lessThan": "a2035918a7a1d8fd3bb79d22e1e149294a5a8418",
"status": "affected",
"version": "48ff079b28d82dbce000cc45c0fd35b6ae9ffbda",
"versionType": "git"
},
{
"lessThan": "960c4a8069bfd352c48cc88592618f1ebe24c69e",
"status": "affected",
"version": "48ff079b28d82dbce000cc45c0fd35b6ae9ffbda",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_migrate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix error path at svm_migrate_copy_to_ram\n\nIf page migration from device to sys ram fails for some reasons driver needs\nrelease and unlock allocated system pages. To do that driver should use page\nphysical address, or pfn, then get struct page*. Current driver uses dma\naddress(for adev) that is not correct with IOMMU enabled, or even in general.\n\nThe patch releases and unlocks allocated system pages based on where migration\nfailed by struct page* of sys ram pages. Also dma_unmap correspodent system\nram pages at error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in amdkfd SVM VRAM-to-RAM migration (svm_migrate_copy_to_ram), reached from local /dev/kfd AMDKFD_IOC_SVM ioctls, CPU/GPU page faults, or TTM eviction in the caller\u2019s process; it is not reachable from the network stack.\nAC:L - An attacker who can open /dev/kfd fully controls SVM prefetch and faults and can force the failing copy path (alloc_page_vma ENOMEM, dma_map_page failure, or GART IB allocation failure) via memory or DMA-mapping pressure; no uncontrollable race or rare config is required.\nPR:L - kfd_open() and AMDKFD_IOC_SVM perform no capability check; /dev/kfd and the amdgpu render node are accessible to unprivileged users in the render group, which is standard on AMD GPU, ROCm, HPC, and embedded systems.\nUI:N - The attacker opens /dev/kfd, establishes an SVM range, and triggers VRAM-to-RAM migration from their own process; no other user must mount, open, or interact with anything.\nS:U - Impact is kernel page-refcount and vmemmap corruption inside the host kernel that runs amdkfd. This is standard local kernel memory corruption, not a guest-to-host escape or IOMMU DMA-isolation bypass.\nC:H - On the error path the driver treats DMA addresses (IOMMU IOVAs, bounce-buffer addresses, or 0 for skipped pages) as PFNs and put_page()s the resulting struct page, a use-after-free/refcount underflow of unrelated pages that can disclose kernel memory.\nI:H - The same wrong-page unlock_page()+put_page() can free still-mapped pages or drop the lock on pages other code holds, and invalid PFNs write through pfn_to_page() into vmemmap; that is an exploitable write/UAF primitive for control-flow hijack.\nA:H - pfn_to_page() without pfn_valid() on a DMA IOVA, unlock_page() of an unlocked page, and later use of an underflowed page refcount each produce a kernel oops or panic, fully denying availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:07.807Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee007a238dd363ba2f3a3b01815703cfe98711c7"
},
{
"url": "https://git.kernel.org/stable/c/44cad7ea3532f14999008d899daacc4ce4b633bf"
},
{
"url": "https://git.kernel.org/stable/c/872b7427e64f3e84b16c62577cbf3cd09a3401a2"
},
{
"url": "https://git.kernel.org/stable/c/da87bcad1f781d822e7ced6d1de9dbc6d381c72e"
},
{
"url": "https://git.kernel.org/stable/c/a2035918a7a1d8fd3bb79d22e1e149294a5a8418"
},
{
"url": "https://git.kernel.org/stable/c/960c4a8069bfd352c48cc88592618f1ebe24c69e"
}
],
"title": "drm/amdkfd: Fix error path at svm_migrate_copy_to_ram",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89810",
"datePublished": "2026-09-16T10:30:43.350Z",
"dateReserved": "2026-09-11T19:38:34.767Z",
"dateUpdated": "2026-10-30T12:33:07.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53108 (GCVE-0-2026-53108)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-11-06 16:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/64s: Fix unmap race with PMD migration entries
The following race is possible with migration swap entries or
device-private THP entries. e.g. when move_pages is called on a PMD THP
page, then there maybe an intermediate state, where PMD entry acts as
a migration swap entry (pmd_present() is true). Then if an munmap
happens at the same time, then this VM_BUG_ON() can happen in
pmdp_huge_get_and_clear_full().
This patch fixes that.
Thread A: move_pages() syscall
add_folio_for_migration()
mmap_read_lock(mm)
folio_isolate_lru(folio)
mmap_read_unlock(mm)
do_move_pages_to_node()
migrate_pages()
try_to_migrate_one()
spin_lock(ptl)
set_pmd_migration_entry()
pmdp_invalidate() # PMD: _PAGE_INVALID | _PAGE_PTE | pfn
set_pmd_at() # PMD: migration swap entry (pmd_present=0)
spin_unlock(ptl)
[page copy phase] # <--- RACE WINDOW -->
Thread B: munmap()
mmap_write_downgrade(mm)
unmap_vmas() -> zap_pmd_range()
zap_huge_pmd()
__pmd_trans_huge_lock()
pmd_is_huge(): # !pmd_present && !pmd_none -> TRUE (swap entry)
pmd_lock() -> # spin_lock(ptl), waits for Thread A to release ptl
pmdp_huge_get_and_clear_full()
VM_BUG_ON(!pmd_present(*pmdp)) # HITS!
[ 287.738700][ T1867] ------------[ cut here ]------------
[ 287.743843][ T1867] kernel BUG at arch/powerpc/mm/book3s64/pgtable.c:187!
cpu 0x0: Vector: 700 (Program Check) at [c00000044037f4f0]
pc: c000000000094ca4: pmdp_huge_get_and_clear_full+0x6c/0x23c
lr: c000000000645dec: zap_huge_pmd+0xb0/0x868
sp: c00000044037f790
msr: 800000000282b033
current = 0xc0000004032c1a00
paca = 0xc000000004fe0000 irqmask: 0x03 irq_happened: 0x09
pid = 1867, comm = a.out
kernel BUG at :187!
Linux version 6.19.0-12136-g14360d4f917c-dirty (powerpc64le-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #27 SMP PREEMPT Sun Feb 22 10:38:56 IST 2026
enter ? for help
[link register ] c000000000645dec zap_huge_pmd+0xb0/0x868
[c00000044037f790] c00000044037f7d0 (unreliable)
[c00000044037f7d0] c000000000645dcc zap_huge_pmd+0x90/0x868
[c00000044037f840] c0000000005724cc unmap_page_range+0x176c/0x1f40
[c00000044037fa00] c000000000572ea0 unmap_vmas+0xb0/0x1d8
[c00000044037fa90] c0000000005af254 unmap_region+0xb4/0x128
[c00000044037fb50] c0000000005af400 vms_complete_munmap_vmas+0x138/0x310
[c00000044037fbe0] c0000000005b0f1c do_vmi_align_munmap+0x1ec/0x238
[c00000044037fd30] c0000000005b3688 __vm_munmap+0x170/0x1f8
[c00000044037fdf0] c000000000587f74 sys_munmap+0x2c/0x40
[c00000044037fe10] c000000000032668 system_call_exception+0x128/0x350
[c00000044037fe50] c00000000000d05c system_call_vectored_common+0x15c/0x2ec
---- Exception: 3000 (System Call Vectored) at 0000000010064a2c
SP (7fff9b1ee9c0) is in userspace
0:mon> zh
commit a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages"),
enabled migration for device-private PMD entries. Hence this is one
other path where this warning could get trigger from.
------------[ cut here ]------------
WARNING: arch/powerpc/mm/book3s64/hash_pgtable.c:199 at hash__pmd_hugepage_update+0x48/0x284, CPU#3: hmm-tests/1905
Modules linked in: test_hmm
CPU: 3 UID: 0 PID: 1905 Comm: hmm-tests Tainted: G B W L N 7.0.0-rc1-01438-g7e2f0ee7581c #21 PREEMPT
Tainted: [B]=BAD_PAGE, [W]=WARN, [L]=SOFTLOCKUP, [N]=TEST
Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries
NIP [c000000000096b70] hash__pmd_hugepage_update+0x48/0x284
LR [c000000000096e7c] hash__pmdp_huge_get_and_clear+0xd0/0xd4
Call Trace:
[c000000604707670] [c000000004e102b8] 0xc000000004e102b8 (unreliable)
[c000000604707700] [c00000000064ec3c] set_pmd_migration_entry+0x414/0x498
[c000000604707760] [c00000000063e5a4] migrate_vma_col
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 75358ea359e7c0dfceb3c7b3d854570b4260cb7f Version: 75358ea359e7c0dfceb3c7b3d854570b4260cb7f Version: 75358ea359e7c0dfceb3c7b3d854570b4260cb7f Version: 75358ea359e7c0dfceb3c7b3d854570b4260cb7f Version: 75358ea359e7c0dfceb3c7b3d854570b4260cb7f Version: 75358ea359e7c0dfceb3c7b3d854570b4260cb7f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:18:59.795012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:24:00.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/include/asm/book3s/64/pgtable.h",
"arch/powerpc/mm/book3s64/pgtable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d4999bfbcbc5b801bfcf482c567380dd26ad268",
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"versionType": "git"
},
{
"lessThan": "6f571bf37da84ab822bf22341d48655312aaee20",
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"versionType": "git"
},
{
"lessThan": "5c8dd49f4a857aa40c4a8694930509d159feae24",
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"versionType": "git"
},
{
"lessThan": "09207dc57ab4cb8967e6cad55a37e15ff8523d41",
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"versionType": "git"
},
{
"lessThan": "829367e55012c053738ebe7db20c4a90d6609ece",
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"versionType": "git"
},
{
"lessThan": "bbcbf045d6c778e82b47a35fc8728387708e9a3d",
"status": "affected",
"version": "75358ea359e7c0dfceb3c7b3d854570b4260cb7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/include/asm/book3s/64/pgtable.h",
"arch/powerpc/mm/book3s64/pgtable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: Fix unmap race with PMD migration entries\n\nThe following race is possible with migration swap entries or\ndevice-private THP entries. e.g. when move_pages is called on a PMD THP\npage, then there maybe an intermediate state, where PMD entry acts as\na migration swap entry (pmd_present() is true). Then if an munmap\nhappens at the same time, then this VM_BUG_ON() can happen in\npmdp_huge_get_and_clear_full().\n\nThis patch fixes that.\n\nThread A: move_pages() syscall\n add_folio_for_migration()\n mmap_read_lock(mm)\n folio_isolate_lru(folio)\n mmap_read_unlock(mm)\n\n do_move_pages_to_node()\n migrate_pages()\n try_to_migrate_one()\n spin_lock(ptl)\n set_pmd_migration_entry()\n pmdp_invalidate() # PMD: _PAGE_INVALID | _PAGE_PTE | pfn\n set_pmd_at() # PMD: migration swap entry (pmd_present=0)\n spin_unlock(ptl)\n [page copy phase] # \u003c--- RACE WINDOW --\u003e\n\nThread B: munmap()\n mmap_write_downgrade(mm)\n unmap_vmas() -\u003e zap_pmd_range()\n zap_huge_pmd()\n __pmd_trans_huge_lock()\n pmd_is_huge(): # !pmd_present \u0026\u0026 !pmd_none -\u003e TRUE (swap entry)\n pmd_lock() -\u003e \t\t# spin_lock(ptl), waits for Thread A to release ptl\n pmdp_huge_get_and_clear_full()\n VM_BUG_ON(!pmd_present(*pmdp)) # HITS!\n\n[ 287.738700][ T1867] ------------[ cut here ]------------\n[ 287.743843][ T1867] kernel BUG at arch/powerpc/mm/book3s64/pgtable.c:187!\ncpu 0x0: Vector: 700 (Program Check) at [c00000044037f4f0]\n pc: c000000000094ca4: pmdp_huge_get_and_clear_full+0x6c/0x23c\n lr: c000000000645dec: zap_huge_pmd+0xb0/0x868\n sp: c00000044037f790\n msr: 800000000282b033\n current = 0xc0000004032c1a00\n paca = 0xc000000004fe0000 irqmask: 0x03 irq_happened: 0x09\n pid = 1867, comm = a.out\nkernel BUG at :187!\nLinux version 6.19.0-12136-g14360d4f917c-dirty (powerpc64le-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #27 SMP PREEMPT Sun Feb 22 10:38:56 IST 2026\nenter ? for help\n[link register ] c000000000645dec zap_huge_pmd+0xb0/0x868\n[c00000044037f790] c00000044037f7d0 (unreliable)\n[c00000044037f7d0] c000000000645dcc zap_huge_pmd+0x90/0x868\n[c00000044037f840] c0000000005724cc unmap_page_range+0x176c/0x1f40\n[c00000044037fa00] c000000000572ea0 unmap_vmas+0xb0/0x1d8\n[c00000044037fa90] c0000000005af254 unmap_region+0xb4/0x128\n[c00000044037fb50] c0000000005af400 vms_complete_munmap_vmas+0x138/0x310\n[c00000044037fbe0] c0000000005b0f1c do_vmi_align_munmap+0x1ec/0x238\n[c00000044037fd30] c0000000005b3688 __vm_munmap+0x170/0x1f8\n[c00000044037fdf0] c000000000587f74 sys_munmap+0x2c/0x40\n[c00000044037fe10] c000000000032668 system_call_exception+0x128/0x350\n[c00000044037fe50] c00000000000d05c system_call_vectored_common+0x15c/0x2ec\n---- Exception: 3000 (System Call Vectored) at 0000000010064a2c\nSP (7fff9b1ee9c0) is in userspace\n0:mon\u003e zh\n\ncommit a30b48bf1b24 (\"mm/migrate_device: implement THP migration of zone device pages\"),\nenabled migration for device-private PMD entries. Hence this is one\nother path where this warning could get trigger from.\n\n ------------[ cut here ]------------\n WARNING: arch/powerpc/mm/book3s64/hash_pgtable.c:199 at hash__pmd_hugepage_update+0x48/0x284, CPU#3: hmm-tests/1905\n Modules linked in: test_hmm\n CPU: 3 UID: 0 PID: 1905 Comm: hmm-tests Tainted: G B W L N 7.0.0-rc1-01438-g7e2f0ee7581c #21 PREEMPT\n Tainted: [B]=BAD_PAGE, [W]=WARN, [L]=SOFTLOCKUP, [N]=TEST\n Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries\n NIP [c000000000096b70] hash__pmd_hugepage_update+0x48/0x284\n LR [c000000000096e7c] hash__pmdp_huge_get_and_clear+0xd0/0xd4\n Call Trace:\n [c000000604707670] [c000000004e102b8] 0xc000000004e102b8 (unreliable)\n [c000000604707700] [c00000000064ec3c] set_pmd_migration_entry+0x414/0x498\n [c000000604707760] [c00000000063e5a4] migrate_vma_col\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:39.730Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d4999bfbcbc5b801bfcf482c567380dd26ad268"
},
{
"url": "https://git.kernel.org/stable/c/6f571bf37da84ab822bf22341d48655312aaee20"
},
{
"url": "https://git.kernel.org/stable/c/5c8dd49f4a857aa40c4a8694930509d159feae24"
},
{
"url": "https://git.kernel.org/stable/c/09207dc57ab4cb8967e6cad55a37e15ff8523d41"
},
{
"url": "https://git.kernel.org/stable/c/829367e55012c053738ebe7db20c4a90d6609ece"
},
{
"url": "https://git.kernel.org/stable/c/bbcbf045d6c778e82b47a35fc8728387708e9a3d"
}
],
"title": "powerpc/64s: Fix unmap race with PMD migration entries",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53108",
"datePublished": "2026-06-24T16:30:42.707Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-11-06T16:24:00.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43308 (GCVE-0-2026-43308)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
There is no need to BUG(), we can just return an error and log an error
message.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0 Version: 5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0 Version: 5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0 Version: 5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0 Version: 5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0 Version: 5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43308",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:34:57.010242Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:47.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent-tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c614b64bee2c3cbb0c80dd3a9ee492c74364e275",
"status": "affected",
"version": "5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0",
"versionType": "git"
},
{
"lessThan": "0e77f1c8ebf5b1f858b5ac613baceb79919d6d3f",
"status": "affected",
"version": "5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0",
"versionType": "git"
},
{
"lessThan": "a5ac87aabdedd31e832b40466605e83f428136aa",
"status": "affected",
"version": "5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0",
"versionType": "git"
},
{
"lessThan": "6ad4caadc6343c3d7987bf3211f15d66135c4c42",
"status": "affected",
"version": "5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0",
"versionType": "git"
},
{
"lessThan": "5549743e11c06da23cfa7712a994b9f1e69064c6",
"status": "affected",
"version": "5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0",
"versionType": "git"
},
{
"lessThan": "c7d1d4ff56744074e005771aff193b927392d51f",
"status": "affected",
"version": "5d4f98a28c7d334091c1b7744f48a1acdd2a4ae0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent-tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don\u0027t BUG() on unexpected delayed ref type in run_one_delayed_ref()\n\nThere is no need to BUG(), we can just return an error and log an error\nmessage."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:24.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c614b64bee2c3cbb0c80dd3a9ee492c74364e275"
},
{
"url": "https://git.kernel.org/stable/c/0e77f1c8ebf5b1f858b5ac613baceb79919d6d3f"
},
{
"url": "https://git.kernel.org/stable/c/a5ac87aabdedd31e832b40466605e83f428136aa"
},
{
"url": "https://git.kernel.org/stable/c/6ad4caadc6343c3d7987bf3211f15d66135c4c42"
},
{
"url": "https://git.kernel.org/stable/c/5549743e11c06da23cfa7712a994b9f1e69064c6"
},
{
"url": "https://git.kernel.org/stable/c/c7d1d4ff56744074e005771aff193b927392d51f"
}
],
"title": "btrfs: don\u0027t BUG() on unexpected delayed ref type in run_one_delayed_ref()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43308",
"datePublished": "2026-05-08T13:11:26.937Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-11-06T15:42:47.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68353 (GCVE-0-2025-68353)
Vulnerability from cvelistv5
Published
2025-12-24 10:32
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: vxlan: prevent NULL deref in vxlan_xmit_one
Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in
vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the
following NULL dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000010
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:vxlan_xmit_one+0xbb3/0x1580
Call Trace:
vxlan_xmit+0x429/0x610
dev_hard_start_xmit+0x55/0xa0
__dev_queue_xmit+0x6d0/0x7f0
ip_finish_output2+0x24b/0x590
ip_output+0x63/0x110
Mentioned commits changed the code path in vxlan_xmit_one and as a side
effect the sock4/6 pointer validity checks in vxlan(6)_get_route were
lost. Fix this by adding back checks.
Since both commits being fixed were released in the same version (v6.7)
and are strongly related, bundle the fixes in a single commit.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "333deb6b43c11d5bce00463b364ac993d2fa02a6",
"status": "affected",
"version": "6f19b2c136d98a84d79030b53e23d405edfdc783",
"versionType": "git"
},
{
"lessThan": "4ac26aafdc8c7271414e2e7c0b2cb266a26591bc",
"status": "affected",
"version": "6f19b2c136d98a84d79030b53e23d405edfdc783",
"versionType": "git"
},
{
"lessThan": "1f73a56f986005f0bc64ed23873930e2ee4f5911",
"status": "affected",
"version": "6f19b2c136d98a84d79030b53e23d405edfdc783",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vxlan: prevent NULL deref in vxlan_xmit_one\n\nNeither sock4 nor sock6 pointers are guaranteed to be non-NULL in\nvxlan_xmit_one, e.g. if the iface is brought down. This can lead to the\nfollowing NULL dereference:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000010\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:vxlan_xmit_one+0xbb3/0x1580\n Call Trace:\n vxlan_xmit+0x429/0x610\n dev_hard_start_xmit+0x55/0xa0\n __dev_queue_xmit+0x6d0/0x7f0\n ip_finish_output2+0x24b/0x590\n ip_output+0x63/0x110\n\nMentioned commits changed the code path in vxlan_xmit_one and as a side\neffect the sock4/6 pointer validity checks in vxlan(6)_get_route were\nlost. Fix this by adding back checks.\n\nSince both commits being fixed were released in the same version (v6.7)\nand are strongly related, bundle the fixes in a single commit."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:14.894Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/333deb6b43c11d5bce00463b364ac993d2fa02a6"
},
{
"url": "https://git.kernel.org/stable/c/4ac26aafdc8c7271414e2e7c0b2cb266a26591bc"
},
{
"url": "https://git.kernel.org/stable/c/1f73a56f986005f0bc64ed23873930e2ee4f5911"
}
],
"title": "net: vxlan: prevent NULL deref in vxlan_xmit_one",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68353",
"datePublished": "2025-12-24T10:32:44.068Z",
"dateReserved": "2025-12-16T14:48:05.300Z",
"dateUpdated": "2026-10-21T12:38:14.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68730 (GCVE-0-2025-68730)
Vulnerability from cvelistv5
Published
2025-12-24 10:33
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
Don't add BO to the vdev->bo_list in ivpu_gem_create_object().
When failure happens inside drm_gem_shmem_create(), the BO is not
fully created and ivpu_gem_bo_free() callback will not be called
causing a deleted BO to be left on the list.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/ivpu/ivpu_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ad57ebd1249c7bbfe9a07ff5e0176dfa320cd62",
"status": "affected",
"version": "8d88e4cdce4f5c56de55174a4d32ea9c06f7fa66",
"versionType": "git"
},
{
"lessThan": "8172838a284c27190fa6782c2740a97020434750",
"status": "affected",
"version": "8d88e4cdce4f5c56de55174a4d32ea9c06f7fa66",
"versionType": "git"
},
{
"lessThan": "c9ef5ccd8bd9bcf598b6d3f77e7eb4dde7149aec",
"status": "affected",
"version": "8d88e4cdce4f5c56de55174a4d32ea9c06f7fa66",
"versionType": "git"
},
{
"lessThan": "8b694b405a84696f1d964f6da7cf9721e68c4714",
"status": "affected",
"version": "8d88e4cdce4f5c56de55174a4d32ea9c06f7fa66",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/ivpu/ivpu_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()\n\nDon\u0027t add BO to the vdev-\u003ebo_list in ivpu_gem_create_object().\nWhen failure happens inside drm_gem_shmem_create(), the BO is not\nfully created and ivpu_gem_bo_free() callback will not be called\ncausing a deleted BO to be left on the list."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker reaches the flaw through DRM_IOCTL_IVPU_BO_CREATE on a local /dev/accel/accel* device, followed by closing the descriptor to invoke vulnerable context teardown.\nAC:L - A page-aligned size of 0x8000000000000000 deterministically becomes a negative loff_t in shmem_file_setup(), forcing failure after the BO was linked; the attacker then directly triggers the UAF by closing the descriptor.\nPR:L - The ioctl has no DRM authentication, master, root-only, or capability requirement and is available to an ordinary user granted normal accelerator-device access.\nUI:N - The attacker independently issues the allocation ioctl and closes the descriptor; no action by another user is required.\nS:U - The dangling BO corrupts or exposes resources within the same host-kernel security authority and does not itself cross a VM or IOMMU isolation boundary.\nC:H - The freed BO can be reclaimed and sprayed before list traversal, making its reservation and other pointer fields attacker-influenced; this kernel-heap UAF can support arbitrary kernel-memory disclosure.\nI:H - Traversal performs locking and possible unbinding through attacker-influenced freed-object pointers, making arbitrary kernel writes or control-flow hijacking defensible.\nA:H - The stale BO is dereferenced during context teardown, producing the documented kernel page fault; controlled reallocation can also corrupt the list and cause an unbounded teardown loop."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:24.802Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ad57ebd1249c7bbfe9a07ff5e0176dfa320cd62"
},
{
"url": "https://git.kernel.org/stable/c/8172838a284c27190fa6782c2740a97020434750"
},
{
"url": "https://git.kernel.org/stable/c/c9ef5ccd8bd9bcf598b6d3f77e7eb4dde7149aec"
},
{
"url": "https://git.kernel.org/stable/c/8b694b405a84696f1d964f6da7cf9721e68c4714"
}
],
"title": "accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68730",
"datePublished": "2025-12-24T10:33:13.236Z",
"dateReserved": "2025-12-24T10:30:51.028Z",
"dateUpdated": "2026-10-21T12:38:24.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74542 (GCVE-0-2026-74542)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
Fix the handling of folio_queue allocation failure in writeback by adding a
mempool and passing in gfp_t flags to the rolling buffer functions that
allocate memory, using the mempool if gfp != GFP_KERNEL.
This is then extended upwards and the gfp to be used for a request is stored
in the netfs_io_request struct and is then used for both requests and
subrequests, eliminating the sleeping loops there.
The failure caused:
folio != NULL
WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c",
"fs/netfs/internal.h",
"fs/netfs/main.c",
"fs/netfs/objects.c",
"fs/netfs/read_pgpriv2.c",
"fs/netfs/rolling_buffer.c",
"fs/netfs/write_issue.c",
"include/linux/netfs.h",
"include/linux/rolling_buffer.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b343252d6f536203dd0660f676190dcbf6d2ecdc",
"status": "affected",
"version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
"versionType": "git"
},
{
"lessThan": "15ed8a9b7c63e9171f5139a6aaa1ffb61809861f",
"status": "affected",
"version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
"versionType": "git"
},
{
"lessThan": "3f6d7f8a5416d852648d15a05e895f1195ee8a85",
"status": "affected",
"version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
"versionType": "git"
},
{
"lessThan": "1d78d56c43ef3768183e8370e7367b162700e049",
"status": "affected",
"version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c",
"fs/netfs/internal.h",
"fs/netfs/main.c",
"fs/netfs/objects.c",
"fs/netfs/read_pgpriv2.c",
"fs/netfs/rolling_buffer.c",
"fs/netfs/write_issue.c",
"include/linux/netfs.h",
"include/linux/rolling_buffer.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix folio_queue ENOMEM in writeback by adding a mempool\n\nFix the handling of folio_queue allocation failure in writeback by adding a\nmempool and passing in gfp_t flags to the rolling buffer functions that\nallocate memory, using the mempool if gfp != GFP_KERNEL.\n\nThis is then extended upwards and the gfp to be used for a request is stored\nin the netfs_io_request struct and is then used for both requests and\nsubrequests, eliminating the sleeping loops there.\n\nThe failure caused:\n\n folio != NULL\n WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:52.776Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b343252d6f536203dd0660f676190dcbf6d2ecdc"
},
{
"url": "https://git.kernel.org/stable/c/15ed8a9b7c63e9171f5139a6aaa1ffb61809861f"
},
{
"url": "https://git.kernel.org/stable/c/3f6d7f8a5416d852648d15a05e895f1195ee8a85"
},
{
"url": "https://git.kernel.org/stable/c/1d78d56c43ef3768183e8370e7367b162700e049"
}
],
"title": "netfs: Fix folio_queue ENOMEM in writeback by adding a mempool",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74542",
"datePublished": "2026-08-15T12:27:52.741Z",
"dateReserved": "2026-08-15T05:44:03.914Z",
"dateUpdated": "2026-10-21T12:45:52.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98977 (GCVE-0-2026-98977)
Vulnerability from cvelistv5
Published
2026-10-23 12:19
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
namespace: handle mount locking for automounts correctly
If mounts are propagated across user namespaces, attach_recursive_mnt()
locks every copy of the source mount to protect overmounts from
vanishing and revealing the underlying files or directories.
The user namespace is taken from the caller's mount namespaces since
this is where the mounts end up. Except, that's not always true.
Automounts may legitimately get popped in by tasks located in a
different mount and user namespace during path lookup.
Then check doesn't make sense at that point. The copy in the namespace
of the parent - which may be the host's - is now locked and the host
cannot change the flags of its own mounts anymore.
Here's the reproducer:
- host has debugfs mounted nosuid,nodev,noexec and shared
- tracefs automount below it is not yet active
- hand a child process a directory descriptor on that mount
- child process enters auser and mount namespace
- child process' namespace now holds a locked copy of the host's debugfs
mount that receives propagation from it
- child process stats "tracing/." through the descriptor
- lookup runs on the host's mount so the automount lands below the host's mount
- propagation puts a copy below the child's copy
- both try to clear the flags on the mount they got, with a bind remount:
host, on its own automount: MS_REMOUNT|MS_BIND = EPERM
child, on the copy in its namespace: MS_REMOUNT|MS_BIND = 0
So the lock landed on the host's mount instead of the child's copy.
Congrats. So we need to compare with the owner of the namespace the
mount actually gets mounted on. For all regular cases that is the
caller's mount namespace and so nothing changes.
Detached trees in anonymous mount namespaces by be handed over via
SCM_RIGHTS or inherited in other ways on purpose so the attaching task's
mount namespace is authoritative, not the creator of the detached tree.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 Version: 9c773201d61272db49f8f33a83a3cb2a3fe4b14f Version: 3.8.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9b488641cfa63f9b41321530c543688b2e34f03",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "91676705756af6a59a515087b8b854c8a28d12eb",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "587d25c4b13d49c8fd05df2f71240f73bb2a058c",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "5e8f3ac8fa3d411b422ad32b9168c46a4824cc79",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "b3ccde78f1608836e62320428abc0e8aa9cf2329",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "e01c79761c7b3373e80094c5eadb21cb864fa8bc",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "6ab37fae14196ba2262b152a7d9222c50356d278",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"lessThan": "33aadc7c72055fca93cb5a3691d836ebf8b31c9b",
"status": "affected",
"version": "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9",
"versionType": "git"
},
{
"status": "affected",
"version": "9c773201d61272db49f8f33a83a3cb2a3fe4b14f",
"versionType": "git"
},
{
"lessThan": "3.9",
"status": "affected",
"version": "3.8.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: handle mount locking for automounts correctly\n\nIf mounts are propagated across user namespaces, attach_recursive_mnt()\nlocks every copy of the source mount to protect overmounts from\nvanishing and revealing the underlying files or directories.\n\nThe user namespace is taken from the caller\u0027s mount namespaces since\nthis is where the mounts end up. Except, that\u0027s not always true.\nAutomounts may legitimately get popped in by tasks located in a\ndifferent mount and user namespace during path lookup.\n\nThen check doesn\u0027t make sense at that point. The copy in the namespace\nof the parent - which may be the host\u0027s - is now locked and the host\ncannot change the flags of its own mounts anymore.\n\nHere\u0027s the reproducer:\n\n- host has debugfs mounted nosuid,nodev,noexec and shared\n- tracefs automount below it is not yet active\n- hand a child process a directory descriptor on that mount\n- child process enters auser and mount namespace\n- child process\u0027 namespace now holds a locked copy of the host\u0027s debugfs\n mount that receives propagation from it\n- child process stats \"tracing/.\" through the descriptor\n- lookup runs on the host\u0027s mount so the automount lands below the host\u0027s mount\n- propagation puts a copy below the child\u0027s copy\n- both try to clear the flags on the mount they got, with a bind remount:\n\n host, on its own automount: MS_REMOUNT|MS_BIND = EPERM\n child, on the copy in its namespace: MS_REMOUNT|MS_BIND = 0\n\nSo the lock landed on the host\u0027s mount instead of the child\u0027s copy.\nCongrats. So we need to compare with the owner of the namespace the\nmount actually gets mounted on. For all regular cases that is the\ncaller\u0027s mount namespace and so nothing changes.\n\nDetached trees in anonymous mount namespaces by be handed over via\nSCM_RIGHTS or inherited in other ways on purpose so the attaching task\u0027s\nmount namespace is authoritative, not the creator of the detached tree."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:39.052Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9b488641cfa63f9b41321530c543688b2e34f03"
},
{
"url": "https://git.kernel.org/stable/c/91676705756af6a59a515087b8b854c8a28d12eb"
},
{
"url": "https://git.kernel.org/stable/c/587d25c4b13d49c8fd05df2f71240f73bb2a058c"
},
{
"url": "https://git.kernel.org/stable/c/5e8f3ac8fa3d411b422ad32b9168c46a4824cc79"
},
{
"url": "https://git.kernel.org/stable/c/b3ccde78f1608836e62320428abc0e8aa9cf2329"
},
{
"url": "https://git.kernel.org/stable/c/e01c79761c7b3373e80094c5eadb21cb864fa8bc"
},
{
"url": "https://git.kernel.org/stable/c/6ab37fae14196ba2262b152a7d9222c50356d278"
},
{
"url": "https://git.kernel.org/stable/c/33aadc7c72055fca93cb5a3691d836ebf8b31c9b"
}
],
"title": "namespace: handle mount locking for automounts correctly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98977",
"datePublished": "2026-10-23T12:19:50.475Z",
"dateReserved": "2026-09-25T10:25:14.383Z",
"dateUpdated": "2026-10-30T12:40:39.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99166 (GCVE-0-2026-99166)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rds: fix uninitialized trans dereference in CM event handler
rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA
device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device
type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but
the event switch dereferences it: unconditionally in the
RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(),
and (with a connection context) in the ROUTE_RESOLVED and
ESTABLISHED cases.
An RDS listener on an iWARP device therefore crashes the kernel as
soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO
the wild load becomes a NULL dereference at offset 0xa0
(&trans->cm_handle_connect) in the iw_cm_wq workqueue.
GCC masks the bug in default builds by folding the uninitialized
load into &rds_ib_transport; Clang-built kernels take the real
uninitialized path and oops.
The active side can land on a non-IB device too: the id that
rds_ib_conn_path_connect() creates is not restricted to a node type,
so rdma_resolve_addr() binds it to whichever device serves the local
address, and an iWARP RNIC on the same netdev qualifies. The crash
there is different: resolving a route on an iWARP id never fills in
cm_id->route.path_rec, and the ROUTE_RESOLVED case writes
path_rec[0].sl before it calls into the transport.
The iWARP transport was dropped long ago and IB is the only
transport left, so make that explicit: initialize trans to
&rds_ib_transport at declaration, drop the conditional assignment,
reject a connect request that arrives on a non-IB device, and drop a
connection whose address resolved to one instead of resolving a
route on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST
on purpose: a non-zero return from the handler makes rdma_cm destroy
the id the event was delivered on, which is right for the request's
freshly created id but would free a connection id that RDS still owns
for any other event. On the active side the id stays ic->i_cm_id and
the connection's shutdown destroys it, so that case returns 0.
[achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of
bailing out for every event on a non-IB device, so that rdma_cm does
not destroy connection ids RDS still tracks; drop a connection whose
address resolved to a non-IB device before a route is resolved on it;
changelog adjusted]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d Version: dcdede0406d30e14a6ed727dce69dfac0518371d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d15e853aa88da5375edd32b39d08a048b64a1c5",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "8c77774535c3d6162929521a6fa11e3db086fa32",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "8973f70cb068012d83cff1cfa3f45ef94ab02267",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "a2fde862b98db8908e2ebaffbb35a75a0e9d5b33",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "074bb7cdc3e26afa698888ba56fc1df0e3f24650",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "5f23e4e3a31dacfd82a8f56be253adc0910ee84f",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "ca14c289ed9ffed6cc64290d039e923e5720a8bf",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
},
{
"lessThan": "492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8",
"status": "affected",
"version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix uninitialized trans dereference in CM event handler\n\nrds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA\ndevice is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device\ntype, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but\nthe event switch dereferences it: unconditionally in the\nRDMA_CM_EVENT_CONNECT_REQUEST case via trans-\u003ecm_handle_connect(),\nand (with a connection context) in the ROUTE_RESOLVED and\nESTABLISHED cases.\n\nAn RDS listener on an iWARP device therefore crashes the kernel as\nsoon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO\nthe wild load becomes a NULL dereference at offset 0xa0\n(\u0026trans-\u003ecm_handle_connect) in the iw_cm_wq workqueue.\n\nGCC masks the bug in default builds by folding the uninitialized\nload into \u0026rds_ib_transport; Clang-built kernels take the real\nuninitialized path and oops.\n\nThe active side can land on a non-IB device too: the id that\nrds_ib_conn_path_connect() creates is not restricted to a node type,\nso rdma_resolve_addr() binds it to whichever device serves the local\naddress, and an iWARP RNIC on the same netdev qualifies. The crash\nthere is different: resolving a route on an iWARP id never fills in\ncm_id-\u003eroute.path_rec, and the ROUTE_RESOLVED case writes\npath_rec[0].sl before it calls into the transport.\n\nThe iWARP transport was dropped long ago and IB is the only\ntransport left, so make that explicit: initialize trans to\n\u0026rds_ib_transport at declaration, drop the conditional assignment,\nreject a connect request that arrives on a non-IB device, and drop a\nconnection whose address resolved to one instead of resolving a\nroute on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST\non purpose: a non-zero return from the handler makes rdma_cm destroy\nthe id the event was delivered on, which is right for the request\u0027s\nfreshly created id but would free a connection id that RDS still owns\nfor any other event. On the active side the id stays ic-\u003ei_cm_id and\nthe connection\u0027s shutdown destroys it, so that case returns 0.\n\n[achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of\n bailing out for every event on a non-IB device, so that rdma_cm does\n not destroy connection ids RDS still tracks; drop a connection whose\n address resolved to a non-IB device before a route is resolved on it;\n changelog adjusted]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:32.571Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d15e853aa88da5375edd32b39d08a048b64a1c5"
},
{
"url": "https://git.kernel.org/stable/c/8c77774535c3d6162929521a6fa11e3db086fa32"
},
{
"url": "https://git.kernel.org/stable/c/8973f70cb068012d83cff1cfa3f45ef94ab02267"
},
{
"url": "https://git.kernel.org/stable/c/a2fde862b98db8908e2ebaffbb35a75a0e9d5b33"
},
{
"url": "https://git.kernel.org/stable/c/074bb7cdc3e26afa698888ba56fc1df0e3f24650"
},
{
"url": "https://git.kernel.org/stable/c/5f23e4e3a31dacfd82a8f56be253adc0910ee84f"
},
{
"url": "https://git.kernel.org/stable/c/ca14c289ed9ffed6cc64290d039e923e5720a8bf"
},
{
"url": "https://git.kernel.org/stable/c/492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8"
}
],
"title": "net: rds: fix uninitialized trans dereference in CM event handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99166",
"datePublished": "2026-10-28T10:35:18.050Z",
"dateReserved": "2026-09-25T10:25:14.398Z",
"dateUpdated": "2026-10-30T12:42:32.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100072 (GCVE-0-2026-100072)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: platform: Use acpi_bus_get_primary_device()
The acpi_get_first_physical_node() usage in acpi_platform_fill_resource()
and acpi_create_platform_device() is generally unsafe because in theory
the device returned by it may be freed at any time [1].
It is also inefficient because acpi_get_first_physical_node() is called
multiple times for the same argument which can be avoided.
Address these issues by using acpi_bus_get_primary_device() instead of
acpi_get_first_physical_node() and adjusting the code to call it just
once at the beginning of and acpi_create_platform_device() and drop
the device reference acquired by it upon the return from that function.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a75e5de593ef158feb17989bff7730c5a3d82503",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
},
{
"lessThan": "527a497fb2ef77a95170eefe2007e2c4c957bd2c",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
},
{
"lessThan": "c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
},
{
"lessThan": "a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:45.183Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503"
},
{
"url": "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c"
},
{
"url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"
},
{
"url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"
}
],
"title": "ACPI: platform: Use acpi_bus_get_primary_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100072",
"datePublished": "2026-09-25T13:06:45.579Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-10-21T12:38:45.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97477 (GCVE-0-2026-97477)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
When __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path
jumps to err_mode which frees the counter without decrementing
port_counter->num_counters. The only place that decrements is
rdma_counter_free(), which is unreachable since the counter was never
successfully bound.
This leak accumulates across repeated failures, permanently preventing
the port from switching to AUTO mode (-EBUSY in __counter_set_mode())
and blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When
the mode was NONE before the call, the MANUAL mode set by
__counter_set_mode() also leaks since the revert logic is never
reached.
Add an err_bind label between the num_counters increment and the
existing err_mode label. It decrements num_counters and mirrors the
MANUAL→NONE revert from rdma_counter_free(), ensuring the port state
is fully restored on bind failure.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/counters.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4517686789b404827591c52f79e9a57822371ca0",
"status": "affected",
"version": "8bc205eff3056a9ed3850937cdd2192f05e6d3cb",
"versionType": "git"
},
{
"lessThan": "7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2a",
"status": "affected",
"version": "8bc205eff3056a9ed3850937cdd2192f05e6d3cb",
"versionType": "git"
},
{
"lessThan": "1bcdeddddffadff9993657f6b0e5535d66ebd10f",
"status": "affected",
"version": "8bc205eff3056a9ed3850937cdd2192f05e6d3cb",
"versionType": "git"
},
{
"lessThan": "da95cb016812c0e012ea839f191926e35ca8f57f",
"status": "affected",
"version": "8bc205eff3056a9ed3850937cdd2192f05e6d3cb",
"versionType": "git"
},
{
"lessThan": "4fbc8230009f5b1bcd13cc74c5a6a43ddba141fd",
"status": "affected",
"version": "8bc205eff3056a9ed3850937cdd2192f05e6d3cb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/counters.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()\n\nWhen __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path\njumps to err_mode which frees the counter without decrementing\nport_counter-\u003enum_counters. The only place that decrements is\nrdma_counter_free(), which is unreachable since the counter was never\nsuccessfully bound.\n\nThis leak accumulates across repeated failures, permanently preventing\nthe port from switching to AUTO mode (-EBUSY in __counter_set_mode())\nand blocking the MANUAL\u2192NONE auto-revert in rdma_counter_free(). When\nthe mode was NONE before the call, the MANUAL mode set by\n__counter_set_mode() also leaks since the revert logic is never\nreached.\n\nAdd an err_bind label between the num_counters increment and the\nexisting err_mode label. It decrements num_counters and mirrors the\nMANUAL\u2192NONE revert from rdma_counter_free(), ensuring the port state\nis fully restored on bind failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:58.713Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4517686789b404827591c52f79e9a57822371ca0"
},
{
"url": "https://git.kernel.org/stable/c/7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2a"
},
{
"url": "https://git.kernel.org/stable/c/1bcdeddddffadff9993657f6b0e5535d66ebd10f"
},
{
"url": "https://git.kernel.org/stable/c/da95cb016812c0e012ea839f191926e35ca8f57f"
},
{
"url": "https://git.kernel.org/stable/c/4fbc8230009f5b1bcd13cc74c5a6a43ddba141fd"
}
],
"title": "RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97477",
"datePublished": "2026-09-24T16:04:19.358Z",
"dateReserved": "2026-09-24T16:01:01.149Z",
"dateUpdated": "2026-10-30T12:36:58.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53017 (GCVE-0-2026-53017)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix data loss caused by incorrect use of nat_entry flag
Data loss can occur when fsync is performed on a newly created file
(before any checkpoint has been written) concurrently with a checkpoint
operation. The scenario is as follows:
create & write & fsync 'file A' write checkpoint
- f2fs_do_sync_file // inline inode
- f2fs_write_inode // inode folio is dirty
- f2fs_write_checkpoint
- f2fs_flush_merged_writes
- f2fs_sync_node_pages
- f2fs_flush_nat_entries
- f2fs_fsync_node_pages // no dirty node
- f2fs_need_inode_block_update // return false
SPO and lost 'file A'
f2fs_flush_nat_entries() sets the IS_CHECKPOINTED and HAS_LAST_FSYNC
flags for the nat_entry, but this does not mean that the checkpoint has
actually completed successfully. However, f2fs_need_inode_block_update()
checks these flags and incorrectly assumes that the checkpoint has
finished.
The root cause is that the semantics of IS_CHECKPOINTED and
HAS_LAST_FSYNC are only guaranteed after the checkpoint write fully
completes.
This patch modifies f2fs_need_inode_block_update() to acquire the
sbi->node_write lock before reading the nat_entry flags, ensuring that
once IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the
checkpoint operation has already completed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e05df3b115e7308afbca652769b54e4549fcc723 Version: e05df3b115e7308afbca652769b54e4549fcc723 Version: e05df3b115e7308afbca652769b54e4549fcc723 Version: e05df3b115e7308afbca652769b54e4549fcc723 Version: e05df3b115e7308afbca652769b54e4549fcc723 Version: e05df3b115e7308afbca652769b54e4549fcc723 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb65e8c7bd0a78a470cbdd3ff96232ba4a2ace89",
"status": "affected",
"version": "e05df3b115e7308afbca652769b54e4549fcc723",
"versionType": "git"
},
{
"lessThan": "0645fa4d48e9b77d93f8b7a1c1fea58a97c2f8b0",
"status": "affected",
"version": "e05df3b115e7308afbca652769b54e4549fcc723",
"versionType": "git"
},
{
"lessThan": "9fd3bcb54a6afea5fa8a828d010561143560b7c5",
"status": "affected",
"version": "e05df3b115e7308afbca652769b54e4549fcc723",
"versionType": "git"
},
{
"lessThan": "cb06a07d835ba1ea250785a796243bb483e65816",
"status": "affected",
"version": "e05df3b115e7308afbca652769b54e4549fcc723",
"versionType": "git"
},
{
"lessThan": "20cedb4d9f6b230d0ee469690b8f868f06a07c29",
"status": "affected",
"version": "e05df3b115e7308afbca652769b54e4549fcc723",
"versionType": "git"
},
{
"lessThan": "238e14eb7226f883b72caccd2d37bf5707df066b",
"status": "affected",
"version": "e05df3b115e7308afbca652769b54e4549fcc723",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix data loss caused by incorrect use of nat_entry flag\n\nData loss can occur when fsync is performed on a newly created file\n(before any checkpoint has been written) concurrently with a checkpoint\noperation. The scenario is as follows:\n\ncreate \u0026 write \u0026 fsync \u0027file A\u0027 write checkpoint\n- f2fs_do_sync_file // inline inode\n - f2fs_write_inode // inode folio is dirty\n - f2fs_write_checkpoint\n - f2fs_flush_merged_writes\n - f2fs_sync_node_pages\n - f2fs_flush_nat_entries\n - f2fs_fsync_node_pages // no dirty node\n - f2fs_need_inode_block_update // return false\n SPO and lost \u0027file A\u0027\n\nf2fs_flush_nat_entries() sets the IS_CHECKPOINTED and HAS_LAST_FSYNC\nflags for the nat_entry, but this does not mean that the checkpoint has\nactually completed successfully. However, f2fs_need_inode_block_update()\nchecks these flags and incorrectly assumes that the checkpoint has\nfinished.\n\nThe root cause is that the semantics of IS_CHECKPOINTED and\nHAS_LAST_FSYNC are only guaranteed after the checkpoint write fully\ncompletes.\n\nThis patch modifies f2fs_need_inode_block_update() to acquire the\nsbi-\u003enode_write lock before reading the nat_entry flags, ensuring that\nonce IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the\ncheckpoint operation has already completed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:29.040Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb65e8c7bd0a78a470cbdd3ff96232ba4a2ace89"
},
{
"url": "https://git.kernel.org/stable/c/0645fa4d48e9b77d93f8b7a1c1fea58a97c2f8b0"
},
{
"url": "https://git.kernel.org/stable/c/9fd3bcb54a6afea5fa8a828d010561143560b7c5"
},
{
"url": "https://git.kernel.org/stable/c/cb06a07d835ba1ea250785a796243bb483e65816"
},
{
"url": "https://git.kernel.org/stable/c/20cedb4d9f6b230d0ee469690b8f868f06a07c29"
},
{
"url": "https://git.kernel.org/stable/c/238e14eb7226f883b72caccd2d37bf5707df066b"
}
],
"title": "f2fs: fix data loss caused by incorrect use of nat_entry flag",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53017",
"datePublished": "2026-06-24T16:29:27.154Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-10-30T12:26:29.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99131 (GCVE-0-2026-99131)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-31 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix capability check in xfs
An user reported a bug where he managed to evade group's quota
by changing a file's gid to a different group id the same user
belonged to, even though quotas were enforced on both gids and the
file's size was big enough to exceed the quota's hardlimit.
Commit eba0549bc7d1 replaced a capable() call by a
has_capability_noaudit() to prevent unnecessary selinux audit messages.
Turns out that both calls have slightly different semantics even though
their documentation seems similar. Where in a nutshell:
capable() - Tests the task's effective credentials
has_ns_capability_noaudit() - Tests the task's real credentials
This most of the time has no practical difference but in some cases like
changing attrs (specifically group id in this case) through a NFS client
this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively
bypassing quota accounting checks.
Using instead ns_capable_noaudit() should fix this issue and prevent
selinux audit messages.
This also fix the remaining calls to has_capability_noaudit()
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eba0549bc7d100691c13384b774346b8aa9cf9a9 Version: eba0549bc7d100691c13384b774346b8aa9cf9a9 Version: eba0549bc7d100691c13384b774346b8aa9cf9a9 Version: eba0549bc7d100691c13384b774346b8aa9cf9a9 Version: eba0549bc7d100691c13384b774346b8aa9cf9a9 Version: eba0549bc7d100691c13384b774346b8aa9cf9a9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_fsmap.c",
"fs/xfs/xfs_ioctl.c",
"fs/xfs/xfs_iops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29f994db0447104a7a52fb6495193c80007cb66a",
"status": "affected",
"version": "eba0549bc7d100691c13384b774346b8aa9cf9a9",
"versionType": "git"
},
{
"lessThan": "e84bfb08016496ec5ce09a5ef9c813f23c060781",
"status": "affected",
"version": "eba0549bc7d100691c13384b774346b8aa9cf9a9",
"versionType": "git"
},
{
"lessThan": "87881f816ab721d8a727cba20c36b9c71b489c8e",
"status": "affected",
"version": "eba0549bc7d100691c13384b774346b8aa9cf9a9",
"versionType": "git"
},
{
"lessThan": "19a1a22029ad3ae3604c763af6bd1195cb73648f",
"status": "affected",
"version": "eba0549bc7d100691c13384b774346b8aa9cf9a9",
"versionType": "git"
},
{
"lessThan": "7809ac0161c7c5f52ed348fb1ec683b2b454a83e",
"status": "affected",
"version": "eba0549bc7d100691c13384b774346b8aa9cf9a9",
"versionType": "git"
},
{
"lessThan": "e2f62a9744ebad3bcb6347a648e615026e9efeff",
"status": "affected",
"version": "eba0549bc7d100691c13384b774346b8aa9cf9a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_fsmap.c",
"fs/xfs/xfs_ioctl.c",
"fs/xfs/xfs_iops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix capability check in xfs\n\nAn user reported a bug where he managed to evade group\u0027s quota\nby changing a file\u0027s gid to a different group id the same user\nbelonged to, even though quotas were enforced on both gids and the\nfile\u0027s size was big enough to exceed the quota\u0027s hardlimit.\n\nCommit eba0549bc7d1 replaced a capable() call by a\nhas_capability_noaudit() to prevent unnecessary selinux audit messages.\nTurns out that both calls have slightly different semantics even though\ntheir documentation seems similar. Where in a nutshell:\n\ncapable() - Tests the task\u0027s effective credentials\nhas_ns_capability_noaudit() - Tests the task\u0027s real credentials\n\nThis most of the time has no practical difference but in some cases like\nchanging attrs (specifically group id in this case) through a NFS client\nthis will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively\nbypassing quota accounting checks.\n\nUsing instead ns_capable_noaudit() should fix this issue and prevent\nselinux audit messages.\n\nThis also fix the remaining calls to has_capability_noaudit()"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An NFSv4 COMPOUND/SETATTR request carries FATTR4_OWNER_GROUP; nfsd4_decode_setattr() sets ATTR_GID, and nfsd4_setattr()-\u003enfsd_setattr()-\u003enotify_change()-\u003exfs_vn_setattr() reaches the patched xfs_setattr_nonsize(). NFS is routable, so the vector is Network.\nAC:L - The attacker controls the deterministic sequence: AUTH_SYS credentials assert both groups, NFS WRITE fills the source group\u0027s quota, and SETATTR moves each file to the over-limit destination group. No race or external state transition is required.\nPR:N - svcauth_unix_accept() accepts the uid, gid, and supplementary groups asserted in an AUTH_SYS RPC without account verification, and nfsd_setuser() installs them as subjective credentials. chgrp_ok() then requires only the asserted owner identity and destination-group membership.\nUI:N - The remote client creates and fills the file and sends the SETATTR group change itself; neither nfsd_setattr() nor xfs_setattr_nonsize() requires a separate victim action.\nS:U - xfs_trans_dqresv() skips a quota check and xfs_qm_vop_chown() updates dquots within the same host XFS security authority; no VM, sandbox, or other security boundary is crossed.\nC:N - XFS_QMOPT_FORCE_RES only bypasses the limit branch in xfs_trans_dqresv(), after which quota counters and inode ownership are updated; the path performs no out-of-bounds read or disclosure of kernel or other-file data.\nI:L - With XFS_QMOPT_FORCE_RES set, xfs_trans_dqresv() omits the hard-limit test and xfs_qm_vop_chown() charges blocks and inodes to an already over-limit group. This defeats quota policy and modifies resource accounting, but provides no arbitrary write or control over other users\u0027 file contents.\nA:H - xfs_qm_vop_chown() debits the source dquot and, after forced reservation, credits the already over-limit destination; repeating NFS writes and group changes can consume the entire XFS volume. Full-volume exhaustion denies allocations to all users and services on that filesystem."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:43:34.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29f994db0447104a7a52fb6495193c80007cb66a"
},
{
"url": "https://git.kernel.org/stable/c/e84bfb08016496ec5ce09a5ef9c813f23c060781"
},
{
"url": "https://git.kernel.org/stable/c/87881f816ab721d8a727cba20c36b9c71b489c8e"
},
{
"url": "https://git.kernel.org/stable/c/19a1a22029ad3ae3604c763af6bd1195cb73648f"
},
{
"url": "https://git.kernel.org/stable/c/7809ac0161c7c5f52ed348fb1ec683b2b454a83e"
},
{
"url": "https://git.kernel.org/stable/c/e2f62a9744ebad3bcb6347a648e615026e9efeff"
}
],
"title": "xfs: fix capability check in xfs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99131",
"datePublished": "2026-10-28T10:34:45.102Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-31T12:43:34.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68319 (GCVE-0-2025-68319)
Vulnerability from cvelistv5
Published
2025-12-16 15:39
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netconsole: Acquire su_mutex before navigating configs hierarchy
There is a race between operations that iterate over the userdata
cg_children list and concurrent add/remove of userdata items through
configfs. The update_userdata() function iterates over the
nt->userdata_group.cg_children list, and count_extradata_entries() also
iterates over this same list to count nodes.
Quoting from Documentation/filesystems/configfs.rst:
> A subsystem can navigate the cg_children list and the ci_parent pointer
> to see the tree created by the subsystem. This can race with configfs'
> management of the hierarchy, so configfs uses the subsystem mutex to
> protect modifications. Whenever a subsystem wants to navigate the
> hierarchy, it must do so under the protection of the subsystem
> mutex.
Without proper locking, if a userdata item is added or removed
concurrently while these functions are iterating, the list can be
accessed in an inconsistent state. For example, the list_for_each() loop
can reach a node that is being removed from the list by list_del_init()
which sets the nodes' .next pointer to point to itself, so the loop will
never end (or reach the WARN_ON_ONCE in update_userdata() ).
Fix this by holding the configfs subsystem mutex (su_mutex) during all
operations that iterate over cg_children.
This includes:
- userdatum_value_store() which calls update_userdata() to iterate over
cg_children
- All sysdata_*_enabled_store() functions which call
count_extradata_entries() to iterate over cg_children
The su_mutex must be acquired before dynamic_netconsole_mutex to avoid
potential lock ordering issues, as configfs operations may already hold
su_mutex when calling into our code.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/netconsole.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "932c0c7a7ec413399febca5fe3dddf913bb5c924",
"status": "affected",
"version": "df03f830d099f0811281a222aefdd9d400fa0b72",
"versionType": "git"
},
{
"lessThan": "ff70aa7e8cf05745fdba7258952a8bedf33ea336",
"status": "affected",
"version": "df03f830d099f0811281a222aefdd9d400fa0b72",
"versionType": "git"
},
{
"lessThan": "d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b",
"status": "affected",
"version": "df03f830d099f0811281a222aefdd9d400fa0b72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/netconsole.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: Acquire su_mutex before navigating configs hierarchy\n\nThere is a race between operations that iterate over the userdata\ncg_children list and concurrent add/remove of userdata items through\nconfigfs. The update_userdata() function iterates over the\nnt-\u003euserdata_group.cg_children list, and count_extradata_entries() also\niterates over this same list to count nodes.\n\nQuoting from Documentation/filesystems/configfs.rst:\n\u003e A subsystem can navigate the cg_children list and the ci_parent pointer\n\u003e to see the tree created by the subsystem. This can race with configfs\u0027\n\u003e management of the hierarchy, so configfs uses the subsystem mutex to\n\u003e protect modifications. Whenever a subsystem wants to navigate the\n\u003e hierarchy, it must do so under the protection of the subsystem\n\u003e mutex.\n\nWithout proper locking, if a userdata item is added or removed\nconcurrently while these functions are iterating, the list can be\naccessed in an inconsistent state. For example, the list_for_each() loop\ncan reach a node that is being removed from the list by list_del_init()\nwhich sets the nodes\u0027 .next pointer to point to itself, so the loop will\nnever end (or reach the WARN_ON_ONCE in update_userdata() ).\n\nFix this by holding the configfs subsystem mutex (su_mutex) during all\noperations that iterate over cg_children.\nThis includes:\n- userdatum_value_store() which calls update_userdata() to iterate over\n cg_children\n- All sysdata_*_enabled_store() functions which call\n count_extradata_entries() to iterate over cg_children\n\nThe su_mutex must be acquired before dynamic_netconsole_mutex to avoid\npotential lock ordering issues, as configfs operations may already hold\nsu_mutex when calling into our code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:12.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/932c0c7a7ec413399febca5fe3dddf913bb5c924"
},
{
"url": "https://git.kernel.org/stable/c/ff70aa7e8cf05745fdba7258952a8bedf33ea336"
},
{
"url": "https://git.kernel.org/stable/c/d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b"
}
],
"title": "netconsole: Acquire su_mutex before navigating configs hierarchy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68319",
"datePublished": "2025-12-16T15:39:48.903Z",
"dateReserved": "2025-12-16T14:48:05.295Z",
"dateUpdated": "2026-10-21T12:38:12.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99139 (GCVE-0-2026-99139)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding
rcu_read_lock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support
tcp_congestion_ops in bpf"), icsk_ca_ops can point to dynamically
allocated BPF struct_ops memory that may be freed concurrently via
setsockopt(TCP_CONGESTION), leading to a use-after-free.
BUG: KASAN: slab-use-after-free in _copy_to_user+0x37/0x60
Read of size 16 at addr ffff888013505260 by task exploit/149
_copy_to_user+0x37/0x60
do_tcp_getsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585)
tcp_getsockopt+0x91/0xf0
__sys_getsockopt+0xf7/0x170
Fix this by holding rcu_read_lock() around the ca_ops->name access,
using READ_ONCE() to load icsk_ca_ops, and copying the name to a
stack buffer before releasing the lock. Also annotate the relevant
icsk_ca_ops stores with WRITE_ONCE() to fix the accompanying KCSAN
data-race issue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 Version: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp.c",
"net/ipv4/tcp_cong.c",
"net/ipv4/tcp_dctcp.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a60e62705c17534d6b6539de7b3a40c259e6827f",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "4b0930d66dde0a1d1898f0edbbb5496c4dfa5f03",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "08dc5c62c09653d1c4ba67a009beb138486c2604",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "c1804ef016392dd91267d2207ee43b1de34302ca",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "a8e45471afa230c1431c26c8e99ec24377e3b514",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
},
{
"lessThan": "5271b79b7ad68dcb222e893773f92bdabf7750f3",
"status": "affected",
"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp.c",
"net/ipv4/tcp_cong.c",
"net/ipv4/tcp_dctcp.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)\n\ndo_tcp_getsockopt() reads icsk-\u003eicsk_ca_ops-\u003ename without holding\nrcu_read_lock(). Since commit 0baf26b0fcd7 (\"bpf: tcp: Support\ntcp_congestion_ops in bpf\"), icsk_ca_ops can point to dynamically\nallocated BPF struct_ops memory that may be freed concurrently via\nsetsockopt(TCP_CONGESTION), leading to a use-after-free.\n\n BUG: KASAN: slab-use-after-free in _copy_to_user+0x37/0x60\n Read of size 16 at addr ffff888013505260 by task exploit/149\n _copy_to_user+0x37/0x60\n do_tcp_getsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585)\n tcp_getsockopt+0x91/0xf0\n __sys_getsockopt+0xf7/0x170\n\nFix this by holding rcu_read_lock() around the ca_ops-\u003ename access,\nusing READ_ONCE() to load icsk_ca_ops, and copying the name to a\nstack buffer before releasing the lock. Also annotate the relevant\nicsk_ca_ops stores with WRITE_ONCE() to fix the accompanying KCSAN\ndata-race issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:11.824Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a60e62705c17534d6b6539de7b3a40c259e6827f"
},
{
"url": "https://git.kernel.org/stable/c/4b0930d66dde0a1d1898f0edbbb5496c4dfa5f03"
},
{
"url": "https://git.kernel.org/stable/c/08dc5c62c09653d1c4ba67a009beb138486c2604"
},
{
"url": "https://git.kernel.org/stable/c/c1804ef016392dd91267d2207ee43b1de34302ca"
},
{
"url": "https://git.kernel.org/stable/c/a8e45471afa230c1431c26c8e99ec24377e3b514"
},
{
"url": "https://git.kernel.org/stable/c/5271b79b7ad68dcb222e893773f92bdabf7750f3"
}
],
"title": "tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99139",
"datePublished": "2026-10-28T10:34:50.674Z",
"dateReserved": "2026-09-25T10:25:14.395Z",
"dateUpdated": "2026-10-30T12:42:11.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98048 (GCVE-0-2026-98048)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: don't rewrite bpf_fastcall patterns entered by a jump
mark_fastcall_pattern_for_call() must ensure that matched
"spill; call; fill" instruction series is not interrupted by a jump.
Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills()
is not sound.
Record the instructions targeted by jumps in
insn_aux_data[*].jump_target when the CFG is built and use this flag
to stop growing a pattern at such an instruction. Jumps to the first
spill are fine.
Note that existing insn_aux_data[*].jmp_point field can't be reused,
as it marks subprogram return instructions.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/bpf_verifier.h",
"kernel/bpf/cfg.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0cd1c3ac63504ba3c50c01a00c11812919b619f",
"status": "affected",
"version": "5b5f51bff1b66cedb62b5ba74a1878341204e057",
"versionType": "git"
},
{
"lessThan": "c4d3bdb3ab211dcfad734b02e06fcb12adb4757f",
"status": "affected",
"version": "5b5f51bff1b66cedb62b5ba74a1878341204e057",
"versionType": "git"
},
{
"lessThan": "24adbc2c3bbe3385ce922587e1f8e837a68b3e25",
"status": "affected",
"version": "5b5f51bff1b66cedb62b5ba74a1878341204e057",
"versionType": "git"
},
{
"lessThan": "0b1c83dc3c4401cd7e846548f62e3caf3d06742e",
"status": "affected",
"version": "5b5f51bff1b66cedb62b5ba74a1878341204e057",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/bpf_verifier.h",
"kernel/bpf/cfg.c",
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: don\u0027t rewrite bpf_fastcall patterns entered by a jump\n\nmark_fastcall_pattern_for_call() must ensure that matched\n\"spill; call; fill\" instruction series is not interrupted by a jump.\nOtherwise the rewrite applied by bpf_remove_fastcall_spills_fills()\nis not sound.\n\nRecord the instructions targeted by jumps in\ninsn_aux_data[*].jump_target when the CFG is built and use this flag\nto stop growing a pattern at such an instruction. Jumps to the first\nspill are fine.\n\nNote that existing insn_aux_data[*].jmp_point field can\u0027t be reused,\nas it marks subprogram return instructions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:15.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0cd1c3ac63504ba3c50c01a00c11812919b619f"
},
{
"url": "https://git.kernel.org/stable/c/c4d3bdb3ab211dcfad734b02e06fcb12adb4757f"
},
{
"url": "https://git.kernel.org/stable/c/24adbc2c3bbe3385ce922587e1f8e837a68b3e25"
},
{
"url": "https://git.kernel.org/stable/c/0b1c83dc3c4401cd7e846548f62e3caf3d06742e"
}
],
"title": "bpf: don\u0027t rewrite bpf_fastcall patterns entered by a jump",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98048",
"datePublished": "2026-09-25T10:23:57.956Z",
"dateReserved": "2026-09-25T10:19:56.072Z",
"dateUpdated": "2026-10-21T12:54:15.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64389 (GCVE-0-2026-64389)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate NTLMv2 response before updating session key
ksmbd_auth_ntlmv2() derives the NTLMv2 session key into
sess->sess_key before it verifies the NTLMv2 response.
ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even
when ksmbd_auth_ntlmv2() failed.
With SMB3 multichannel binding, the failed authentication operates on
an existing session and the session setup error path does not expire
binding sessions. A client can send a binding session setup with a
bad NT proof and KEY_XCH and still modify sess->sess_key before
STATUS_LOGON_FAILURE is returned.
Relevant path:
smb2_sess_setup()
-> conn->binding = true
-> ntlm_authenticate()
-> session_user()
-> ksmbd_decode_ntlmssp_auth_blob()
-> ksmbd_auth_ntlmv2()
-> calc_ntlmv2_hash()
-> hmac_md5_usingrawkey(..., sess->sess_key)
-> crypto_memneq() returns mismatch
-> KEY_XCH arc4_crypt(..., sess->sess_key, ...)
-> out_err without expiring the binding session
Derive the base session key into a local buffer and copy it to
sess->sess_key only after the proof matches. Return immediately on
authentication failure so KEY_XCH is only processed after successful
authentication.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e589e997bddde0a6f45672dd871cba7b3ff28e17",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "a6a951416b55eaf51ea2742f7ba786f240e70137",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "f5d74c186bab26a5d5a025305e67edd0888aa34d",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "b56400364aed5c34d6e1a0b493081290a5328a9c",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "89ca7756d5566ba636bb9092cdbe57dab095e136",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "954d196bebb2b50151cb96454c72dc113b2af1ac",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess-\u003esess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess-\u003esess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n smb2_sess_setup()\n -\u003e conn-\u003ebinding = true\n -\u003e ntlm_authenticate()\n -\u003e session_user()\n -\u003e ksmbd_decode_ntlmssp_auth_blob()\n -\u003e ksmbd_auth_ntlmv2()\n -\u003e calc_ntlmv2_hash()\n -\u003e hmac_md5_usingrawkey(..., sess-\u003esess_key)\n -\u003e crypto_memneq() returns mismatch\n -\u003e KEY_XCH arc4_crypt(..., sess-\u003esess_key, ...)\n -\u003e out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess-\u003esess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable NTLMv2 authentication path is reached remotely through ksmbd SESSION_SETUP requests over SMB on TCP/445.\nAC:L - An attacker can deterministically trigger the key overwrite using a malformed multichannel binding request with KEY_XCH; no race or condition beyond attacker control is required.\nPR:N - The overwrite occurs before NTLMv2 proof validation, and the affected code does not verify the binding request signature, so valid credentials or an authenticated attacker session are unnecessary.\nUI:N - No victim action is required beyond an active SMB session, which can belong to an automated client or service.\nS:U - The corrupted session state and resulting effects remain within the ksmbd server and host kernel security authority.\nC:N - The bounded session-key overwrite does not disclose the prior key, kernel memory, or protected SMB data.\nI:L - The attacker can modify an established session\u0027s security-critical key state, but cannot reliably select the resulting key or obtain an arbitrary memory or file-write primitive.\nA:H - Repeated unauthenticated key corruption can desynchronize signing-key derivation and render targeted multichannel binding or session recovery unusable, causing complete loss of the affected SMB session in dependent deployments."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:50.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e589e997bddde0a6f45672dd871cba7b3ff28e17"
},
{
"url": "https://git.kernel.org/stable/c/a6a951416b55eaf51ea2742f7ba786f240e70137"
},
{
"url": "https://git.kernel.org/stable/c/f5d74c186bab26a5d5a025305e67edd0888aa34d"
},
{
"url": "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c"
},
{
"url": "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136"
},
{
"url": "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac"
}
],
"title": "ksmbd: validate NTLMv2 response before updating session key",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64389",
"datePublished": "2026-07-25T08:50:36.817Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-10-30T12:27:50.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68238 (GCVE-0-2026-68238)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Release VFCT ACPI table reference
amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()
but never releases it. acpi_get_table() takes a reference on the
table (incrementing its validation_count and mapping it on the 0->1
transition); without a paired acpi_put_table() the mapping is leaked
on every call, whether or not a matching VBIOS image is found.
Route all exit paths after the table is acquired through a common
acpi_put_table(). The VBIOS image is copied out with kmemdup() before
the table is released, so it remains valid for the caller.
(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1c19e02a689661a9687d689dcc5995d3be538262",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "1748043b5114ce5ee5ee874d5f821a158d70631c",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "50a75929c0c5e8ab29a3ac49dc92489873d9d261",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "312278b3091912fa56a6a587609f17dcb33465c2",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "65bff26617607c1331283232016c0e89088c5b78",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Release VFCT ACPI table reference\n\namdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()\nbut never releases it. acpi_get_table() takes a reference on the\ntable (incrementing its validation_count and mapping it on the 0-\u003e1\ntransition); without a paired acpi_put_table() the mapping is leaked\non every call, whether or not a matching VBIOS image is found.\n\nRoute all exit paths after the table is acquired through a common\nacpi_put_table(). The VBIOS image is copied out with kmemdup() before\nthe table is released, so it remains valid for the caller.\n\n(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:10.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c19e02a689661a9687d689dcc5995d3be538262"
},
{
"url": "https://git.kernel.org/stable/c/1748043b5114ce5ee5ee874d5f821a158d70631c"
},
{
"url": "https://git.kernel.org/stable/c/50a75929c0c5e8ab29a3ac49dc92489873d9d261"
},
{
"url": "https://git.kernel.org/stable/c/312278b3091912fa56a6a587609f17dcb33465c2"
},
{
"url": "https://git.kernel.org/stable/c/9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8"
},
{
"url": "https://git.kernel.org/stable/c/65bff26617607c1331283232016c0e89088c5b78"
}
],
"title": "drm/amdgpu: Release VFCT ACPI table reference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68238",
"datePublished": "2026-08-10T12:01:03.277Z",
"dateReserved": "2026-07-30T09:28:09.376Z",
"dateUpdated": "2026-10-30T12:28:10.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80786 (GCVE-0-2026-80786)
Vulnerability from cvelistv5
Published
2026-09-04 15:12
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Wrap user-invoked calls to fb_set_var() in helper
Handle fbcon during display updates in fb_set_var_from_user(). Check
with fbcon if the mode change is possible, update hardware state and
finally update fbcon. Update all callers.
Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other
mode-changes callers in sysfs and driver code are missing fbcon-related
steps.
With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain
fbcon state themselves.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fb_chrdev.c",
"drivers/video/fbdev/core/fbcon.c",
"drivers/video/fbdev/core/fbmem.c",
"drivers/video/fbdev/core/fbsysfs.c",
"drivers/video/fbdev/ps3fb.c",
"drivers/video/fbdev/sh_mobile_lcdcfb.c",
"include/linux/fb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af39d039b5591e3ebaa2e013862bd8cacc6d9dc3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3130e7bf43ecfe3a15bcf90b9698e0764a2d8d08",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d33589eff3d40439b3c83e8da0d07d20df797d50",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ed7e9715849abd0816b8487b0d12ebd05d6e938b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "07f7e46833f71472e30da54a50dacdf48521bdd3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6f611e5e5f3327cf2e2daabe6ee5acac58cc784e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fb_chrdev.c",
"drivers/video/fbdev/core/fbcon.c",
"drivers/video/fbdev/core/fbmem.c",
"drivers/video/fbdev/core/fbsysfs.c",
"drivers/video/fbdev/ps3fb.c",
"drivers/video/fbdev/sh_mobile_lcdcfb.c",
"include/linux/fb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Wrap user-invoked calls to fb_set_var() in helper\n\nHandle fbcon during display updates in fb_set_var_from_user(). Check\nwith fbcon if the mode change is possible, update hardware state and\nfinally update fbcon. Update all callers.\n\nOnly the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other\nmode-changes callers in sysfs and driver code are missing fbcon-related\nsteps.\n\nWith the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain\nfbcon state themselves."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:08.620Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af39d039b5591e3ebaa2e013862bd8cacc6d9dc3"
},
{
"url": "https://git.kernel.org/stable/c/3130e7bf43ecfe3a15bcf90b9698e0764a2d8d08"
},
{
"url": "https://git.kernel.org/stable/c/d33589eff3d40439b3c83e8da0d07d20df797d50"
},
{
"url": "https://git.kernel.org/stable/c/ed7e9715849abd0816b8487b0d12ebd05d6e938b"
},
{
"url": "https://git.kernel.org/stable/c/07f7e46833f71472e30da54a50dacdf48521bdd3"
},
{
"url": "https://git.kernel.org/stable/c/6f611e5e5f3327cf2e2daabe6ee5acac58cc784e"
}
],
"title": "fbdev: Wrap user-invoked calls to fb_set_var() in helper",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80786",
"datePublished": "2026-09-04T15:12:57.927Z",
"dateReserved": "2026-08-26T14:34:25.793Z",
"dateUpdated": "2026-10-30T12:31:08.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90330 (GCVE-0-2026-90330)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-hidpp: Fix FF device cleanup on init failure
hidpp_ff_init() creates the input force-feedback device with
input_ff_create(), then allocates the HID++ FF private data,
effect ID array, and workqueue.
If any of those allocations fail after input_ff_create() succeeds,
the function returns an error without destroying the FF device.
Add an unwind path that frees the private allocations made by
hidpp_ff_init() and calls input_ff_destroy() for failures after
input_ff_create() succeeds.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ff21a635dd1a9c6ca378847160897649cdbbfae4 Version: ff21a635dd1a9c6ca378847160897649cdbbfae4 Version: ff21a635dd1a9c6ca378847160897649cdbbfae4 Version: ff21a635dd1a9c6ca378847160897649cdbbfae4 Version: ff21a635dd1a9c6ca378847160897649cdbbfae4 Version: ff21a635dd1a9c6ca378847160897649cdbbfae4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-logitech-hidpp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a265fee3d24bd611783fd929582b7b6d62000a65",
"status": "affected",
"version": "ff21a635dd1a9c6ca378847160897649cdbbfae4",
"versionType": "git"
},
{
"lessThan": "360a49fc53acdfe2dbb80c23cfa606ed7e13a85d",
"status": "affected",
"version": "ff21a635dd1a9c6ca378847160897649cdbbfae4",
"versionType": "git"
},
{
"lessThan": "6bb216586a3cb4ce327511a7c0445fa88e85b3cb",
"status": "affected",
"version": "ff21a635dd1a9c6ca378847160897649cdbbfae4",
"versionType": "git"
},
{
"lessThan": "2fd9c8112907c14efefe6a90d20b774737052db3",
"status": "affected",
"version": "ff21a635dd1a9c6ca378847160897649cdbbfae4",
"versionType": "git"
},
{
"lessThan": "13378c9ac0a1bcdf49ba158e4199594aafb589cd",
"status": "affected",
"version": "ff21a635dd1a9c6ca378847160897649cdbbfae4",
"versionType": "git"
},
{
"lessThan": "dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac",
"status": "affected",
"version": "ff21a635dd1a9c6ca378847160897649cdbbfae4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-logitech-hidpp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Fix FF device cleanup on init failure\n\nhidpp_ff_init() creates the input force-feedback device with\ninput_ff_create(), then allocates the HID++ FF private data,\neffect ID array, and workqueue.\n\nIf any of those allocations fail after input_ff_create() succeeds,\nthe function returns an error without destroying the FF device.\nAdd an unwind path that frees the private allocations made by\nhidpp_ff_init() and calls input_ff_destroy() for failures after\ninput_ff_create() succeeds."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:12.113Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a265fee3d24bd611783fd929582b7b6d62000a65"
},
{
"url": "https://git.kernel.org/stable/c/360a49fc53acdfe2dbb80c23cfa606ed7e13a85d"
},
{
"url": "https://git.kernel.org/stable/c/6bb216586a3cb4ce327511a7c0445fa88e85b3cb"
},
{
"url": "https://git.kernel.org/stable/c/2fd9c8112907c14efefe6a90d20b774737052db3"
},
{
"url": "https://git.kernel.org/stable/c/13378c9ac0a1bcdf49ba158e4199594aafb589cd"
},
{
"url": "https://git.kernel.org/stable/c/dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac"
}
],
"title": "HID: logitech-hidpp: Fix FF device cleanup on init failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90330",
"datePublished": "2026-09-17T16:08:43.953Z",
"dateReserved": "2026-09-11T19:38:34.803Z",
"dateUpdated": "2026-10-30T12:35:12.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38187 (GCVE-0-2025-38187)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()
The RPC container is released after being passed to r535_gsp_rpc_send().
When sending the initial fragment of a large RPC and passing the
caller's RPC container, the container will be freed prematurely. Subsequent
attempts to send remaining fragments will therefore result in a
use-after-free.
Allocate a temporary RPC container for holding the initial fragment of a
large RPC when sending. Free the caller's container when all fragments
are successfully sent.
[ Rebase onto Blackwell changes. - Danilo ]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "69270d24af7694494ac4116bcad30a812ca49ca7",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
},
{
"lessThan": "cd4677407c0ee250fc21e36439c8a442ddd62cc1",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
},
{
"lessThan": "9802f0a63b641f4cddb2139c814c2e95cb825099",
"status": "affected",
"version": "176fdcbddfd288408ce8571c1760ad618d962096",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()\n\nThe RPC container is released after being passed to r535_gsp_rpc_send().\n\nWhen sending the initial fragment of a large RPC and passing the\ncaller\u0027s RPC container, the container will be freed prematurely. Subsequent\nattempts to send remaining fragments will therefore result in a\nuse-after-free.\n\nAllocate a temporary RPC container for holding the initial fragment of a\nlarge RPC when sending. Free the caller\u0027s container when all fragments\nare successfully sent.\n\n[ Rebase onto Blackwell changes. - Danilo ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is in the nouveau GSP-RM RPC layer, reached through local GPU device operations and power-management transitions (DRM device open/close driving runtime PM, or system suspend/resume). There is no network or remote-peer input path to `r535_gsp_rpc_push()`.\nAC:L - The free and the subsequent use are sequential within the same thread, so no race must be won \u2014 every large RPC (any FBSR memlist over ~33 MB, which is the normal case on GSP GPUs) deterministically reads freed memory. Reallocation of the freed order-5/6 block by the immediately following `r535_gsp_rpc_get()` is likewise deterministic behaviour of the buddy allocator, and heap grooming from another CPU is fully under attacker control.\nPR:L - An unprivileged local user with access to the DRM render node can drive nouveau runtime-PM suspend/resume cycles (which invoke `r535_gsp_fini(suspend=true)` \u2192 `fbsr-\u003esuspend` \u2192 the large memlist RPC) simply by opening and closing the device; on typical desktop/laptop systems an active local session can also request system suspend via logind without elevated rights.\nUI:N - No victim action is needed \u2014 GPU runtime suspend fires automatically on idle and can be induced by the attacker\u0027s own process lifecycle, so the vulnerable path executes without any other user interacting with the system.\nS:U - The use-after-free and its consequences are contained within the kernel\u0027s own security authority; the corrupted DMA descriptors are consumed by the GPU within the driver\u0027s existing mappings rather than crossing a VM or IOMMU security boundary.\nC:H - Up to hundreds of kilobytes of freed kernel heap are read and transmitted verbatim to the GSP firmware as RPC continuation records, and because those bytes are interpreted as physical page descriptors for the VRAM save/restore DMA, a groomed heap lets an attacker steer GPU DMA reads at arbitrary memory.\nI:H - The stale data read from the freed container becomes the PTE array that GSP-RM uses as DMA targets for writing saved VRAM contents, so attacker-controlled reallocation of that buffer yields arbitrary physical-memory writes performed by the GPU; even without grooming the driver corrupts its own freshly allocated container through the overlapping memcpy.\nA:H - The use-after-free reliably corrupts the FBSR memlist sent to GSP-RM, producing firmware hangs, RPC timeouts, WARN/oops and failed resume that leave the GPU and often the machine unusable, and it trips KASAN/hardened-usercopy style fatal reports."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:49.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/69270d24af7694494ac4116bcad30a812ca49ca7"
},
{
"url": "https://git.kernel.org/stable/c/cd4677407c0ee250fc21e36439c8a442ddd62cc1"
},
{
"url": "https://git.kernel.org/stable/c/9802f0a63b641f4cddb2139c814c2e95cb825099"
}
],
"title": "drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38187",
"datePublished": "2025-07-04T13:37:13.126Z",
"dateReserved": "2025-04-16T04:51:23.992Z",
"dateUpdated": "2026-10-21T12:36:49.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99128 (GCVE-0-2026-99128)
Vulnerability from cvelistv5
Published
2026-10-28 10:34
Modified
2026-10-30 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate chunk length in the inqueue parser
SCTP chunks always include a four-byte generic header, but
sctp_inq_pop() currently accepts shorter declared lengths. A zero-length
chunk leaves chunk_end at the current header.
When ASCONF is covered by the association's SCTP-AUTH policy,
sctp_assoc_bh_rcv() can continue before the state machine performs its
normal chunk-length check. sctp_inq_pop() then returns the same malformed
chunk repeatedly and the receive softirq can lock up.
A remote SCTP peer can trigger this after establishing an association on
a kernel built with CONFIG_IP_SCTP and configured with
net.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did
not require application credentials, a shared SCTP AUTH key, or
net.sctp.addip_noauth_enable=1.
On commit f967455fb2a5 ("seg6: reset IP6CB after IPv6 decapsulation"),
one zero-length ASCONF caused repeated
watchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger
health probes succeeded, while 36 of 37 post-trigger probes failed. With
this change, all 37 post-trigger probes succeeded and no equivalent
soft-lockup signature appeared.
Reject chunks shorter than the generic SCTP header at the shared inqueue
parser boundary. Mark the packet for discard before either caller can
continue processing it, while preserving the four-byte generic minimum.
Declared-length 1 through 4 controls and kernel-generated ASCONF traffic
remained healthy. The patched sctp_hello selftest passed for IPv4 and
IPv6.
The complete private reproducer and validation evidence are available
directly to maintainers on request.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/inqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "b0dbd53b242609c88e81b0a49093bdbef5d5a418",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "5a7ee52589dae36c93dc64d7a97c5ded84618572",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "e0fb7fe180488a5afa2e91509ea838e8df8cb771",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "40507f59f230dcf60ae13cb48d34f8c6e9f40659",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "9ac57e4c62e93c287b36080e5da3645690549990",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/inqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate chunk length in the inqueue parser\n\nSCTP chunks always include a four-byte generic header, but\nsctp_inq_pop() currently accepts shorter declared lengths. A zero-length\nchunk leaves chunk_end at the current header.\n\nWhen ASCONF is covered by the association\u0027s SCTP-AUTH policy,\nsctp_assoc_bh_rcv() can continue before the state machine performs its\nnormal chunk-length check. sctp_inq_pop() then returns the same malformed\nchunk repeatedly and the receive softirq can lock up.\n\nA remote SCTP peer can trigger this after establishing an association on\na kernel built with CONFIG_IP_SCTP and configured with\nnet.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did\nnot require application credentials, a shared SCTP AUTH key, or\nnet.sctp.addip_noauth_enable=1.\n\nOn commit f967455fb2a5 (\"seg6: reset IP6CB after IPv6 decapsulation\"),\none zero-length ASCONF caused repeated\nwatchdog soft-lockup reports in a two-vCPU KVM guest. All 3 pre-trigger\nhealth probes succeeded, while 36 of 37 post-trigger probes failed. With\nthis change, all 37 post-trigger probes succeeded and no equivalent\nsoft-lockup signature appeared.\n\nReject chunks shorter than the generic SCTP header at the shared inqueue\nparser boundary. Mark the packet for discard before either caller can\ncontinue processing it, while preserving the four-byte generic minimum.\nDeclared-length 1 through 4 controls and kernel-generated ASCONF traffic\nremained healthy. The patched sctp_hello selftest passed for IPv4 and\nIPv6.\n\nThe complete private reproducer and validation evidence are available\ndirectly to maintainers on request."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:42:02.124Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc4a4f1d6b6d725438dc37b97f03d95ed9feb63f"
},
{
"url": "https://git.kernel.org/stable/c/b0dbd53b242609c88e81b0a49093bdbef5d5a418"
},
{
"url": "https://git.kernel.org/stable/c/d28ea1a62e27210d8ea3cf496dfae85dbdd7b84f"
},
{
"url": "https://git.kernel.org/stable/c/5a7ee52589dae36c93dc64d7a97c5ded84618572"
},
{
"url": "https://git.kernel.org/stable/c/e0fb7fe180488a5afa2e91509ea838e8df8cb771"
},
{
"url": "https://git.kernel.org/stable/c/40507f59f230dcf60ae13cb48d34f8c6e9f40659"
},
{
"url": "https://git.kernel.org/stable/c/9ac57e4c62e93c287b36080e5da3645690549990"
},
{
"url": "https://git.kernel.org/stable/c/6cfc1b90cb86f4aabc69fb8e30128e07e2cdfa3a"
}
],
"title": "sctp: validate chunk length in the inqueue parser",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99128",
"datePublished": "2026-10-28T10:34:42.229Z",
"dateReserved": "2026-09-25T10:25:14.394Z",
"dateUpdated": "2026-10-30T12:42:02.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90097 (GCVE-0-2026-90097)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
The VMBus module initialization function, hv_acpi_init(), currently
does nothing when running in the root partition and root is not nested
in another VM. But the initialization function reports success, so the
VMBus module is indeed loaded. VMBus functionality is not actually
needed, but the VMBus module must be loaded so that hv_vmbus_exists()
can answer correctly. Furthermore, the mshv_root dependency on the
VMBus module is needed as described in the commit message for
840b740a35bf ("mshv: Add conditional VMBus dependency").
Loading the VMBus module without actually initializing it causes
failures if the module should later be unloaded. The module unload code
tries to clean up things that were never initialized, resulting in
memory faults and a panic.
Fix this by having VMBus module exit function perform the same
check for non-nested root partition, and do nothing in such a
case, just like hv_acpi_init().
In the long run, the code that manages the Hyper-V provided SynIC
should be refactored to better coordinate the requirements of
root partition scenarios and normal VM scenarios, and to hopefully
remove the hv_vmbus_exists() dependnecy between mshv_root and
VMBus modules. Preventing the current unload failure scenario is
an expediency until such a refactoring is done.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7e279d78664aa91107ebff4b03eca367967f5908 Version: 7e279d78664aa91107ebff4b03eca367967f5908 Version: 7e279d78664aa91107ebff4b03eca367967f5908 Version: 7e279d78664aa91107ebff4b03eca367967f5908 Version: 7e279d78664aa91107ebff4b03eca367967f5908 Version: 7e279d78664aa91107ebff4b03eca367967f5908 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/vmbus_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "321f650493d6b8169dacd4d5d6f63550dce54d6c",
"status": "affected",
"version": "7e279d78664aa91107ebff4b03eca367967f5908",
"versionType": "git"
},
{
"lessThan": "4cc1ba2b31065a48fde14e9d53ad399a3ca32e35",
"status": "affected",
"version": "7e279d78664aa91107ebff4b03eca367967f5908",
"versionType": "git"
},
{
"lessThan": "ca1f4a926d08035c52c735a42200e4e5ea548f32",
"status": "affected",
"version": "7e279d78664aa91107ebff4b03eca367967f5908",
"versionType": "git"
},
{
"lessThan": "aa17842bbccaeaba7d05c166019d1c96a41bca54",
"status": "affected",
"version": "7e279d78664aa91107ebff4b03eca367967f5908",
"versionType": "git"
},
{
"lessThan": "4c19c302cc577bd6b466f6d8e97971777392c2fa",
"status": "affected",
"version": "7e279d78664aa91107ebff4b03eca367967f5908",
"versionType": "git"
},
{
"lessThan": "cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42",
"status": "affected",
"version": "7e279d78664aa91107ebff4b03eca367967f5908",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/vmbus_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition\n\nThe VMBus module initialization function, hv_acpi_init(), currently\ndoes nothing when running in the root partition and root is not nested\nin another VM. But the initialization function reports success, so the\nVMBus module is indeed loaded. VMBus functionality is not actually\nneeded, but the VMBus module must be loaded so that hv_vmbus_exists()\ncan answer correctly. Furthermore, the mshv_root dependency on the\nVMBus module is needed as described in the commit message for\n840b740a35bf (\"mshv: Add conditional VMBus dependency\").\n\nLoading the VMBus module without actually initializing it causes\nfailures if the module should later be unloaded. The module unload code\ntries to clean up things that were never initialized, resulting in\nmemory faults and a panic.\n\nFix this by having VMBus module exit function perform the same\ncheck for non-nested root partition, and do nothing in such a\ncase, just like hv_acpi_init().\n\nIn the long run, the code that manages the Hyper-V provided SynIC\nshould be refactored to better coordinate the requirements of\nroot partition scenarios and normal VM scenarios, and to hopefully\nremove the hv_vmbus_exists() dependnecy between mshv_root and\nVMBus modules. Preventing the current unload failure scenario is\nan expediency until such a refactoring is done."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:06.704Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/321f650493d6b8169dacd4d5d6f63550dce54d6c"
},
{
"url": "https://git.kernel.org/stable/c/4cc1ba2b31065a48fde14e9d53ad399a3ca32e35"
},
{
"url": "https://git.kernel.org/stable/c/ca1f4a926d08035c52c735a42200e4e5ea548f32"
},
{
"url": "https://git.kernel.org/stable/c/aa17842bbccaeaba7d05c166019d1c96a41bca54"
},
{
"url": "https://git.kernel.org/stable/c/4c19c302cc577bd6b466f6d8e97971777392c2fa"
},
{
"url": "https://git.kernel.org/stable/c/cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42"
}
],
"title": "Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90097",
"datePublished": "2026-09-17T16:06:09.529Z",
"dateReserved": "2026-09-11T19:38:34.786Z",
"dateUpdated": "2026-10-30T12:34:06.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43352 (GCVE-0-2026-43352)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
The logic used to abort the DMA ring contains several flaws:
1. The driver unconditionally issues a ring abort even when the ring has
already stopped.
2. The completion used to wait for abort completion is never
re-initialized, resulting in incorrect wait behavior.
3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which
resets hardware ring pointers and disrupts the controller state.
4. If the ring is already stopped, the abort operation should be
considered successful without attempting further action.
Fix the abort handling by checking whether the ring is running before
issuing an abort, re-initializing the completion when needed, ensuring that
RING_CTRL_ENABLE remains asserted during abort, and treating an already
stopped ring as a successful condition.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 Version: 9ad9a52cce2828d932ae9495181e3d6414f72c07 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/mipi-i3c-hci/dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "377e75da122ffce7cec551f43fa884d57f2f8e63",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "04b2853fdbb2ec9d03ece45da3c830396647120f",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "55a0b47a372245f7667e0a4ba5c6f2a4c7a889a6",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "003df94bcc9227e8e930abd03ac7f63ac10033dc",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "5549611888f5ca2db5e8e692b57f30626ddf9898",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "b795e68bf3073d67bebbb5a44d93f49efc5b8cc7",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/mipi-i3c-hci/dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue\n\nThe logic used to abort the DMA ring contains several flaws:\n\n 1. The driver unconditionally issues a ring abort even when the ring has\n already stopped.\n 2. The completion used to wait for abort completion is never\n re-initialized, resulting in incorrect wait behavior.\n 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which\n resets hardware ring pointers and disrupts the controller state.\n 4. If the ring is already stopped, the abort operation should be\n considered successful without attempting further action.\n\nFix the abort handling by checking whether the ring is running before\nissuing an abort, re-initializing the completion when needed, ensuring that\nRING_CTRL_ENABLE remains asserted during abort, and treating an already\nstopped ring as a successful condition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable DMA dequeue path is reached through local I3C/I2C transfer paths on a system with MIPI I3C HCI hardware, including kernel I3C client drivers and the i2c-dev ioctl path. It is not reachable through network packets or a remotely exposed protocol.\nAC:L - A local attacker who can initiate transfers can force timeout/error handling, for example by setting aggressive I2C adapter timeouts and issuing transfers, causing the dequeue abort path to run. The trigger does not depend on an uncontrollable race or rare memory layout.\nPR:L - The practical attacker needs local access to an exposed I2C/I3C transfer interface or low-privilege access to driver operations that initiate I3C transfers. No init-namespace root-only capability gate or user-namespace-mediated privilege path is required for the core vulnerable path.\nUI:N - Once the attacker has local access to the relevant transfer interface, exploitation does not require another user to perform an action. The attacker can repeatedly issue the triggering transfers themselves.\nS:U - The vulnerability corrupts or disrupts kernel/controller state within the same host security authority. It does not constitute a VM escape or a demonstrated IOMMU/security-scope bypass.\nC:H - The faulty abort handling can fail to stop DMA correctly and can unmap/free transfer buffers while hardware may still be writing, creating a plausible kernel memory corruption primitive. Under the required higher-severity rule, this is scored as potentially enabling high-impact information disclosure.\nI:H - Incorrectly aborting and restarting the DMA ring can leave hardware DMA active against stale or reused memory and corrupt kernel data structures. Such DMA-after-unmap memory corruption is defensibly treated as high integrity impact because it may be shaped into arbitrary kernel memory modification or control-flow compromise.\nA:H - The bug can disrupt the controller state, trigger WARN_ON paths, hang transfers, and plausibly corrupt kernel memory through continued DMA after a failed abort. This supports high availability impact due to kernel crash, hang, or persistent device failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:28.372Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/377e75da122ffce7cec551f43fa884d57f2f8e63"
},
{
"url": "https://git.kernel.org/stable/c/04b2853fdbb2ec9d03ece45da3c830396647120f"
},
{
"url": "https://git.kernel.org/stable/c/55a0b47a372245f7667e0a4ba5c6f2a4c7a889a6"
},
{
"url": "https://git.kernel.org/stable/c/003df94bcc9227e8e930abd03ac7f63ac10033dc"
},
{
"url": "https://git.kernel.org/stable/c/5549611888f5ca2db5e8e692b57f30626ddf9898"
},
{
"url": "https://git.kernel.org/stable/c/b795e68bf3073d67bebbb5a44d93f49efc5b8cc7"
}
],
"title": "i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43352",
"datePublished": "2026-05-08T14:21:09.552Z",
"dateReserved": "2026-05-01T14:12:56.004Z",
"dateUpdated": "2026-10-30T12:25:28.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38064 (GCVE-0-2025-38064)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio: break and reset virtio devices on device_shutdown()
Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory
accesses during the hang.
Invalid read at addr 0x102877002, size 2, region '(null)', reason: rejected
Invalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected
...
It was traced down to virtio-console. Kexec works fine if virtio-console
is not in use.
The issue is that virtio-console continues to write to the MMIO even after
underlying virtio-pci device is reset.
Additionally, Eric noticed that IOMMUs are reset before devices, if
devices are not reset on shutdown they continue to poke at guest memory
and get errors from the IOMMU. Some devices get wedged then.
The problem can be solved by breaking all virtio devices on virtio
bus shutdown, then resetting them.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38064",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:46:59.627689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:52:07.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/virtio/virtio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c03e32494dd0bbcc301523e5ae567c2f567a7d9",
"status": "affected",
"version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
"versionType": "git"
},
{
"lessThan": "acdfe206be6c70ec55dc8bfdb1a22036d10fae26",
"status": "affected",
"version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
"versionType": "git"
},
{
"lessThan": "1eaa83fd94ed5e40d43139025f5acb7bcfed3b5f",
"status": "affected",
"version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
"versionType": "git"
},
{
"lessThan": "aee42f3d57bfa37b2716df4584edeecf63b9df4c",
"status": "affected",
"version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
"versionType": "git"
},
{
"lessThan": "8bd2fa086a04886798b505f28db4002525895203",
"status": "affected",
"version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/virtio/virtio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region \u0027(null)\u0027, reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region \u0027(null)\u0027, reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is `device_shutdown()`, reached only through local reboot/halt/kexec syscalls in `kernel/reboot.c`; no network or adjacent-network input reaches the virtio bus shutdown code. The impact lands on the local system (guest kernel), so the vector is Local.\nAC:L - The failure is deterministic rather than a race \u2014 every reboot/kexec on a system with an in-use virtio device (virtio-console, virtio-net, virtio-blk) leaves the device unquiesced, and the reporter noted kexec hangs reliably whenever virtio-console is in use. No memory-layout or timing conditions outside the attacker\u0027s control are required.\nPR:L - Although `reboot()`/`kexec_load()` nominally check `CAP_SYS_BOOT`, unprivileged local users on typical desktop, embedded and appliance deployments can initiate a system reboot or power-off through logind/polkit (and Ctrl-Alt-Del reaches `ctrl_alt_del()` with no credentials at all), so a basic local user can reach `device_shutdown()`. Choosing the higher-severity option, this is Low rather than High.\nUI:N - The reboot/kexec that triggers the unquiesced-device window is performed by the attacker themselves; no separate victim has to open a file, mount a filesystem, or take any other action.\nS:U - Both the flawed code and the damage \u2014 the hang, the stray MMIO/DMA traffic, and the corruption of the newly loaded kernel image \u2014 are confined to the same kernel/guest security authority. The virtio backend that performs the stray DMA already holds authority over that memory, so no privilege boundary is crossed.\nC:H - With virtqueues left armed and `intel_iommu_shutdown()` having already disabled translation and protected memory regions, the still-live device continues DMA *reads* from stale ring and buffer physical addresses \u2014 QEMU observed exactly this (\"Invalid read at addr 0x102877002\"). Those reads hand the contents of memory now owned by the kexec\u0027d kernel to the device backend, an unbounded kernel-memory disclosure.\nI:H - The same unreset devices continue DMA *writes* into stale buffer addresses (\"Invalid write at addr 0x102877A44\") after DMA isolation has been torn down, so a device such as virtio-net can deposit remote-attacker-supplied packet bytes into memory that the freshly loaded kernel has repurposed for its own image and data. That is arbitrary corruption of the incoming kernel, exploitable for control-flow hijack.\nA:H - The reported symptom is a hard hang of the VM on kexec \u2014 the machine never completes the boot and requires an out-of-band power cycle \u2014 and the commit further notes that devices \"get wedged\" once the IOMMU rejects their accesses. Complete loss of availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:38.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c03e32494dd0bbcc301523e5ae567c2f567a7d9"
},
{
"url": "https://git.kernel.org/stable/c/acdfe206be6c70ec55dc8bfdb1a22036d10fae26"
},
{
"url": "https://git.kernel.org/stable/c/1eaa83fd94ed5e40d43139025f5acb7bcfed3b5f"
},
{
"url": "https://git.kernel.org/stable/c/aee42f3d57bfa37b2716df4584edeecf63b9df4c"
},
{
"url": "https://git.kernel.org/stable/c/8bd2fa086a04886798b505f28db4002525895203"
}
],
"title": "virtio: break and reset virtio devices on device_shutdown()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38064",
"datePublished": "2025-06-18T09:33:42.931Z",
"dateReserved": "2025-04-16T04:51:23.980Z",
"dateUpdated": "2026-10-30T12:21:38.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99083 (GCVE-0-2026-99083)
Vulnerability from cvelistv5
Published
2026-10-23 12:45
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 676392184785ace61e939831e7ca44a03d438c3b Version: ef572ffa8eb44111eed2925fbb2adca78bdcbf61 Version: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 Version: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 Version: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 Version: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 Version: 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 Version: 2ba03cecb12ac7ac9e0170e251543c56832d9959 Version: 5.15.145 ≤ Version: 6.1.40 ≤ Version: 6.4.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a07dfb33112a42437f9d2d0bfd35c68575257381",
"status": "affected",
"version": "676392184785ace61e939831e7ca44a03d438c3b",
"versionType": "git"
},
{
"lessThan": "1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff",
"status": "affected",
"version": "ef572ffa8eb44111eed2925fbb2adca78bdcbf61",
"versionType": "git"
},
{
"lessThan": "59c6dcc5dd9dafe764ca0d40525933b2be69b059",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "517404e157395d0f8da125ca956c566895dfcd06",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "4722d06b2907585074252061b1024a696c1cfc23",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"lessThan": "23a0be6a84a38ac169eeab49017934e8e27c65f0",
"status": "affected",
"version": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8",
"versionType": "git"
},
{
"status": "affected",
"version": "2ba03cecb12ac7ac9e0170e251543c56832d9959",
"versionType": "git"
},
{
"lessThan": "5.15.224",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ksmbd_conn_handler_loop() receives the compound request over TCP/445, and __process_request() dispatches its non-first SMB2 SESSION_SETUP to smb2_sess_setup() and krb5_authenticate(). The SESSION_SETUP SecurityBuffer carries the Kerberos AP-REQ that produces the AP-REP copied by the patched path.\nAC:L - The same authenticated peer can create directory entries, request a sized QUERY_DIRECTORY response, and place SESSION_SETUP later in the compound, controlling next_smb2_rsp_hdr_off before supplying its valid AP-REQ; no race or external actor is required.\nPR:L - ksmbd_krb5_authenticate() checks KSMBD_USER_FLAG_OK before its length check and memcpy; ksmbd.mountd sets it only after krb5_rd_req() accepts the AP-REQ and usm_handle_login_request() recognizes the account. An ordinary valid Kerberos account suffices, but an unauthenticated peer cannot reach the write.\nUI:N - The peer opens the session, prepares the prior compound response, and sends the Kerberos SESSION_SETUP itself; no victim user must open, mount, or approve anything.\nS:U - ksmbd_krb5_authenticate() corrupts memory adjacent to the host kernel\u0027s response_buf allocation; this remains within the same kernel security authority and crosses no VM, IOMMU, or sandbox boundary.\nC:H - The AP-REP memcpy in ksmbd_krb5_authenticate() can overrun response_buf and corrupt adjacent heap objects; exploitable kernel heap corruption can be converted into a memory-read primitive exposing arbitrary kernel data.\nI:H - The memcpy writes resp-\u003espnego_blob_len AP-REP bytes beyond response_buf into adjacent kernel heap memory, enabling corruption of object metadata or control data and potential kernel code execution.\nA:H - Writing the AP-REP beyond response_buf can corrupt adjacent allocations or allocator metadata and trigger KASAN, an oops, or a kernel panic; the authenticated SMB peer can repeat the compound request."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:38.581Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381"
},
{
"url": "https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff"
},
{
"url": "https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059"
},
{
"url": "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a"
},
{
"url": "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"
},
{
"url": "https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23"
},
{
"url": "https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0"
}
],
"title": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99083",
"datePublished": "2026-10-23T12:45:01.735Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-30T12:41:38.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63832 (GCVE-0-2026-63832)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: add wcid publish check in mt76_sta_add
Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add
to avoid reinitializing the wcid->poll_list.
Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4.
According to the corruption information, prev->next was changed to itself.
wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2
wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)
wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)
slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192
list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).
mt76_wcid_add_poll+0x95/0xd0 [mt76]
mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]
mt7925_rx_check+0xa7/0xc0 [mt7925_common]
mt76_dma_rx_poll+0x50d/0x790 [mt76]
mt792x_poll_rx+0x52/0xe0 [mt792x_lib]
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c9389e3f9453ec2d710e61830eafedddfd561226 Version: 4911e4cb157cf87d5bdb3fa8e0c200032443371e Version: 4911e4cb157cf87d5bdb3fa8e0c200032443371e Version: 4911e4cb157cf87d5bdb3fa8e0c200032443371e Version: 57d3f833087942ded1a8765b1b361454d3d39e8f Version: 6.12.13 ≤ Version: 6.13.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63832",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:31:24.788366Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "CWE-662 Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:49.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "720f39a9c60fdb604291c630f4f157753b376d68",
"status": "affected",
"version": "c9389e3f9453ec2d710e61830eafedddfd561226",
"versionType": "git"
},
{
"lessThan": "3c499851753a24d2e148d4e9ca51764c0c51554e",
"status": "affected",
"version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
"versionType": "git"
},
{
"lessThan": "55e014aaec650ede08b693ba59c8d0443f13f11c",
"status": "affected",
"version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
"versionType": "git"
},
{
"lessThan": "20b126920a259df4d7dcae19fcfe2c57a74d6b2e",
"status": "affected",
"version": "4911e4cb157cf87d5bdb3fa8e0c200032443371e",
"versionType": "git"
},
{
"status": "affected",
"version": "57d3f833087942ded1a8765b1b361454d3d39e8f",
"versionType": "git"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.13",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mac80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: add wcid publish check in mt76_sta_add\n\nSince mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add\nto avoid reinitializing the wcid-\u003epoll_list.\n\nFound dev-\u003esta_poll_list corruption when using mt7925 and 7.1-rc4.\nAccording to the corruption information, prev-\u003enext was changed to itself.\n\nwlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2\nwlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b)\nwlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3)\n slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192\nlist_add corruption. prev-\u003enext should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040).\n\n mt76_wcid_add_poll+0x95/0xd0 [mt76]\n mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common]\n mt7925_rx_check+0xa7/0xc0 [mt7925_common]\n mt76_dma_rx_poll+0x50d/0x790 [mt76]\n mt792x_poll_rx+0x52/0xe0 [mt792x_lib]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached through WiFi RX/TX-status DMA processing and station add during 802.11 association/roaming, both triggered by frames from a peer on the same wireless segment. Per kernel WiFi guidance, frame-driven driver bugs are Adjacent, not Network.\nAC:L - An adjacent attacker can reliably create the race by sending deauth/association traffic to force sta re-add while flooding data frames to keep the RX poll path active; both sides of the race are attacker-influenced and repeatable.\nPR:N - Exploitation requires no Linux privileges\u2014only the ability to send 802.11 management/data frames as a nearby WiFi peer (rogue AP, deauth attacker, or associating client on AP mode), with no authentication to the victim host.\nUI:N - No victim user action is required beyond normal WiFi operation; deauth-forced roaming and automatic reassociation drive the vulnerable sta_add path without user interaction.\nS:U - Impact is kernel heap/list corruption within the same security authority; this is not a VM escape, IOMMU bypass, or cross-namespace boundary violation.\nC:H - Reinitializing an embedded list_head while still linked corrupts kernel linked-list metadata in kmalloc-backed structures; list corruption is memory corruption that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The corrupted doubly-linked list enables list-poisoning style arbitrary kernel writes and potential control-flow hijacking, not merely a bounded or transient modification.\nA:H - The reproducer triggers kernel list_add corruption detection and crash; corrupted sta_poll_list integrity can cause kernel panic/oops during normal WiFi operation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:39.285Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/720f39a9c60fdb604291c630f4f157753b376d68"
},
{
"url": "https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e"
},
{
"url": "https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c"
},
{
"url": "https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e"
}
],
"title": "wifi: mt76: add wcid publish check in mt76_sta_add",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63832",
"datePublished": "2026-07-19T12:02:24.908Z",
"dateReserved": "2026-07-19T07:54:57.015Z",
"dateUpdated": "2026-10-21T12:42:39.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68323 (GCVE-0-2026-68323)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: serialize udp bearer replicast list updates
tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with
list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs
from the encap receive softirq (via tipc_udp_rcast_disc()) without
rtnl_lock(), so it can race the cleanup delete and corrupt the list:
list_del corruption. prev->next should be ffff8880298d7ab8,
but was ffff88802449ad38. (prev=ffff888027e3ec98)
kernel BUG at lib/list_debug.c:62!
RIP: __list_del_entry_valid_or_report+0x17a/0x200
Workqueue: events cleanup_bearer
Call Trace:
cleanup_bearer (net/tipc/udp_media.c:811)
process_one_work (kernel/workqueue.c:3302)
worker_thread (kernel/workqueue.c:3466)
The bearer can be enabled from an unprivileged user namespace, as the
TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.
Add a spinlock to struct udp_bearer and take it around the list_add_rcu()
in tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so
the two writers can no longer corrupt the list.
Reject a duplicate peer under the same lock before allocating, and remove
tipc_udp_is_known_peer(). The old lockless pre-check in
tipc_udp_rcast_disc() was racy: two softirqs discovering the same peer
could both find it absent and add it twice.
cleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the
bearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()
and add a peer after cleanup_bearer() has already emptied the list, leaking
that entry when the bearer is freed. Mark the bearer disabled under
rcast_lock once the list is emptied and refuse further additions.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ef20cd4dd1633987bcf46ac34ace2c8af212361f Version: ef20cd4dd1633987bcf46ac34ace2c8af212361f Version: ef20cd4dd1633987bcf46ac34ace2c8af212361f Version: ef20cd4dd1633987bcf46ac34ace2c8af212361f Version: ef20cd4dd1633987bcf46ac34ace2c8af212361f Version: ef20cd4dd1633987bcf46ac34ace2c8af212361f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:07.182932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:04.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/udp_media.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c148aec60ef1e806cbc9da44b3d89409df998ade",
"status": "affected",
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
"versionType": "git"
},
{
"lessThan": "3ff6b534d20824cddab99c81ea3bd1144e635626",
"status": "affected",
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
"versionType": "git"
},
{
"lessThan": "3ff143a884a19bfcf3aebd999b02274fe44f46f3",
"status": "affected",
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
"versionType": "git"
},
{
"lessThan": "5d3cea7d41dc72073fea6f879815c9b57c3b330d",
"status": "affected",
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
"versionType": "git"
},
{
"lessThan": "d70c81001df9320d3445e664428a1d408b5ba896",
"status": "affected",
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
"versionType": "git"
},
{
"lessThan": "350e592ff4e30e48ffb55e142d11a73e63f4869c",
"status": "affected",
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/udp_media.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub-\u003ercast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n list_del corruption. prev-\u003enext should be ffff8880298d7ab8,\n but was ffff88802449ad38. (prev=ffff888027e3ec98)\n kernel BUG at lib/list_debug.c:62!\n RIP: __list_del_entry_valid_or_report+0x17a/0x200\n Workqueue: events cleanup_bearer\n Call Trace:\n cleanup_bearer (net/tipc/udp_media.c:811)\n process_one_work (kernel/workqueue.c:3302)\n worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer\u0027s up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires the local half of the race \u2014 enabling and then disabling a TIPC UDP replicast bearer via generic netlink \u2014 even though the second half is driven by UDP packets; a purely remote peer cannot schedule cleanup_bearer(), so local access is needed.\nAC:L - The attacker owns both racers: they flood LINK_CONFIG UDP packets at the bearer port (softirq list_add_rcu) while issuing TIPC_NL_BEARER_DISABLE (workqueue list_del_rcu), and the window is wide because b-\u003eup is cleared before cleanup_bearer is scheduled, so it can be retried until it hits.\nPR:L - TIPC_NL_BEARER_ENABLE/DISABLE/ADD use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the net\u0027s owning user namespace, which any unprivileged user obtains with unshare -Urn; no real root is required.\nUI:N - The attacker performs every step itself \u2014 create netns, enable bearer, send packets, disable bearer \u2014 with no action by any other user or administrator.\nS:U - The corruption and any resulting escalation stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Concurrent list_add_rcu/list_del_rcu on ub-\u003ercast.list leaves dangling and duplicated entries, so udp_replicast objects freed by rcast_free_rcu remain reachable from the list; the resulting use-after-free reads of attacker-groomed heap memory can disclose arbitrary kernel data.\nI:H - List corruption makes list_add_rcu/list_del_rcu write prev-\u003enext and next-\u003eprev through stale pointers into freed or attacker-controlled heap memory, a classic write primitive that is leverageable for control-flow hijack and privilege escalation.\nA:H - The reported symptom is a hard kernel BUG at lib/list_debug.c:62 (__list_del_entry_valid_or_report) in the cleanup_bearer workqueue, i.e. an immediate panic; without CONFIG_DEBUG_LIST the corrupted list and freed-entry traversal crash the kernel anyway."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:23.482Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c148aec60ef1e806cbc9da44b3d89409df998ade"
},
{
"url": "https://git.kernel.org/stable/c/3ff6b534d20824cddab99c81ea3bd1144e635626"
},
{
"url": "https://git.kernel.org/stable/c/3ff143a884a19bfcf3aebd999b02274fe44f46f3"
},
{
"url": "https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d"
},
{
"url": "https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896"
},
{
"url": "https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c"
}
],
"title": "tipc: serialize udp bearer replicast list updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68323",
"datePublished": "2026-08-10T12:02:59.034Z",
"dateReserved": "2026-07-30T09:28:09.382Z",
"dateUpdated": "2026-10-30T12:28:23.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64068 (GCVE-0-2026-64068)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix missing locking around retry adding new subreqs
Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take
the appropriate lock when adding extra subrequests into
stream->subrequests.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_retry.c",
"fs/netfs/write_retry.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f59c4ec86ef3a9ac99706ae163a38ec28129fd76",
"status": "affected",
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
"versionType": "git"
},
{
"lessThan": "d5c9d19b0ff2f7153532ac238a5e96fed2df315c",
"status": "affected",
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
"versionType": "git"
},
{
"lessThan": "393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2",
"status": "affected",
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
"versionType": "git"
},
{
"lessThan": "cce18c263e9623872327ba3c956012f73c1179cc",
"status": "affected",
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/read_retry.c",
"fs/netfs/write_retry.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing locking around retry adding new subreqs\n\nFix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take\nthe appropriate lock when adding extra subrequests into\nstream-\u003esubrequests."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in netfs client retry logic reached when CIFS, Ceph, AFS, or fscache-backed NFS processes I/O responses from a remote server; a malicious or MITM server can trigger retries and race the collector via crafted protocol replies.\nAC:L - An attacker controlling the remote server can force NEED_RETRY conditions and time fast completions during subrequest splitting; they control both sides of the race by sending concurrent responses while the client retries.\nPR:N - Exploitation requires no privileges on the victim host; a remote attacker only needs the client to have an active mount and any process to perform normal reads or writes against it.\nUI:N - No victim interaction beyond routine filesystem access on an already-mounted share; readahead, writeback, and daemon I/O can trigger the race without deliberate user action.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Concurrent unsynchronized list manipulation of refcounted subrequest objects can cause use-after-free, enabling arbitrary kernel memory disclosure.\nI:H - List corruption and use-after-free on heap-allocated subrequests can be leveraged for arbitrary kernel writes and control-flow hijacking.\nA:H - The race can corrupt the subrequest list and trigger kernel oops, panic, or use-after-free crashes during normal network filesystem I/O retries."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:00.243Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f59c4ec86ef3a9ac99706ae163a38ec28129fd76"
},
{
"url": "https://git.kernel.org/stable/c/d5c9d19b0ff2f7153532ac238a5e96fed2df315c"
},
{
"url": "https://git.kernel.org/stable/c/393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2"
},
{
"url": "https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc"
}
],
"title": "netfs: Fix missing locking around retry adding new subreqs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64068",
"datePublished": "2026-07-19T15:39:45.306Z",
"dateReserved": "2026-07-19T07:54:57.030Z",
"dateUpdated": "2026-10-21T12:43:00.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-37743 (GCVE-0-2025-37743)
Vulnerability from cvelistv5
Published
2025-05-01 12:55
Modified
2026-11-05 20:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Avoid memory leak while enabling statistics
Driver uses monitor destination rings for extended statistics mode and
standalone monitor mode. In extended statistics mode, TLVs are parsed from
the buffer received from the monitor destination ring and assigned to the
ppdu_info structure to update per-packet statistics. In standalone monitor
mode, along with per-packet statistics, the packet data (payload) is
captured, and the driver updates per MSDU to mac80211.
When the AP interface is enabled, only extended statistics mode is
activated. As part of enabling monitor rings for collecting statistics,
the driver subscribes to HAL_RX_MPDU_START TLV in the filter
configuration. This TLV is received from the monitor destination ring, and
kzalloc for the mon_mpdu object occurs, which is not freed, leading to a
memory leak. The kzalloc for the mon_mpdu object is only required while
enabling the standalone monitor interface. This causes a memory leak while
enabling extended statistics mode in the driver.
Fix this memory leak by removing the kzalloc for the mon_mpdu object in
the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone
monitor mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs.
These TLV tags will be handled properly when enabling standalone monitor
mode in the future.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-37743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:40:17.654801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:41:53.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_mon.c",
"drivers/net/wireless/ath/ath12k/hal_rx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0554373bc9acccfbbc53a7fc5f94e8227a2f2959",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "8319cf3c0f2ed1f1d4c256c0bf605833bc45dbbb",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "286bab0fc7b9db728dab8c63cadf6be9b3facf8c",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
},
{
"lessThan": "ecfc131389923405be8e7a6f4408fd9321e4d19b",
"status": "affected",
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_mon.c",
"drivers/net/wireless/ath/ath12k/hal_rx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.3",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Avoid memory leak while enabling statistics\n\nDriver uses monitor destination rings for extended statistics mode and\nstandalone monitor mode. In extended statistics mode, TLVs are parsed from\nthe buffer received from the monitor destination ring and assigned to the\nppdu_info structure to update per-packet statistics. In standalone monitor\nmode, along with per-packet statistics, the packet data (payload) is\ncaptured, and the driver updates per MSDU to mac80211.\n\nWhen the AP interface is enabled, only extended statistics mode is\nactivated. As part of enabling monitor rings for collecting statistics,\nthe driver subscribes to HAL_RX_MPDU_START TLV in the filter\nconfiguration. This TLV is received from the monitor destination ring, and\nkzalloc for the mon_mpdu object occurs, which is not freed, leading to a\nmemory leak. The kzalloc for the mon_mpdu object is only required while\nenabling the standalone monitor interface. This causes a memory leak while\nenabling extended statistics mode in the driver.\n\nFix this memory leak by removing the kzalloc for the mon_mpdu object in\nthe HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone\nmonitor mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs.\nThese TLV tags will be handled properly when enabling standalone monitor\nmode in the future.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:22.701Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0554373bc9acccfbbc53a7fc5f94e8227a2f2959"
},
{
"url": "https://git.kernel.org/stable/c/8319cf3c0f2ed1f1d4c256c0bf605833bc45dbbb"
},
{
"url": "https://git.kernel.org/stable/c/286bab0fc7b9db728dab8c63cadf6be9b3facf8c"
},
{
"url": "https://git.kernel.org/stable/c/ecfc131389923405be8e7a6f4408fd9321e4d19b"
}
],
"title": "wifi: ath12k: Avoid memory leak while enabling statistics",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-37743",
"datePublished": "2025-05-01T12:55:51.312Z",
"dateReserved": "2025-04-16T04:51:23.936Z",
"dateUpdated": "2026-11-05T20:41:53.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99082 (GCVE-0-2026-99082)
Vulnerability from cvelistv5
Published
2026-10-23 12:45
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Use active memslots for the per-vCPU MMIO cache
KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information. Both the fill and
validation paths use kvm_memslots(), which unconditionally selects address
space 0, even when the vCPU is running in SMM and using address space 1.
Commit 56f17dd3fbc4 ("kvm: x86: fix stale mmio cache bug") added the
memslot generation to the cache key so that a memslot update could not
leave a stale entry valid. When commit 699023e23965 ("KVM: x86: add SMM
to the MMU role, support SMRAM address space") added the SMM address space,
these helpers were not converted to use the active memslots.
Consequently, an update to the SMM memslots can leave an entry from the old
SMM address space apparently valid after the vCPU returns to the normal
address space. A guest can then cause an access to valid RAM at the same
GFN to be returned to userspace as KVM_EXIT_MMIO.
Completing that exit through the VMM's RAM address space writes the backing
page without going through KVM's write-tracking path. If the page backs a
nested EPT table, KVM can continue using shadow translations derived from
the old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()
catches this invalid cache and memslot combination.
Use the vCPU's active memslots when caching and validating the entry.
Memslot generations are unique across address spaces, so the generation
also distinguishes the normal and SMM views. This matches the MMIO SPTE
cache, which already uses kvm_vcpu_memslots().
On an unpatched current-mainline kernel, a regression test that fills the
cache in SMM and updates only the SMM memslots fails the intended RAM write
and triggers the kvm_mmu_write_protect_fault() warning. With this change,
the same test completes the RAM write without a warning. The x86/smm_test,
set_memory_region_test, and memslot_modification_stress_test selftests also
pass.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 Version: 699023e239658e62da6f42f47d31b54788521ec1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "485a5286675b15b00ee850d90eaa178cc588445f",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "445e3369ac8cc1b18aedc8e8f977c68a0a326fa9",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "1c77d33d85786d36e56ca1b580fb55347fd65b47",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "a63f79d9da9468952396af73e1e53330845cf876",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "2566780c684c9c21241d409d790087c73070f312",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "e792a9ace39d2812a5b342a1987186c7bc653204",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "b3e6212dea2e4328a841ceb37f377583176dc735",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information. Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid. When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space. A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM\u0027s RAM address space writes the backing\npage without going through KVM\u0027s write-tracking path. If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU\u0027s active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views. This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning. With this change,\nthe same test completes the RAM write without a warning. The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker drives guest memory accesses through KVM_RUN via kvm_vcpu_ioctl()-\u003ekvm_arch_vcpu_ioctl_run()-\u003ehandle_ept_violation()/handle_ept_misconfig()-\u003ekvm_mmu_page_fault(), reaching the patched MMIO-cache helpers; no network protocol carries the input.\nAC:L - A malicious L1 can deterministically enter SMM, fault on an unmapped GFN to fill the cache, alter Q35 SMRAM mappings, execute RSM, and write the same GFN; this requires no race, and the complete sequence was reproduced with nested VMX/EPT.\nPR:L - The demonstrated escape needs kernel-level control of the L1 guest to manage SMM and EPT12, but that is tenant-granted guest privilege relative to host KVM; neither kvm_mmu_page_fault() nor vcpu_match_mmio_gen() requires host administrative capability.\nUI:N - The malicious L1 performs the SMM access, Q35 SMRAM reconfiguration, RSM, nested-EPT update, and final RAM write itself, without any action by a host user or administrator.\nS:C - The flaw originates in host KVM\u0027s per-vCPU MMIO cache, while stale shadow EPT translations permit the guest to access host kernel memory, crossing the guest-to-host virtualization boundary.\nC:H - Bypassing kvm_page_track_write() leaves EPT02 translations derived from old EPT12 contents; on affected Linux 6.1.74 this exact stale mapping was demonstrated to provide arbitrary reads of host physical and kernel memory.\nI:H - The same stale EPT02 translations were demonstrated to provide arbitrary host-memory writes and host-kernel code execution after emulator_write_emulated() incorrectly routed the tracked EPT12 write through KVM_EXIT_MMIO.\nA:H - Arbitrary host-kernel writes and code execution can crash the host and all co-resident VMs; independently, the invalid cache state reaches WARN_ON_ONCE() in kvm_mmu_write_protect_fault(), which panics hardened panic_on_warn hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:37.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/485a5286675b15b00ee850d90eaa178cc588445f"
},
{
"url": "https://git.kernel.org/stable/c/445e3369ac8cc1b18aedc8e8f977c68a0a326fa9"
},
{
"url": "https://git.kernel.org/stable/c/1c77d33d85786d36e56ca1b580fb55347fd65b47"
},
{
"url": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876"
},
{
"url": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd"
},
{
"url": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312"
},
{
"url": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204"
},
{
"url": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735"
}
],
"title": "KVM: x86: Use active memslots for the per-vCPU MMIO cache",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99082",
"datePublished": "2026-10-23T12:45:00.798Z",
"dateReserved": "2026-09-25T10:25:14.390Z",
"dateUpdated": "2026-10-30T12:41:37.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43310 (GCVE-0-2026-43310)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-10-30 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and
g2 VPU cannot decode simultaneously; otherwise, it will cause below bus
error and produce corrupted pictures, even potentially lead to system hang.
[ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out.
[ 110.583517] hantro-vpu 38310000.video-codec: bus error detected.
Therefore, it is necessary to ensure that g1 and g2 operate alternately.
This allows for successful multi-instance decoding of H.264 and HEVC.
To achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the
v4l2_m2m_dev can handle the scheduling.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c Version: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c Version: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c Version: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c Version: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c Version: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/verisilicon/hantro.h",
"drivers/media/platform/verisilicon/hantro_drv.c",
"drivers/media/platform/verisilicon/imx8m_vpu_hw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42a9fbccb33a38c5a9e0a84680939da8eae4f60e",
"status": "affected",
"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c",
"versionType": "git"
},
{
"lessThan": "f988fbf0536b42f6a05ccc1ac709d60236ec1aa6",
"status": "affected",
"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c",
"versionType": "git"
},
{
"lessThan": "f2efc1e8ab65bdb9b892af132887323e4df92f02",
"status": "affected",
"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c",
"versionType": "git"
},
{
"lessThan": "5133ef7c893c2c3aee7dd12503dc480de9dbfbb5",
"status": "affected",
"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c",
"versionType": "git"
},
{
"lessThan": "286d629d10640bc22f3bf46aa4f356eb7975e862",
"status": "affected",
"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c",
"versionType": "git"
},
{
"lessThan": "e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765",
"status": "affected",
"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/verisilicon/hantro.h",
"drivers/media/platform/verisilicon/hantro_drv.c",
"drivers/media/platform/verisilicon/imx8m_vpu_hw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC\n\nFor the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and\ng2 VPU cannot decode simultaneously; otherwise, it will cause below bus\nerror and produce corrupted pictures, even potentially lead to system hang.\n\n[ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out.\n[ 110.583517] hantro-vpu 38310000.video-codec: bus error detected.\n\nTherefore, it is necessary to ensure that g1 and g2 operate alternately.\nThis allows for successful multi-instance decoding of H.264 and HEVC.\n\nTo achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the\nv4l2_m2m_dev can handle the scheduling."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:25:25.171Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42a9fbccb33a38c5a9e0a84680939da8eae4f60e"
},
{
"url": "https://git.kernel.org/stable/c/f988fbf0536b42f6a05ccc1ac709d60236ec1aa6"
},
{
"url": "https://git.kernel.org/stable/c/f2efc1e8ab65bdb9b892af132887323e4df92f02"
},
{
"url": "https://git.kernel.org/stable/c/5133ef7c893c2c3aee7dd12503dc480de9dbfbb5"
},
{
"url": "https://git.kernel.org/stable/c/286d629d10640bc22f3bf46aa4f356eb7975e862"
},
{
"url": "https://git.kernel.org/stable/c/e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765"
}
],
"title": "media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43310",
"datePublished": "2026-05-08T13:11:28.372Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-10-30T12:25:25.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52956 (GCVE-0-2026-52956)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
In __ceph_x_decrypt(), a part of the buffer p is interpreted as a
ceph_x_encrypt_header, and the magic field of this struct is accessed.
This happens without any guarantee that the buffer is large enough to
hold this struct. The function parameter ciphertext_len represents the
length of the ciphertext to decrypt and is guaranteed to be at most the
remaining size of the allocated buffer p. However, this value is not
necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message
frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold
the ciphertext at its end with a ciphertext_len of 8 or less, can
trigger an out-of-bounds memory access when accessing hdr->magic.
This patch fixes the issue by adding a check to ensure that the
decrypted plaintext in the buffer is large enough to represent at least
the ceph_x_encrypt_header.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 Version: e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 Version: e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 Version: e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 Version: e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 Version: e15fd0a11db00fc7f470a9fc804657ec3f6d04a5 Version: 2982b9c92a66604ffb9fb2db54cf735133d1ef56 Version: 4.9.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52956",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:23:29.086880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:10.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c417b7d2d1c7fdc25af24490201320e36a3cc21d",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"lessThan": "759053333a40c6997c2917dcd6160bfe40d2b42e",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"lessThan": "ebc7eddf6225b87e3aae720875f9dd40cb6b1cef",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"lessThan": "5df268406ef38d0f92547959296577c7077dacdc",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"lessThan": "c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"lessThan": "821365487aa58d06bda65c676ba215d506ba9768",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"status": "affected",
"version": "2982b9c92a66604ffb9fb2db54cf735133d1ef56",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr-\u003emagic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable CephX decrypt path processes auth payloads received over the Ceph messenger TCP protocol from monitors/OSDs/MDSs. A malicious or compromised remote Ceph peer can supply the malformed auth frame during connection authentication.\nAC:L - The attacker controls the frame and ciphertext length needed to reach the missing plaintext-size check. No race or unusual victim state is required once the kernel client connects to the attacker-controlled peer.\nPR:N - The vulnerable parsing occurs in the authentication handshake before the remote peer has been authenticated by the kernel client. The attacker needs no privileges on the vulnerable system.\nUI:N - In a reasonable deployment, a configured kernel Ceph client connects or reconnects to its Ceph peers automatically. Exploitation does not require an interactive victim action at trigger time.\nS:U - The impact is within the kernel/client system processing the Ceph protocol. It does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a bounded out-of-bounds read of the CephX encryption header magic field, but the read value is only compared internally and is not returned to the attacker. There is no practical information disclosure primitive.\nI:N - The vulnerable code performs no write based on the out-of-bounds access. The fix adds a read-side length check and there is no memory corruption or data modification path.\nA:H - The peer-controlled short plaintext can trigger an out-of-bounds kernel memory access in the auth receive path. Such kernel OOB accesses can produce an oops/panic or otherwise terminate the Ceph client connection, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:21.612Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c417b7d2d1c7fdc25af24490201320e36a3cc21d"
},
{
"url": "https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e"
},
{
"url": "https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef"
},
{
"url": "https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc"
},
{
"url": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2"
},
{
"url": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768"
}
],
"title": "libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52956",
"datePublished": "2026-06-24T16:28:38.414Z",
"dateReserved": "2026-06-09T07:44:35.373Z",
"dateUpdated": "2026-10-30T12:26:21.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68401 (GCVE-0-2026-68401)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
Sashiko (locally) reports multiple out-of-bound issues in
ffa_setup_and_transmit:
1) Writing ep_mem_access->reserved can write out of bounds for FFA
versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case
while reserved has an offset of 24.
Instead of zeroing fields, memset the struct to zero first based on
the FFA version.
2) Make sure there is enough size to write constituents.
While at it, convert the only sizeof() in the driver that uses a
type instead of variable.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 22157f74458106c5900dbd938eb44623c22d97a0 Version: 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Version: 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Version: 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Version: 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Version: 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Version: 28ebfb74fbf513e0c7cd2674d8c2400ee0220d18 Version: b77ec23b6df41c48e88735230e11caec56163630 Version: 6.1.31 ≤ Version: 5.15.114 ≤ Version: 6.3.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "500f92f398c717aa515afd23c7a38c0e7f4a1dc9",
"status": "affected",
"version": "22157f74458106c5900dbd938eb44623c22d97a0",
"versionType": "git"
},
{
"lessThan": "d312a71b19bb83803c8d1372bc042bd36db657f7",
"status": "affected",
"version": "111a833dc5cbef3d05b2a796a7e23cb7f6ff2192",
"versionType": "git"
},
{
"lessThan": "00bef9d0f9e787f56ff4699d3b577983ff8b7f24",
"status": "affected",
"version": "111a833dc5cbef3d05b2a796a7e23cb7f6ff2192",
"versionType": "git"
},
{
"lessThan": "cf5708c9d78c98214c62b1e5d049cd527a543b8e",
"status": "affected",
"version": "111a833dc5cbef3d05b2a796a7e23cb7f6ff2192",
"versionType": "git"
},
{
"lessThan": "27abdaf0c5c89b06694e4c3d8318e8d6a60c1d1b",
"status": "affected",
"version": "111a833dc5cbef3d05b2a796a7e23cb7f6ff2192",
"versionType": "git"
},
{
"lessThan": "3383ffb7ef937317361713ffcc21921a7848511a",
"status": "affected",
"version": "111a833dc5cbef3d05b2a796a7e23cb7f6ff2192",
"versionType": "git"
},
{
"status": "affected",
"version": "28ebfb74fbf513e0c7cd2674d8c2400ee0220d18",
"versionType": "git"
},
{
"status": "affected",
"version": "b77ec23b6df41c48e88735230e11caec56163630",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.31",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.114",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_ffa/driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()\n\nSashiko (locally) reports multiple out-of-bound issues in\nffa_setup_and_transmit:\n1) Writing ep_mem_access-\u003ereserved can write out of bounds for FFA\n versions \u003c 1.2 as ffa_emad_size_get() returns 16 bytes in that case\n while reserved has an offset of 24.\n Instead of zeroing fields, memset the struct to zero first based on\n the FFA version.\n\n2) Make sure there is enough size to write constituents.\n\nWhile at it, convert the only sizeof() in the driver that uses a\ntype instead of variable."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The FF-A memory transaction code is reached only from local kernel clients, in practice from userspace via TEE_IOC_SHM_REGISTER/protmem allocation on /dev/tee0 (OP-TEE over FF-A) or /dev/tee_ts0 (Arm TS TEE). There is no network or adjacent-network path to ffa_setup_and_transmit().\nAC:L - The out-of-bound EMAD write occurs deterministically on every memory share/lend whenever the negotiated FF-A version is below 1.2 (the common case, since ffa_emad_size_get() returns 16 while the reserved field sits at offset 24), and the attacker fully controls the registered buffer size and page layout that drive the constituent/fragment loop. No race or unknown state is involved.\nPR:L - An unprivileged local user with access to the TEE device node (typically world- or tee-group-accessible on Android and Arm embedded/automotive systems) can call TEE_IOC_SHM_REGISTER and reach ffa_setup_and_transmit(); no capability check exists along the path.\nUI:N - The attacker triggers the memory-sharing path entirely through its own ioctl calls on the TEE device; no action by another user or administrator is needed.\nS:U - The corruption occurs in the kernel\u0027s own RX/TX descriptor buffer and adjacent kernel memory, all within the kernel\u0027s security authority; no hypervisor, IOMMU, or secure-world boundary is crossed by the overflow itself.\nC:H - The out-of-bounds writes corrupt kernel memory neighbouring the FF-A descriptor buffer (a page allocated with alloc_pages_exact() whose neighbours are arbitrary kernel objects); such heap corruption can be shaped into a read primitive, and it also leaves adjacent kernel data reflected in the descriptor handed to the secure world.\nI:H - This is a kernel out-of-bounds write: 8 zero bytes past each 16-byte EMAD slot, plus a full 16-byte constituent entry containing attacker-influenced physical addresses and page counts written past the end of the TX buffer due to the missing sizeof() in the bound check, giving a controlled heap overwrite usable for privilege escalation.\nA:H - Writing past the descriptor buffer corrupts adjacent kernel allocations and the memory descriptor passed to the secure world, readily causing kernel oops/panic or an aborted secure-world transaction, and the overflow is triggerable repeatedly by an unprivileged user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:28.852Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/500f92f398c717aa515afd23c7a38c0e7f4a1dc9"
},
{
"url": "https://git.kernel.org/stable/c/d312a71b19bb83803c8d1372bc042bd36db657f7"
},
{
"url": "https://git.kernel.org/stable/c/00bef9d0f9e787f56ff4699d3b577983ff8b7f24"
},
{
"url": "https://git.kernel.org/stable/c/cf5708c9d78c98214c62b1e5d049cd527a543b8e"
},
{
"url": "https://git.kernel.org/stable/c/27abdaf0c5c89b06694e4c3d8318e8d6a60c1d1b"
},
{
"url": "https://git.kernel.org/stable/c/3383ffb7ef937317361713ffcc21921a7848511a"
}
],
"title": "firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68401",
"datePublished": "2026-08-10T12:04:21.020Z",
"dateReserved": "2026-07-30T09:28:09.389Z",
"dateUpdated": "2026-10-30T12:28:28.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43053 (GCVE-0-2026-43053)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: close crash window in attr dabtree inactivation
When inactivating an inode with node-format extended attributes,
xfs_attr3_node_inactive() invalidates all child leaf/node blocks via
xfs_trans_binval(), but intentionally does not remove the corresponding
entries from their parent node blocks. The implicit assumption is that
xfs_attr_inactive() will truncate the entire attr fork to zero extents
afterwards, so log recovery will never reach the root node and follow
those stale pointers.
However, if a log shutdown occurs after the leaf/node block cancellations
commit but before the attr bmap truncation commits, this assumption
breaks. Recovery replays the attr bmap intact (the inode still has
attr fork extents), but suppresses replay of all cancelled leaf/node
blocks, maybe leaving them as stale data on disk. On the next mount,
xlog_recover_process_iunlinks() retries inactivation and attempts to
read the root node via the attr bmap. If the root node was not replayed,
reading the unreplayed root block triggers a metadata verification
failure immediately; if it was replayed, following its child pointers
to unreplayed child blocks triggers the same failure:
XFS (pmem0): Metadata corruption detected at
xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78
XFS (pmem0): Unmount and run xfs_repair
XFS (pmem0): First 128 bytes of corrupted metadata buffer:
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117
Fix this in two places:
In xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a
child block, immediately remove the entry that references it from the
parent node in the same transaction. This eliminates the window where
the parent holds a pointer to a cancelled block. Once all children are
removed, the now-empty root node is converted to a leaf block within the
same transaction. This node-to-leaf conversion is necessary for crash
safety. If the system shutdown after the empty node is written to the
log but before the second-phase bmap truncation commits, log recovery
will attempt to verify the root block on disk. xfs_da3_node_verify()
does not permit a node block with count == 0; such a block will fail
verification and trigger a metadata corruption shutdown. on the other
hand, leaf blocks are allowed to have this transient state.
In xfs_attr_inactive(), split the attr fork truncation into two explicit
phases. First, truncate all extents beyond the root block (the child
extents whose parent references have already been removed above).
Second, invalidate the root block and truncate the attr bmap to zero in
a single transaction. The two operations in the second phase must be
atomic: as long as the attr bmap has any non-zero length, recovery can
follow it to the root block, so the root block invalidation must commit
together with the bmap-to-zero truncation.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:27:23.065718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:28.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_attr_inactive.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "190d54d1d42878fce8c735c2d9ac835725694d3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7ea3850b9ce005e70f502b308edb2d99ca074ed3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e5a3e3cdd9b3015ae79456c81beebfdbb5246c0f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_attr_inactive.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: close crash window in attr dabtree inactivation\n\nWhen inactivating an inode with node-format extended attributes,\nxfs_attr3_node_inactive() invalidates all child leaf/node blocks via\nxfs_trans_binval(), but intentionally does not remove the corresponding\nentries from their parent node blocks. The implicit assumption is that\nxfs_attr_inactive() will truncate the entire attr fork to zero extents\nafterwards, so log recovery will never reach the root node and follow\nthose stale pointers.\n\nHowever, if a log shutdown occurs after the leaf/node block cancellations\ncommit but before the attr bmap truncation commits, this assumption\nbreaks. Recovery replays the attr bmap intact (the inode still has\nattr fork extents), but suppresses replay of all cancelled leaf/node\nblocks, maybe leaving them as stale data on disk. On the next mount,\nxlog_recover_process_iunlinks() retries inactivation and attempts to\nread the root node via the attr bmap. If the root node was not replayed,\nreading the unreplayed root block triggers a metadata verification\nfailure immediately; if it was replayed, following its child pointers\nto unreplayed child blocks triggers the same failure:\n\n XFS (pmem0): Metadata corruption detected at\n xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78\n XFS (pmem0): Unmount and run xfs_repair\n XFS (pmem0): First 128 bytes of corrupted metadata buffer:\n 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n XFS (pmem0): metadata I/O error in \"xfs_da_read_buf+0x104/0x190\" at daddr 0x78 len 8 error 117\n\nFix this in two places:\n\nIn xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a\nchild block, immediately remove the entry that references it from the\nparent node in the same transaction. This eliminates the window where\nthe parent holds a pointer to a cancelled block. Once all children are\nremoved, the now-empty root node is converted to a leaf block within the\nsame transaction. This node-to-leaf conversion is necessary for crash\nsafety. If the system shutdown after the empty node is written to the\nlog but before the second-phase bmap truncation commits, log recovery\nwill attempt to verify the root block on disk. xfs_da3_node_verify()\ndoes not permit a node block with count == 0; such a block will fail\nverification and trigger a metadata corruption shutdown. on the other\nhand, leaf blocks are allowed to have this transient state.\n\nIn xfs_attr_inactive(), split the attr fork truncation into two explicit\nphases. First, truncate all extents beyond the root block (the child\nextents whose parent references have already been removed above).\nSecond, invalidate the root block and truncate the attr bmap to zero in\na single transaction. The two operations in the second phase must be\natomic: as long as the attr bmap has any non-zero length, recovery can\nfollow it to the root block, so the root block invalidation must commit\ntogether with the bmap-to-zero truncation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:58.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/190d54d1d42878fce8c735c2d9ac835725694d3a"
},
{
"url": "https://git.kernel.org/stable/c/7ea3850b9ce005e70f502b308edb2d99ca074ed3"
},
{
"url": "https://git.kernel.org/stable/c/e5a3e3cdd9b3015ae79456c81beebfdbb5246c0f"
},
{
"url": "https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"
}
],
"title": "xfs: close crash window in attr dabtree inactivation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43053",
"datePublished": "2026-05-01T14:15:46.709Z",
"dateReserved": "2026-05-01T14:12:55.980Z",
"dateUpdated": "2026-11-06T15:32:28.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53330 (GCVE-0-2026-53330)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
[Why & How]
The aux_rd_interval array in struct dc_lttpr_caps is declared with
MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset
parameter passed to dp_get_eq_aux_rd_interval() can be as large as
MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD.
This leads to an out-of-bounds read of aux_rd_interval[7] when offset
is 8.
Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to
accommodate the full range of valid repeater counts defined by the DP
spec.
(cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8e5100a575433cc185a2e224280fbd873b6692dd Version: 8e5100a575433cc185a2e224280fbd873b6692dd Version: 8e5100a575433cc185a2e224280fbd873b6692dd Version: 8e5100a575433cc185a2e224280fbd873b6692dd Version: 8e5100a575433cc185a2e224280fbd873b6692dd Version: 8e5100a575433cc185a2e224280fbd873b6692dd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dc_dp_types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b310c6d82d782282085c9728dfe69e07d185b6c",
"status": "affected",
"version": "8e5100a575433cc185a2e224280fbd873b6692dd",
"versionType": "git"
},
{
"lessThan": "a632474c793b7f2a9bbd3d8e3d0dd7d256989300",
"status": "affected",
"version": "8e5100a575433cc185a2e224280fbd873b6692dd",
"versionType": "git"
},
{
"lessThan": "7c5f2d16a8f4464bf2a719ceb2316b8a6b87a3c0",
"status": "affected",
"version": "8e5100a575433cc185a2e224280fbd873b6692dd",
"versionType": "git"
},
{
"lessThan": "454d3b3d499c18373f8960d31aea48338a3ca9e0",
"status": "affected",
"version": "8e5100a575433cc185a2e224280fbd873b6692dd",
"versionType": "git"
},
{
"lessThan": "dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3e",
"status": "affected",
"version": "8e5100a575433cc185a2e224280fbd873b6692dd",
"versionType": "git"
},
{
"lessThan": "e8b4d37eba05141ee01794fc6b7f2da808cee83b",
"status": "affected",
"version": "8e5100a575433cc185a2e224280fbd873b6692dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dc_dp_types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()\n\n[Why \u0026 How]\nThe aux_rd_interval array in struct dc_lttpr_caps is declared with\nMAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset\nparameter passed to dp_get_eq_aux_rd_interval() can be as large as\nMAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD.\nThis leads to an out-of-bounds read of aux_rd_interval[7] when offset\nis 8.\n\nFix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to\naccommodate the full range of valid repeater counts defined by the DP\nspec.\n\n(cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:59.997Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b310c6d82d782282085c9728dfe69e07d185b6c"
},
{
"url": "https://git.kernel.org/stable/c/a632474c793b7f2a9bbd3d8e3d0dd7d256989300"
},
{
"url": "https://git.kernel.org/stable/c/7c5f2d16a8f4464bf2a719ceb2316b8a6b87a3c0"
},
{
"url": "https://git.kernel.org/stable/c/454d3b3d499c18373f8960d31aea48338a3ca9e0"
},
{
"url": "https://git.kernel.org/stable/c/dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3e"
},
{
"url": "https://git.kernel.org/stable/c/e8b4d37eba05141ee01794fc6b7f2da808cee83b"
}
],
"title": "drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53330",
"datePublished": "2026-07-01T13:32:15.160Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-10-30T12:26:59.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46130 (GCVE-0-2026-46130)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-verity-fec: fix reading parity bytes split across blocks (take 3)
fec_decode_bufs() assumes that the parity bytes of the first RS codeword
it decodes are never split across parity blocks.
This assumption is false. Consider v->fec->block_size == 4096 &&
v->fec->roots == 17 && fio->nbufs == 1, for example. In that case, each
call to fec_decode_bufs() consumes v->fec->roots * (fio->nbufs <<
DM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.
Considering that the parity data for each message block starts on a
block boundary, the byte alignment in the parity data will iterate
through 272*i mod 4096 until the 3 parity blocks have been consumed. On
the 16th call (i=15), the alignment will be 4080 bytes into the first
block. Only 16 bytes remain in that block, but 17 parity bytes will be
needed. The code reads out-of-bounds from the parity block buffer.
Fortunately this doesn't normally happen, since it can occur only for
certain non-default values of fec_roots *and* when the maximum number of
buffers couldn't be allocated due to low memory. For example with
block_size=4096 only the following cases are affected:
fec_roots=17: nbufs in [1, 3, 5, 15]
fec_roots=19: nbufs in [1, 229]
fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195]
fec_roots=23: nbufs in [1, 89]
Regardless, fix it by refactoring how the parity blocks are read.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 12caa73a28f0ae147ec0356b45091edf2462462b Version: fc8943886629e26de34867db302c74d465510826 Version: 6df90c02bae468a3a6110bafbc659884d0c4966c Version: 6df90c02bae468a3a6110bafbc659884d0c4966c Version: 6df90c02bae468a3a6110bafbc659884d0c4966c Version: 6bc6ee31113b05db605694491bdeb2b1730142f1 Version: 6.6.72 ≤ Version: 6.12.10 ≤ Version: 6.1.125 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46130",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:09:22.162738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:39.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "03348b440f69417dc3a3c71d8271cff6b05f67fb",
"status": "affected",
"version": "12caa73a28f0ae147ec0356b45091edf2462462b",
"versionType": "git"
},
{
"lessThan": "dac69d1b76049d7e5f565089a6a7f4502a85b9de",
"status": "affected",
"version": "fc8943886629e26de34867db302c74d465510826",
"versionType": "git"
},
{
"lessThan": "d47281b9a4472cfd73122393e79fbe76b651e46a",
"status": "affected",
"version": "6df90c02bae468a3a6110bafbc659884d0c4966c",
"versionType": "git"
},
{
"lessThan": "3d1b4e2d8ac0a1a1390a117f61ce0ca1c47e3bcb",
"status": "affected",
"version": "6df90c02bae468a3a6110bafbc659884d0c4966c",
"versionType": "git"
},
{
"lessThan": "430a05cb926f6bdf53e81460a2c3a553257f3f61",
"status": "affected",
"version": "6df90c02bae468a3a6110bafbc659884d0c4966c",
"versionType": "git"
},
{
"status": "affected",
"version": "6bc6ee31113b05db605694491bdeb2b1730142f1",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.72",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.10",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.125",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.125",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity-fec: fix reading parity bytes split across blocks (take 3)\n\nfec_decode_bufs() assumes that the parity bytes of the first RS codeword\nit decodes are never split across parity blocks.\n\nThis assumption is false. Consider v-\u003efec-\u003eblock_size == 4096 \u0026\u0026\nv-\u003efec-\u003eroots == 17 \u0026\u0026 fio-\u003enbufs == 1, for example. In that case, each\ncall to fec_decode_bufs() consumes v-\u003efec-\u003eroots * (fio-\u003enbufs \u003c\u003c\nDM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes.\n\nConsidering that the parity data for each message block starts on a\nblock boundary, the byte alignment in the parity data will iterate\nthrough 272*i mod 4096 until the 3 parity blocks have been consumed. On\nthe 16th call (i=15), the alignment will be 4080 bytes into the first\nblock. Only 16 bytes remain in that block, but 17 parity bytes will be\nneeded. The code reads out-of-bounds from the parity block buffer.\n\nFortunately this doesn\u0027t normally happen, since it can occur only for\ncertain non-default values of fec_roots *and* when the maximum number of\nbuffers couldn\u0027t be allocated due to low memory. For example with\nblock_size=4096 only the following cases are affected:\n\n fec_roots=17: nbufs in [1, 3, 5, 15]\n fec_roots=19: nbufs in [1, 229]\n fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195]\n fec_roots=23: nbufs in [1, 89]\n\nRegardless, fix it by refactoring how the parity blocks are read."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:19.483Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/03348b440f69417dc3a3c71d8271cff6b05f67fb"
},
{
"url": "https://git.kernel.org/stable/c/dac69d1b76049d7e5f565089a6a7f4502a85b9de"
},
{
"url": "https://git.kernel.org/stable/c/d47281b9a4472cfd73122393e79fbe76b651e46a"
},
{
"url": "https://git.kernel.org/stable/c/3d1b4e2d8ac0a1a1390a117f61ce0ca1c47e3bcb"
},
{
"url": "https://git.kernel.org/stable/c/430a05cb926f6bdf53e81460a2c3a553257f3f61"
}
],
"title": "dm-verity-fec: fix reading parity bytes split across blocks (take 3)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46130",
"datePublished": "2026-05-28T09:35:45.387Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-11-06T16:13:39.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98033 (GCVE-0-2026-98033)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve inner map identity in callback frames
Callback frame constructors initialize map-typed argument registers with
__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,
which is the only field distinguishing inner maps that share an
inner_map_meta template.
When a timer callback invokes bpf_for_each_map_elem() on a second inner
map, both the saved first map and the second map value can reach the nested
callback as the same template with map_uid zero. bpf_timer_init() then
accepts pairing the timer from the second map with the first map.
The runtime records the first map in the timer without taking a reference.
Freeing that map does not find the timer stored in the second map, so a
later timer callback dereferences the freed map.
Copy map_uid from the same caller register as map_ptr when constructing
for-each, timer/workqueue, and task-work callback arguments. The existing
identity check can then reject mismatched inner maps while allowing a
callback value to be paired with its actual map.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf85e4f94d7feef8b3c4c90dbe2468595a48393b",
"status": "affected",
"version": "69c087ba6225b574afb6e505b72cb75242a3d844",
"versionType": "git"
},
{
"lessThan": "166221c52d3ca332f8699a854efca8e2704bb137",
"status": "affected",
"version": "69c087ba6225b574afb6e505b72cb75242a3d844",
"versionType": "git"
},
{
"lessThan": "08b534bafdd9de65b6374474a8fe719c90eb3b01",
"status": "affected",
"version": "69c087ba6225b574afb6e505b72cb75242a3d844",
"versionType": "git"
},
{
"lessThan": "66ff2eff093d2a0838f39c713eeb590bc0946c2a",
"status": "affected",
"version": "69c087ba6225b574afb6e505b72cb75242a3d844",
"versionType": "git"
},
{
"lessThan": "b90c5d770dad910fb89e6c1b15052a8a1e8db752",
"status": "affected",
"version": "69c087ba6225b574afb6e505b72cb75242a3d844",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve inner map identity in callback frames\n\nCallback frame constructors initialize map-typed argument registers with\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,\nwhich is the only field distinguishing inner maps that share an\ninner_map_meta template.\n\nWhen a timer callback invokes bpf_for_each_map_elem() on a second inner\nmap, both the saved first map and the second map value can reach the nested\ncallback as the same template with map_uid zero. bpf_timer_init() then\naccepts pairing the timer from the second map with the first map.\n\nThe runtime records the first map in the timer without taking a reference.\nFreeing that map does not find the timer stored in the second map, so a\nlater timer callback dereferences the freed map.\n\nCopy map_uid from the same caller register as map_ptr when constructing\nfor-each, timer/workqueue, and task-work callback arguments. The existing\nidentity check can then reject mismatched inner maps while allowing a\ncallback value to be paired with its actual map."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:07.398Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf85e4f94d7feef8b3c4c90dbe2468595a48393b"
},
{
"url": "https://git.kernel.org/stable/c/166221c52d3ca332f8699a854efca8e2704bb137"
},
{
"url": "https://git.kernel.org/stable/c/08b534bafdd9de65b6374474a8fe719c90eb3b01"
},
{
"url": "https://git.kernel.org/stable/c/66ff2eff093d2a0838f39c713eeb590bc0946c2a"
},
{
"url": "https://git.kernel.org/stable/c/b90c5d770dad910fb89e6c1b15052a8a1e8db752"
}
],
"title": "bpf: Preserve inner map identity in callback frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98033",
"datePublished": "2026-09-25T10:23:48.761Z",
"dateReserved": "2026-09-25T10:19:56.070Z",
"dateUpdated": "2026-10-21T12:54:07.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38042 (GCVE-0-2025-38042)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2026-10-30 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
The user of k3_udma_glue_reset_rx_chn() e.g. ti_am65_cpsw_nuss can
run on multiple platforms having different DMA architectures.
On some platforms there can be one FDQ for all flows in the RX channel
while for others there is a separate FDQ for each flow in the RX channel.
So far we have been relying on the skip_fdq argument of
k3_udma_glue_reset_rx_chn().
Instead of relying on the user to provide this information, infer it
based on DMA architecture during k3_udma_glue_request_rx_chn() and save it
in an internal flag 'single_fdq'. Use that flag at
k3_udma_glue_reset_rx_chn() to deicide if the FDQ needs
to be cleared for every flow or just for flow 0.
Fixes the below issue on ti_am65_cpsw_nuss driver on AM62-SK.
> ip link set eth1 down
> ip link set eth0 down
> ethtool -L eth0 rx 8
> ip link set eth0 up
> modprobe -r ti_am65_cpsw_nuss
[ 103.045726] ------------[ cut here ]------------
[ 103.050505] k3_knav_desc_pool size 512000 != avail 64000
[ 103.050703] WARNING: CPU: 1 PID: 450 at drivers/net/ethernet/ti/k3-cppi-desc-pool.c:33 k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool]
[ 103.068810] Modules linked in: ti_am65_cpsw_nuss(-) k3_cppi_desc_pool snd_soc_hdmi_codec crct10dif_ce snd_soc_simple_card snd_soc_simple_card_utils display_connector rtc_ti_k3 k3_j72xx_bandgap tidss drm_client_lib snd_soc_davinci_mcas
p drm_dma_helper tps6598x phylink snd_soc_ti_udma rti_wdt drm_display_helper snd_soc_tlv320aic3x_i2c typec at24 phy_gmii_sel snd_soc_ti_edma snd_soc_tlv320aic3x sii902x snd_soc_ti_sdma sa2ul omap_mailbox drm_kms_helper authenc cfg80211 r
fkill fuse drm drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [last unloaded: k3_cppi_desc_pool]
[ 103.119950] CPU: 1 UID: 0 PID: 450 Comm: modprobe Not tainted 6.13.0-rc7-00001-g9c5e3435fa66 #1011
[ 103.119968] Hardware name: Texas Instruments AM625 SK (DT)
[ 103.119974] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 103.119983] pc : k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool]
[ 103.148007] lr : k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool]
[ 103.154709] sp : ffff8000826ebbc0
[ 103.158015] x29: ffff8000826ebbc0 x28: ffff0000090b6300 x27: 0000000000000000
[ 103.165145] x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000019df6b0
[ 103.172271] x23: ffff0000019df6b8 x22: ffff0000019df410 x21: ffff8000826ebc88
[ 103.179397] x20: 000000000007d000 x19: ffff00000a3b3000 x18: 0000000000000000
[ 103.186522] x17: 0000000000000000 x16: 0000000000000000 x15: 000001e8c35e1cde
[ 103.193647] x14: 0000000000000396 x13: 000000000000035c x12: 0000000000000000
[ 103.200772] x11: 000000000000003a x10: 00000000000009c0 x9 : ffff8000826eba20
[ 103.207897] x8 : ffff0000090b6d20 x7 : ffff00007728c180 x6 : ffff00007728c100
[ 103.215022] x5 : 0000000000000001 x4 : ffff000000508a50 x3 : ffff7ffff6146000
[ 103.222147] x2 : 0000000000000000 x1 : e300b4173ee6b200 x0 : 0000000000000000
[ 103.229274] Call trace:
[ 103.231714] k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool] (P)
[ 103.238408] am65_cpsw_nuss_free_rx_chns+0x28/0x4c [ti_am65_cpsw_nuss]
[ 103.244942] devm_action_release+0x14/0x20
[ 103.249040] release_nodes+0x3c/0x68
[ 103.252610] devres_release_all+0x8c/0xdc
[ 103.256614] device_unbind_cleanup+0x18/0x60
[ 103.260876] device_release_driver_internal+0xf8/0x178
[ 103.266004] driver_detach+0x50/0x9c
[ 103.269571] bus_remove_driver+0x6c/0xbc
[ 103.273485] driver_unregister+0x30/0x60
[ 103.277401] platform_driver_unregister+0x14/0x20
[ 103.282096] am65_cpsw_nuss_driver_exit+0x18/0xff4 [ti_am65_cpsw_nuss]
[ 103.288620] __arm64_sys_delete_module+0x17c/0x25c
[ 103.293404] invoke_syscall+0x44/0x100
[ 103.297149] el0_svc_common.constprop.0+0xc0/0xe0
[ 103.301845] do_el0_svc+0x1c/0x28
[ 103.305155] el0_svc+0x28/0x98
---truncated---
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/ti/k3-udma-glue.c",
"drivers/net/ethernet/ti/am65-cpsw-nuss.c",
"drivers/net/ethernet/ti/icssg/icssg_common.c",
"include/linux/dma/k3-udma-glue.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "575c1b6c5574196071cd8ee672e87641ef15778f",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "40d66e0adde4b8ec2fad01f847072af792aeccea",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "929995c980da57beeb415744c7c271a9fde80fa9",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "d0dd9d133ef8fdc894e0be9aa27dc49ef5f813cb",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "0da30874729baeb01889b0eca16cfda122687503",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/ti/k3-udma-glue.c",
"drivers/net/ethernet/ti/am65-cpsw-nuss.c",
"drivers/net/ethernet/ti/icssg/icssg_common.c",
"include/linux/dma/k3-udma-glue.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.9",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn\n\nThe user of k3_udma_glue_reset_rx_chn() e.g. ti_am65_cpsw_nuss can\nrun on multiple platforms having different DMA architectures.\nOn some platforms there can be one FDQ for all flows in the RX channel\nwhile for others there is a separate FDQ for each flow in the RX channel.\n\nSo far we have been relying on the skip_fdq argument of\nk3_udma_glue_reset_rx_chn().\n\nInstead of relying on the user to provide this information, infer it\nbased on DMA architecture during k3_udma_glue_request_rx_chn() and save it\nin an internal flag \u0027single_fdq\u0027. Use that flag at\nk3_udma_glue_reset_rx_chn() to deicide if the FDQ needs\nto be cleared for every flow or just for flow 0.\n\nFixes the below issue on ti_am65_cpsw_nuss driver on AM62-SK.\n\n\u003e ip link set eth1 down\n\u003e ip link set eth0 down\n\u003e ethtool -L eth0 rx 8\n\u003e ip link set eth0 up\n\u003e modprobe -r ti_am65_cpsw_nuss\n\n[ 103.045726] ------------[ cut here ]------------\n[ 103.050505] k3_knav_desc_pool size 512000 != avail 64000\n[ 103.050703] WARNING: CPU: 1 PID: 450 at drivers/net/ethernet/ti/k3-cppi-desc-pool.c:33 k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool]\n[ 103.068810] Modules linked in: ti_am65_cpsw_nuss(-) k3_cppi_desc_pool snd_soc_hdmi_codec crct10dif_ce snd_soc_simple_card snd_soc_simple_card_utils display_connector rtc_ti_k3 k3_j72xx_bandgap tidss drm_client_lib snd_soc_davinci_mcas\np drm_dma_helper tps6598x phylink snd_soc_ti_udma rti_wdt drm_display_helper snd_soc_tlv320aic3x_i2c typec at24 phy_gmii_sel snd_soc_ti_edma snd_soc_tlv320aic3x sii902x snd_soc_ti_sdma sa2ul omap_mailbox drm_kms_helper authenc cfg80211 r\nfkill fuse drm drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [last unloaded: k3_cppi_desc_pool]\n[ 103.119950] CPU: 1 UID: 0 PID: 450 Comm: modprobe Not tainted 6.13.0-rc7-00001-g9c5e3435fa66 #1011\n[ 103.119968] Hardware name: Texas Instruments AM625 SK (DT)\n[ 103.119974] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 103.119983] pc : k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool]\n[ 103.148007] lr : k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool]\n[ 103.154709] sp : ffff8000826ebbc0\n[ 103.158015] x29: ffff8000826ebbc0 x28: ffff0000090b6300 x27: 0000000000000000\n[ 103.165145] x26: 0000000000000000 x25: 0000000000000000 x24: ffff0000019df6b0\n[ 103.172271] x23: ffff0000019df6b8 x22: ffff0000019df410 x21: ffff8000826ebc88\n[ 103.179397] x20: 000000000007d000 x19: ffff00000a3b3000 x18: 0000000000000000\n[ 103.186522] x17: 0000000000000000 x16: 0000000000000000 x15: 000001e8c35e1cde\n[ 103.193647] x14: 0000000000000396 x13: 000000000000035c x12: 0000000000000000\n[ 103.200772] x11: 000000000000003a x10: 00000000000009c0 x9 : ffff8000826eba20\n[ 103.207897] x8 : ffff0000090b6d20 x7 : ffff00007728c180 x6 : ffff00007728c100\n[ 103.215022] x5 : 0000000000000001 x4 : ffff000000508a50 x3 : ffff7ffff6146000\n[ 103.222147] x2 : 0000000000000000 x1 : e300b4173ee6b200 x0 : 0000000000000000\n[ 103.229274] Call trace:\n[ 103.231714] k3_cppi_desc_pool_destroy+0xa0/0xa8 [k3_cppi_desc_pool] (P)\n[ 103.238408] am65_cpsw_nuss_free_rx_chns+0x28/0x4c [ti_am65_cpsw_nuss]\n[ 103.244942] devm_action_release+0x14/0x20\n[ 103.249040] release_nodes+0x3c/0x68\n[ 103.252610] devres_release_all+0x8c/0xdc\n[ 103.256614] device_unbind_cleanup+0x18/0x60\n[ 103.260876] device_release_driver_internal+0xf8/0x178\n[ 103.266004] driver_detach+0x50/0x9c\n[ 103.269571] bus_remove_driver+0x6c/0xbc\n[ 103.273485] driver_unregister+0x30/0x60\n[ 103.277401] platform_driver_unregister+0x14/0x20\n[ 103.282096] am65_cpsw_nuss_driver_exit+0x18/0xff4 [ti_am65_cpsw_nuss]\n[ 103.288620] __arm64_sys_delete_module+0x17c/0x25c\n[ 103.293404] invoke_syscall+0x44/0x100\n[ 103.297149] el0_svc_common.constprop.0+0xc0/0xe0\n[ 103.301845] do_el0_svc+0x1c/0x28\n[ 103.305155] el0_svc+0x28/0x98\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:21:34.927Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/575c1b6c5574196071cd8ee672e87641ef15778f"
},
{
"url": "https://git.kernel.org/stable/c/40d66e0adde4b8ec2fad01f847072af792aeccea"
},
{
"url": "https://git.kernel.org/stable/c/929995c980da57beeb415744c7c271a9fde80fa9"
},
{
"url": "https://git.kernel.org/stable/c/d0dd9d133ef8fdc894e0be9aa27dc49ef5f813cb"
},
{
"url": "https://git.kernel.org/stable/c/0da30874729baeb01889b0eca16cfda122687503"
}
],
"title": "dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38042",
"datePublished": "2025-06-18T09:33:27.214Z",
"dateReserved": "2025-04-16T04:51:23.978Z",
"dateUpdated": "2026-10-30T12:21:34.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53009 (GCVE-0-2026-53009)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb
If ice_tso() or ice_tx_csum() fail, the error path in
ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points
to it and is marked as valid (ICE_TX_BUF_SKB).
'next_to_use' remains unchanged, so the potential problem will
likely fix itself when the next packet is transmitted and the tx_buf
gets overwritten. But if there is no next packet and the interface is
brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf()
will find the tx_buf and free the skb for the second time.
The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error
path, so that ice_unmap_and_free_tx_buf().
Move the initialization of 'first' up, to ensure it's already valid in
case we hit the linearization error path.
The bug was spotted by AI while I had it looking for something else.
It also proposed an initial version of the patch.
I reproduced the bug and tested the fix by adding code to inject
failures, on a build with KASAN.
I looked for similar bugs in related Intel drivers and did not find any.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d76a60ba7afb89523c88cf2ed3a044ce4180289e Version: d76a60ba7afb89523c88cf2ed3a044ce4180289e Version: d76a60ba7afb89523c88cf2ed3a044ce4180289e Version: d76a60ba7afb89523c88cf2ed3a044ce4180289e Version: d76a60ba7afb89523c88cf2ed3a044ce4180289e Version: d76a60ba7afb89523c88cf2ed3a044ce4180289e |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.37.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.155.1.rt7.496.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.155.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s ice network driver. An error in the driver\u0027s handling of network packet transmission, specifically when ice_tso() or ice_tx_csum() functions fail, can lead to a double-free of a network buffer (skb). This occurs because a transmit buffer (tx_buf) may still point to an already freed buffer. If the network interface is subsequently brought down, this double-free can be triggered, potentially leading to a system crash or denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:05:00.966Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53009"
},
{
"name": "RHBZ#2492390",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492390"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53009.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42919"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65711"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54247"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:65712: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:54246: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:65711: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:54247: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ice: fix double-free of tx_buf skb",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module ice from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:39.029257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:13.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aa30e355ee951e804cbc9ff3d5de429ec850eccb",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
},
{
"lessThan": "359906450690a1d70545220bde82ba74f3fd80f8",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
},
{
"lessThan": "eb6cf492ae991e40e1e5b2d3f32ec06e9cc678db",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
},
{
"lessThan": "910e498613d5bf4cbe5f298c2613666c38679fab",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
},
{
"lessThan": "4c08fc2119ef0281cfa2cee007acf0a251be55f2",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
},
{
"lessThan": "1a303baa715e6b78d6a406aaf335f87ff35acfcd",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double-free of tx_buf skb\n\nIf ice_tso() or ice_tx_csum() fail, the error path in\nice_xmit_frame_ring() frees the skb, but the \u0027first\u0027 tx_buf still points\nto it and is marked as valid (ICE_TX_BUF_SKB).\n\u0027next_to_use\u0027 remains unchanged, so the potential problem will\nlikely fix itself when the next packet is transmitted and the tx_buf\ngets overwritten. But if there is no next packet and the interface is\nbrought down instead, ice_clean_tx_ring() -\u003e ice_unmap_and_free_tx_buf()\nwill find the tx_buf and free the skb for the second time.\n\nThe fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error\npath, so that ice_unmap_and_free_tx_buf().\nMove the initialization of \u0027first\u0027 up, to ensure it\u0027s already valid in\ncase we hit the linearization error path.\n\nThe bug was spotted by AI while I had it looking for something else.\nIt also proposed an initial version of the patch.\n\nI reproduced the bug and tested the fix by adding code to inject\nfailures, on a build with KASAN.\n\nI looked for similar bugs in related Intel drivers and did not find any."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is in the ice driver\u0027s local transmit path reached through socket/netdev transmission, not by parsing received network packets directly. A remote peer may induce ordinary replies, but the malformed/offload-error SKB state needed for this bug is locally generated.\nAC:L - There is no race; once an attacker can create an SKB that makes ice_tso() or ice_tx_csum() fail, the stale tx_buf state is deterministic. In a controlled netdev namespace or delegated ice/SF deployment, the attacker can also quiesce/bring down the interface before the next packet overwrites the slot.\nPR:L - The strongest reasonable path requires local ability to generate crafted/offloaded transmit SKBs and control the affected netdev lifecycle, which can be namespace-level CAP_NET_ADMIN over a delegated ice netdev rather than host init-namespace root. It is therefore more than unauthenticated remote access but not necessarily high host administrator privilege.\nUI:N - No victim user action is required in the attacker-controlled local scenario; the attacker can send the triggering packet and then cause cleanup. The bug is completed by driver cleanup, not by a separate user opening or mounting content.\nS:U - The corruption occurs within the host kernel/driver memory management context and affects the same security authority. This is not a KVM guest-to-host, IOMMU, or separate-scope boundary bypass.\nC:H - This is a double-free of an skb pointer retained in the TX ring, a heap memory corruption condition equivalent to a use-after-free primitive. Such corruption can plausibly be shaped into kernel memory disclosure.\nI:H - A double-free of a kernel heap object can corrupt allocator metadata or a reallocated object and can plausibly be leveraged for arbitrary write or control-flow impact. Under the required conservative scoring rule, this warrants high integrity impact.\nA:H - Even without full exploitation, the second dev_kfree_skb_any() on an already freed skb can trigger allocator/KASAN/slab corruption detection or a kernel crash. Repeated triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:26.927Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aa30e355ee951e804cbc9ff3d5de429ec850eccb"
},
{
"url": "https://git.kernel.org/stable/c/359906450690a1d70545220bde82ba74f3fd80f8"
},
{
"url": "https://git.kernel.org/stable/c/eb6cf492ae991e40e1e5b2d3f32ec06e9cc678db"
},
{
"url": "https://git.kernel.org/stable/c/910e498613d5bf4cbe5f298c2613666c38679fab"
},
{
"url": "https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2"
},
{
"url": "https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd"
}
],
"title": "ice: fix double-free of tx_buf skb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53009",
"datePublished": "2026-06-24T16:29:20.332Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-10-30T12:26:26.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97988 (GCVE-0-2026-97988)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost: invalidate vring access on IOTLB transitions
When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB
metadata are interpreted in a different address space. Keeping them
across the transition can leave stale ring mappings in use.
Clearing d->iotlb before taking the VQ locks also lets a worker observe
a transient NULL d->iotlb and fall back to d->umem while translating a
descriptor.
Add a common vhost_clear_device_iotlb() helper for vhost-net and
vhost-vsock. Take all VQ mutexes in index order before dropping the
device-wide IOTLB, invalidate each VQ's cached ring access and metadata,
clear pending IOTLB messages, and free the old table after the handoff.
This serializes the transition with workers and prevents mixed address
space mappings.
On the first direct-to-IOTLB transition, invalidate the cached vring
addresses. When an existing device IOTLB is replaced, preserve the
GIOVA ring addresses and reset only the metadata cache. After clearing
ACCESS_PLATFORM, userspace must configure the vring addresses for the
new address mode.
vhost_vq_invalidate_access() clears desc, avail, and used together.
Treat the VQ as invalidated only when all three are NULL, since a single
GIOVA address may legitimately be zero.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vhost/net.c",
"drivers/vhost/vhost.c",
"drivers/vhost/vhost.h",
"drivers/vhost/vsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "021bf73731f7aa94540a549cf850db5968019960",
"status": "affected",
"version": "6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c",
"versionType": "git"
},
{
"lessThan": "e8fe13c14d57cc7c6bd69c72c5fabaaf0d918f98",
"status": "affected",
"version": "6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c",
"versionType": "git"
},
{
"lessThan": "7f8ee0b8f632441aec456a7c147fb43f5c73542d",
"status": "affected",
"version": "6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c",
"versionType": "git"
},
{
"lessThan": "4a454af8e56c1596ada1421ae5eba90c8896c7c7",
"status": "affected",
"version": "6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c",
"versionType": "git"
},
{
"lessThan": "e4f4761879a230aa59e569102a6ab9851847d833",
"status": "affected",
"version": "6b1e6cc7855b09a0a9bfa1d9f30172ba366f161c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vhost/net.c",
"drivers/vhost/vhost.c",
"drivers/vhost/vhost.h",
"drivers/vhost/vsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: invalidate vring access on IOTLB transitions\n\nWhen VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB\nmetadata are interpreted in a different address space. Keeping them\nacross the transition can leave stale ring mappings in use.\n\nClearing d-\u003eiotlb before taking the VQ locks also lets a worker observe\na transient NULL d-\u003eiotlb and fall back to d-\u003eumem while translating a\ndescriptor.\n\nAdd a common vhost_clear_device_iotlb() helper for vhost-net and\nvhost-vsock. Take all VQ mutexes in index order before dropping the\ndevice-wide IOTLB, invalidate each VQ\u0027s cached ring access and metadata,\nclear pending IOTLB messages, and free the old table after the handoff.\nThis serializes the transition with workers and prevents mixed address\nspace mappings.\n\nOn the first direct-to-IOTLB transition, invalidate the cached vring\naddresses. When an existing device IOTLB is replaced, preserve the\nGIOVA ring addresses and reset only the metadata cache. After clearing\nACCESS_PLATFORM, userspace must configure the vring addresses for the\nnew address mode.\n\nvhost_vq_invalidate_access() clears desc, avail, and used together.\nTreat the VQ as invalidated only when all three are NULL, since a single\nGIOVA address may legitimately be zero."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:58.662Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/021bf73731f7aa94540a549cf850db5968019960"
},
{
"url": "https://git.kernel.org/stable/c/e8fe13c14d57cc7c6bd69c72c5fabaaf0d918f98"
},
{
"url": "https://git.kernel.org/stable/c/7f8ee0b8f632441aec456a7c147fb43f5c73542d"
},
{
"url": "https://git.kernel.org/stable/c/4a454af8e56c1596ada1421ae5eba90c8896c7c7"
},
{
"url": "https://git.kernel.org/stable/c/e4f4761879a230aa59e569102a6ab9851847d833"
}
],
"title": "vhost: invalidate vring access on IOTLB transitions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97988",
"datePublished": "2026-09-25T10:23:21.998Z",
"dateReserved": "2026-09-25T10:18:58.209Z",
"dateUpdated": "2026-10-21T12:53:58.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23259 (GCVE-0-2026-23259)
Vulnerability from cvelistv5
Published
2026-03-18 17:41
Modified
2026-11-05 21:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/rw: free potentially allocated iovec on cache put failure
If a read/write request goes through io_req_rw_cleanup() and has an
allocated iovec attached and fails to put to the rw_cache, then it may
end up with an unaccounted iovec pointer. Have io_rw_recycle() return
whether it recycled the request or not, and use that to gauge whether to
free a potential iovec or not.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:24:08.498519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:33:34.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41cda4c66846c3bfcdeaf28444ccabbb55e64cf1",
"status": "affected",
"version": "a9165b83c1937eeed1f0c731468216d6371d647f",
"versionType": "git"
},
{
"lessThan": "1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c",
"status": "affected",
"version": "a9165b83c1937eeed1f0c731468216d6371d647f",
"versionType": "git"
},
{
"lessThan": "4b9748055457ac3a0710bf210c229d01ea1b01b9",
"status": "affected",
"version": "a9165b83c1937eeed1f0c731468216d6371d647f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: free potentially allocated iovec on cache put failure\n\nIf a read/write request goes through io_req_rw_cleanup() and has an\nallocated iovec attached and fails to put to the rw_cache, then it may\nend up with an unaccounted iovec pointer. Have io_rw_recycle() return\nwhether it recycled the request or not, and use that to gauge whether to\nfree a potential iovec or not."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:03.826Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41cda4c66846c3bfcdeaf28444ccabbb55e64cf1"
},
{
"url": "https://git.kernel.org/stable/c/1d5f2329ab4df65c2ee011b986d8a6e05ad0f67c"
},
{
"url": "https://git.kernel.org/stable/c/4b9748055457ac3a0710bf210c229d01ea1b01b9"
}
],
"title": "io_uring/rw: free potentially allocated iovec on cache put failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23259",
"datePublished": "2026-03-18T17:41:05.827Z",
"dateReserved": "2026-01-13T15:37:45.990Z",
"dateUpdated": "2026-11-05T21:33:34.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68471 (GCVE-0-2026-68471)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ieee80211: validate MLE common info length
ieee80211_mle_common_size() uses the first common-info octet as the
common information length for all known MLE types. However,
ieee80211_mle_size_ok() only validates that octet for Basic, Probe
Request, and TDLS MLEs.
Reconfiguration MLEs also skipped the length octet when calculating the
minimum common size, and Priority Access MLEs skipped validation of the
advertised common information length.
Account for the Reconfiguration common-info length octet and validate
the advertised common information length for all known MLE types. Keep
unknown-type handling unchanged.
[remove now misleading comment]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 Version: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 Version: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 Version: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 Version: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 Version: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/ieee80211-eht.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bba41664af19b8a07d3d728855088ae80e47a4b3",
"status": "affected",
"version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
"versionType": "git"
},
{
"lessThan": "181b46e76a218e9345ed7c4cf59dfa69278e4a06",
"status": "affected",
"version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
"versionType": "git"
},
{
"lessThan": "22941b5c5c46e61a7053e5f32f260f2bc39da617",
"status": "affected",
"version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
"versionType": "git"
},
{
"lessThan": "90576bd6921a91eb038bffbb4b9467c2dc26aa1d",
"status": "affected",
"version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
"versionType": "git"
},
{
"lessThan": "2b1589fd9a076727a73bfb39e96622a76415ad32",
"status": "affected",
"version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
"versionType": "git"
},
{
"lessThan": "293baeae9b2434a3e432629d7720b5603db2d77e",
"status": "affected",
"version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/ieee80211-eht.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Reachable by transmitting crafted 802.11 management frames (probe responses, beacons, protected EHT action frames) over WiFi; the mac80211/cfg80211 stack parses Multi-Link Elements on receive without requiring local access.\nAC:L - An adjacent attacker fully controls the MLE common-info length octet in forged frames and can reliably pass ieee80211_mle_size_ok() with an inflated value, triggering deterministic out-of-bounds parsing during routine scan or beacon processing.\nPR:N - No local privileges or association are required; a rogue AP or frame injector can deliver malicious MLEs to any scanning or MLD-associated station via standard pre-authentication WiFi management traffic.\nUI:N - Exploitation requires only passive reception of attacker-supplied WiFi frames during background scanning or normal beacon/action-frame handling; no victim interaction beyond having WiFi enabled.\nS:U - Impact is kernel heap out-of-bounds access within the WiFi stack on the victim host; it does not cross a VM, IOMMU, or sandbox security boundary to another authority.\nC:H - Inflated common_len makes ieee80211_mle_common_size() exceed the element buffer, causing for_each_element/cfg80211_defragment_element to read beyond the skb or kmalloc allocation, enabling unbounded kernel memory disclosure.\nI:H - The length underflow and out-of-bounds element iteration constitute exploitable kernel memory corruption; subsequent defragmentation and nested ie parsing can leverage corrupted pointers for arbitrary write primitives.\nA:H - Out-of-bounds reads of unmapped or non-element memory during MLE sub-element iteration can trigger a kernel oops or panic, remotely denying service to any WiFi-enabled device in range."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:42.675Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bba41664af19b8a07d3d728855088ae80e47a4b3"
},
{
"url": "https://git.kernel.org/stable/c/181b46e76a218e9345ed7c4cf59dfa69278e4a06"
},
{
"url": "https://git.kernel.org/stable/c/22941b5c5c46e61a7053e5f32f260f2bc39da617"
},
{
"url": "https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d"
},
{
"url": "https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32"
},
{
"url": "https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"
}
],
"title": "wifi: ieee80211: validate MLE common info length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68471",
"datePublished": "2026-08-15T05:51:29.001Z",
"dateReserved": "2026-07-30T09:28:09.396Z",
"dateUpdated": "2026-10-30T12:28:42.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99216 (GCVE-0-2026-99216)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-31 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to
DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()
calls vmbus_initiate_unload(), which unloads the VMBus connection
only if the conn_state is CONNECTED. Consequently, the connection
remains and the Hyper-V host might continue to send messages or post
VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:
Unload vmbus channel in hv panic callback"), in that
vmbus_initiate_unload() started checking the current connection
state before doing the unload. This commit removed some occurrences
where conn_state was forced to DISCONNECTED, but these two remained,
apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,
or if a failure occurs when establishing the connection in the first
place. Whatever value conn_state has at the time is then read by
vmbus_initiate_unload() to determine if there is a connection to
be unloaded.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 5e059fc0f054309036d3f612bc8b0a502ca58545 Version: 9f38f7b46de0747c1909e8c557aa21715dce20c5 Version: caeeb3787167c884b955404a7e669fd77f267e44 Version: 4.19.118 ≤ Version: 5.4.35 ≤ Version: 5.6.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/connection.c",
"drivers/hv/vmbus_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2939215d57bc8e4189290544fca78f3809ac3ef8",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "deef3ab5129ae4c45662c957cdab3739eb047fb1",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "2e5ffbf1e41abbf6e02ce28115107938f55ff646",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "2732210132f92aca0622b5134027990a809279d5",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "f47ce27af80b87cc684d5c12b65506af498ac7e5",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "3195546a377c2d8d176d837e8baad5ce15d11195",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "ec31dc39e835ccde0930daccece8c492d28282fc",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"status": "affected",
"version": "5e059fc0f054309036d3f612bc8b0a502ca58545",
"versionType": "git"
},
{
"status": "affected",
"version": "9f38f7b46de0747c1909e8c557aa21715dce20c5",
"versionType": "git"
},
{
"status": "affected",
"version": "caeeb3787167c884b955404a7e669fd77f267e44",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.118",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.35",
"versionType": "semver"
},
{
"lessThan": "5.7",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/connection.c",
"drivers/hv/vmbus_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don\u0027t reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started checking the current connection\nstate before doing the unload. This commit removed some occurrences\nwhere conn_state was forced to DISCONNECTED, but these two remained,\napparently due to an oversight at the time.\n\nFix this by not forcing conn_state to DISCONNECTED during VMBus exit,\nor if a failure occurs when establishing the connection in the first\nplace. Whatever value conn_state has at the time is then read by\nvmbus_initiate_unload() to determine if there is a connection to\nbe unloaded."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled CHANNELMSG_VERSION_RESPONSE reaches vmbus_connect() through sysvec_hyperv_callback, vmbus_isr(), vmbus_on_msg_dpc(), and vmbus_onversion_response(); this is local Hyper-V IPC, not a network or physical protocol.\nAC:L - A backend can reject versions through 5.2, accept 5.1 in an isolation guest, then post rescind messages while the patched vmbus_connect() cleanup destroys its queues. The same backend controls both the state setup and racing messages.\nPR:N - vmbus_onversion_response() accepts the Hyper-V parent\u0027s VERSION_RESPONSE from the SynIC message page without guest credentials, capabilities, or authentication; the backend needs no privilege inside the guest.\nUI:N - hv_acpi_init() automatically calls vmbus_bus_init(), vmbus_alloc_synic_and_connect(), and vmbus_connect() during driver initialization; the backend supplies the responses without any victim action.\nS:U - The stale rescind_work_queue/work_queue accesses and resulting corruption occur within the same guest kernel that contains the vulnerable VMBus driver; no guest-to-host escape or IOMMU boundary bypass is produced.\nC:H - Without CHANNELMSG_UNLOAD, __vmbus_on_msg_dpc() can queue a rescind through a workqueue already RCU-freed by vmbus_disconnect(); this kernel heap use-after-free permits object reuse and guest-kernel memory disclosure.\nI:H - queue_work() dereferences the freed workqueue\u0027s cpu_pwq and updates pool counters and work-list state, so reuse of that storage can turn continued host messages into kernel heap writes and control-flow corruption.\nA:H - Continued rescind or offer messages can make __queue_work() access a destroyed or freed workqueue before hv_synic_cleanup() disables the SynIC, causing a warning, invalid-pointer fault, kernel oops, or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T12:45:15.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2939215d57bc8e4189290544fca78f3809ac3ef8"
},
{
"url": "https://git.kernel.org/stable/c/a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304"
},
{
"url": "https://git.kernel.org/stable/c/deef3ab5129ae4c45662c957cdab3739eb047fb1"
},
{
"url": "https://git.kernel.org/stable/c/2e5ffbf1e41abbf6e02ce28115107938f55ff646"
},
{
"url": "https://git.kernel.org/stable/c/2732210132f92aca0622b5134027990a809279d5"
},
{
"url": "https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5"
},
{
"url": "https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195"
},
{
"url": "https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"
}
],
"title": "Drivers: hv: Don\u0027t reset VMBus connection state on error/exit paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99216",
"datePublished": "2026-10-28T10:36:09.383Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-31T12:45:15.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53321 (GCVE-0-2026-53321)
Vulnerability from cvelistv5
Published
2026-06-26 19:41
Modified
2026-11-06 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/napi: cap busy_poll_to 10 msec
Currently there's no cap on the maximum amount of time that napi is
allowed to poll if no events are found, which can lead to kernel
complaints on a task being stuck as there's no conditional rescheduling
done within that loop.
Just cap it to 10 msec in total, that's already way above any kind of
sane value that will reap any benefits, yet low enough that it's
nowhere near being able to trigger preemption complaints.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:26:58.486528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:34:20.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/napi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42785efe813e5a7d815f3b6be126e1bc0d12d2b6",
"status": "affected",
"version": "8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5",
"versionType": "git"
},
{
"lessThan": "39767f944a8c9e696566c37ad5b20131406c4b8d",
"status": "affected",
"version": "8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5",
"versionType": "git"
},
{
"lessThan": "cb3af525f8dfb8930f0c123e5755fa967a12d5c1",
"status": "affected",
"version": "8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5",
"versionType": "git"
},
{
"lessThan": "df8599ee18c0e5fe343ffe0b4c379636b8bb839a",
"status": "affected",
"version": "8d0c12a80cdeb80d5e0510e96d38fe551ed8e9b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/napi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/napi: cap busy_poll_to 10 msec\n\nCurrently there\u0027s no cap on the maximum amount of time that napi is\nallowed to poll if no events are found, which can lead to kernel\ncomplaints on a task being stuck as there\u0027s no conditional rescheduling\ndone within that loop.\n\nJust cap it to 10 msec in total, that\u0027s already way above any kind of\nsane value that will reap any benefits, yet low enough that it\u0027s\nnowhere near being able to trigger preemption complaints."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:31.622Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42785efe813e5a7d815f3b6be126e1bc0d12d2b6"
},
{
"url": "https://git.kernel.org/stable/c/39767f944a8c9e696566c37ad5b20131406c4b8d"
},
{
"url": "https://git.kernel.org/stable/c/cb3af525f8dfb8930f0c123e5755fa967a12d5c1"
},
{
"url": "https://git.kernel.org/stable/c/df8599ee18c0e5fe343ffe0b4c379636b8bb839a"
}
],
"title": "io_uring/napi: cap busy_poll_to 10 msec",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53321",
"datePublished": "2026-06-26T19:41:12.589Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-11-06T16:34:20.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43311 (GCVE-0-2026-43311)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc/tegra: pmc: Fix unsafe generic_handle_irq() call
Currently, when resuming from system suspend on Tegra platforms,
the following warning is observed:
WARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666
Call trace:
handle_irq_desc+0x20/0x58 (P)
tegra186_pmc_wake_syscore_resume+0xe4/0x15c
syscore_resume+0x3c/0xb8
suspend_devices_and_enter+0x510/0x540
pm_suspend+0x16c/0x1d8
The warning occurs because generic_handle_irq() is being called from
a non-interrupt context which is considered as unsafe.
Fix this warning by deferring generic_handle_irq() call to an IRQ work
which gets executed in hard IRQ context where generic_handle_irq()
can be called safely.
When PREEMPT_RT kernels are used, regular IRQ work (initialized with
init_irq_work) is deferred to run in per-CPU kthreads in preemptible
context rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD
variant so that with PREEMPT_RT kernels, the IRQ work is processed in
hardirq context instead of being deferred to a thread which is required
for calling generic_handle_irq().
On non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD()
execute in IRQ context, so this change has no functional impact for
standard kernel configurations.
[treding@nvidia.com: miscellaneous cleanups]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:35:08.641786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:47.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/tegra/pmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1c9c79eb06ed7c4e0a090ba5b1d4e475f7d0681",
"status": "affected",
"version": "0474cc8489bda9a8cd6a10252e7e6af29c849438",
"versionType": "git"
},
{
"lessThan": "5330afc068e90c538dd25aa8f82b3735bdb6d461",
"status": "affected",
"version": "0474cc8489bda9a8cd6a10252e7e6af29c849438",
"versionType": "git"
},
{
"lessThan": "57a79c5df057deb7c1d0ebc066698c795092530f",
"status": "affected",
"version": "0474cc8489bda9a8cd6a10252e7e6af29c849438",
"versionType": "git"
},
{
"lessThan": "64016227dcdb968b7030eda04304f3d0df5d209d",
"status": "affected",
"version": "0474cc8489bda9a8cd6a10252e7e6af29c849438",
"versionType": "git"
},
{
"lessThan": "e6d96073af681780820c94079b978474a8a44413",
"status": "affected",
"version": "0474cc8489bda9a8cd6a10252e7e6af29c849438",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/tegra/pmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc/tegra: pmc: Fix unsafe generic_handle_irq() call\n\nCurrently, when resuming from system suspend on Tegra platforms,\nthe following warning is observed:\n\nWARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666\nCall trace:\n handle_irq_desc+0x20/0x58 (P)\n tegra186_pmc_wake_syscore_resume+0xe4/0x15c\n syscore_resume+0x3c/0xb8\n suspend_devices_and_enter+0x510/0x540\n pm_suspend+0x16c/0x1d8\n\nThe warning occurs because generic_handle_irq() is being called from\na non-interrupt context which is considered as unsafe.\n\nFix this warning by deferring generic_handle_irq() call to an IRQ work\nwhich gets executed in hard IRQ context where generic_handle_irq()\ncan be called safely.\n\nWhen PREEMPT_RT kernels are used, regular IRQ work (initialized with\ninit_irq_work) is deferred to run in per-CPU kthreads in preemptible\ncontext rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD\nvariant so that with PREEMPT_RT kernels, the IRQ work is processed in\nhardirq context instead of being deferred to a thread which is required\nfor calling generic_handle_irq().\n\nOn non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD()\nexecute in IRQ context, so this change has no functional impact for\nstandard kernel configurations.\n\n[treding@nvidia.com: miscellaneous cleanups]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:36.236Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1c9c79eb06ed7c4e0a090ba5b1d4e475f7d0681"
},
{
"url": "https://git.kernel.org/stable/c/5330afc068e90c538dd25aa8f82b3735bdb6d461"
},
{
"url": "https://git.kernel.org/stable/c/57a79c5df057deb7c1d0ebc066698c795092530f"
},
{
"url": "https://git.kernel.org/stable/c/64016227dcdb968b7030eda04304f3d0df5d209d"
},
{
"url": "https://git.kernel.org/stable/c/e6d96073af681780820c94079b978474a8a44413"
}
],
"title": "soc/tegra: pmc: Fix unsafe generic_handle_irq() call",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43311",
"datePublished": "2026-05-08T13:11:29.068Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-11-06T15:42:47.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93125 (GCVE-0-2026-93125)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-30 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
check_kfunc_args() detects a kfunc argument named rdonly_buf_size or
rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64,
and does not bound it. check_kfunc_call() later copies that value into
the returned register's mem_size field:
meta->r0_size = reg->var_off.value;
...
regs[BPF_REG_0].mem_size = meta.r0_size;
regs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set
gets truncated instead of causing a load-time rejection, so the verifier
records a PTR_TO_MEM register with an approximately 4 GiB mem_size for
whatever allocation the kfunc returned. A later access check against
that register uses the truncated, wrong bound.
Reject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the
point meta->r0_size is set.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae Version: eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae Version: eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae Version: eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae Version: eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae Version: eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "00bb52be60da16cd5ead4eb9f8ddc9a66d003ff2",
"status": "affected",
"version": "eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae",
"versionType": "git"
},
{
"lessThan": "2147065d3a4e1d5d42ae553fef165f17ec5e0e79",
"status": "affected",
"version": "eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae",
"versionType": "git"
},
{
"lessThan": "b6ac0b5732047d43172b9dfbe6b57b9b8de303c2",
"status": "affected",
"version": "eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae",
"versionType": "git"
},
{
"lessThan": "93a20b14f8627b2d3486e3ec1d3f2e7275a506ec",
"status": "affected",
"version": "eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae",
"versionType": "git"
},
{
"lessThan": "56a3846830ac95a472297d0cbba75cbff29540bb",
"status": "affected",
"version": "eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae",
"versionType": "git"
},
{
"lessThan": "2aaf67f0516fde29620d0edfc29c01b9ea7ad430",
"status": "affected",
"version": "eb1f7f71c126c8fd50ea81af98f97c4b581ea4ae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max\n\ncheck_kfunc_args() detects a kfunc argument named rdonly_buf_size or\nrdwr_buf_size and stores reg-\u003evar_off.value into meta-\u003er0_size, a u64,\nand does not bound it. check_kfunc_call() later copies that value into\nthe returned register\u0027s mem_size field:\n\n meta-\u003er0_size = reg-\u003evar_off.value;\n ...\n regs[BPF_REG_0].mem_size = meta.r0_size;\n\nregs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set\ngets truncated instead of causing a load-time rejection, so the verifier\nrecords a PTR_TO_MEM register with an approximately 4 GiB mem_size for\nwhatever allocation the kfunc returned. A later access check against\nthat register uses the truncated, wrong bound.\n\nReject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the\npoint meta-\u003er0_size is set."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - check_kfunc_args() takes the oversized rdonly_buf_size/rdwr_buf_size from the BPF program\u0027s own constant (reg-\u003evar_off.value) on the local bpf(BPF_PROG_LOAD) path (bpf_prog_load \u2192 bpf_check \u2192 check_kfunc_call). That immediate is not a field of a received packet or a ksmbd/nfsd message.\nAC:L - The attacker picks a 64-bit immediate with upper bits set (e.g. ~0ULL as in hid_rdesc_fixup_get_data_overflow) as the rdonly_buf_size/rdwr_buf_size argument; tnum_is_const succeeds and regs[BPF_REG_0].mem_size = meta.r0_size truncates deterministically, with no race or layout outside their control.\nPR:L - do_check_common() rejects BPF_PSEUDO_KFUNC_CALL unless env-\u003ebpf_capable, which bpf_check() sets from bpf_token_capable(token, CAP_BPF). CAP_BPF is a reduced capability and is delegable into a user namespace via a BPF token, so init-namespace root is not required.\nUI:N - The attacker loads the crafted program with bpf(BPF_PROG_LOAD) and runs it themselves via BPF_PROG_TEST_RUN or by attaching their own HID-BPF/io_uring struct_ops. No separate victim action such as mounting an image is required.\nS:U - The truncated PTR_TO_MEM mem_size lets the verified program read and write host kernel memory, which is a standard kernel privilege escalation in the same authority. It does not cross a KVM/Xen, IOMMU, or guest-to-host boundary.\nC:H - check_kfunc_call() copies the truncated r0_size into a PTR_TO_MEM register, so check_mem_region_access() allows loads of up to ~4 GiB. bpf_kfunc_call_test_get_rdonly_mem takes const int rdonly_buf_size: a value such as 0x1FFFFFFFF becomes -1, the size \u003e 8 check fails open, and the 8-byte prog_test_ref_kfunc is treated as a 4 GiB readable buffer.\nI:H - rdwr_buf_size kfuncs (bpf_kfunc_call_test_get_rdwr_mem, hid_bpf_get_data, bpf_io_uring_get_region) mark R0 as writable PTR_TO_MEM. The same truncated mem_size lets check_mem_region_access() accept stores past the real object, which is an arbitrary kernel write.\nA:H - Those verifier-allowed out-of-bounds loads and stores overrun the kfunc\u0027s actual object (prog_test_struct from get_mem, hid_bpf_get_data\u0027s ctx_kern-\u003edata, or an io_uring mapped region) and can oops or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:36:03.562Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/00bb52be60da16cd5ead4eb9f8ddc9a66d003ff2"
},
{
"url": "https://git.kernel.org/stable/c/2147065d3a4e1d5d42ae553fef165f17ec5e0e79"
},
{
"url": "https://git.kernel.org/stable/c/b6ac0b5732047d43172b9dfbe6b57b9b8de303c2"
},
{
"url": "https://git.kernel.org/stable/c/93a20b14f8627b2d3486e3ec1d3f2e7275a506ec"
},
{
"url": "https://git.kernel.org/stable/c/56a3846830ac95a472297d0cbba75cbff29540bb"
},
{
"url": "https://git.kernel.org/stable/c/2aaf67f0516fde29620d0edfc29c01b9ea7ad430"
}
],
"title": "bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93125",
"datePublished": "2026-09-17T16:11:29.895Z",
"dateReserved": "2026-09-17T16:02:15.087Z",
"dateUpdated": "2026-10-30T12:36:03.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39862 (GCVE-0-2025-39862)
Vulnerability from cvelistv5
Published
2025-09-19 15:26
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix list corruption after hardware restart
Since stations are recreated from scratch, all lists that wcids are added
to must be cleared before calling ieee80211_restart_hw.
Set wcid->sta = 0 for each wcid entry in order to ensure that they are
not added again before they are ready.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b Version: 3a931ebf67b89316c3b5bed2dca4479dd6f85803 Version: 6.1.188 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-39862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T19:23:35.908171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T19:33:11.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mac80211.c",
"drivers/net/wireless/mediatek/mt76/mt76.h",
"drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d40c15d70c2dba2f68dd50e452255bfa1b016f0",
"status": "affected",
"version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
"versionType": "git"
},
{
"lessThan": "6826728f9fd7e7db57cd9647932eea47cbc645c6",
"status": "affected",
"version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
"versionType": "git"
},
{
"lessThan": "8fa8eb52bc2eb08d93202863b5fc478e0bebc00c",
"status": "affected",
"version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
"versionType": "git"
},
{
"lessThan": "065c79df595af21d6d1b27d642860faa1d938774",
"status": "affected",
"version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
"versionType": "git"
},
{
"status": "affected",
"version": "3a931ebf67b89316c3b5bed2dca4479dd6f85803",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.188",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mac80211.c",
"drivers/net/wireless/mediatek/mt76/mt76.h",
"drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.188",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix list corruption after hardware restart\n\nSince stations are recreated from scratch, all lists that wcids are added\nto must be cleared before calling ieee80211_restart_hw.\nSet wcid-\u003esta = 0 for each wcid entry in order to ensure that they are\nnot added again before they are ready."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The mt7915 driver is an 802.11 device driver whose reset path is armed by firmware watchdog exceptions and MCU command timeouts driven by received wireless traffic, and the corrupted lists are then exercised by the RX/TX paths for frames from stations in radio range. Per kernel scoring guidance WiFi driver bugs reachable by frame injection are Adjacent.\nAC:L - The attacker generates every required condition with their own traffic \u2014 flooding auth/assoc requests and malformed management frames to force the firmware exception or MCU timeout that queues the full reset, and associating/deauthing stations to control which wcids remain on the stale lists and which sta slabs are freed and reallocated. Nothing depends on state outside the attacker\u0027s influence.\nPR:N - No credentials on the target are required; unassociated frame injection (probe/auth/assoc floods, deauth) is sufficient to both trigger the reset and populate the stale wcid entries, and an attacker on an open or guest WLAN holds no privilege on the AP.\nUI:N - The corruption happens autonomously inside the driver\u0027s reset work, mac80211 reconfig and tx worker in response to attacker-generated frames. No administrator or local user action is involved.\nS:U - The corrupted list heads, stale RCU pointers and resulting writes are all confined to kernel memory under the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - Dangling `dev-\u003ewcid[]` entries surviving the reset are dereferenced by the RX and TX-status fastpaths after mac80211 frees the backing `ieee80211_sta` objects, giving out-of-bounds and use-after-free reads of attacker-groomable slab memory, and the traversal of `dev-\u003ewcid_list`/`phy-\u003etx_list` leaks kernel pointers. Per the use-after-free guidance this rates High.\nI:H - `list_add_tail()`/`list_del_init()` on the reinitialized-but-still-linked nodes write kernel pointers into freed and reallocated station objects (`prev-\u003enext`, `next-\u003eprev`), and the RX path writes through stale wcid pointers (`rx_key_pn` memcpy, RSSI/stat updates, poll-list insertion) \u2014 a controllable kernel write primitive suitable for control-flow hijacking.\nA:H - List corruption plus dereference of dangling wcid pointers reliably oopses or panics the kernel; with CONFIG_DEBUG_LIST it is an immediate list-corruption BUG, and the cross-linked heads can spin `mt76_txq_schedule_pending()`\u0027s `while (!list_empty(\u0026tx_list))` forever with `phy-\u003etx_lock` held and BHs disabled, hanging the AP."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:30.520Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d40c15d70c2dba2f68dd50e452255bfa1b016f0"
},
{
"url": "https://git.kernel.org/stable/c/6826728f9fd7e7db57cd9647932eea47cbc645c6"
},
{
"url": "https://git.kernel.org/stable/c/8fa8eb52bc2eb08d93202863b5fc478e0bebc00c"
},
{
"url": "https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"
}
],
"title": "wifi: mt76: mt7915: fix list corruption after hardware restart",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39862",
"datePublished": "2025-09-19T15:26:32.259Z",
"dateReserved": "2025-04-16T07:20:57.143Z",
"dateUpdated": "2026-10-21T12:37:30.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68412 (GCVE-0-2026-68412)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
If the test against IEEE80211_MAX_SSID_LEN fails, then 'creq' leaks.
Use the existing error handling path to fix it.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4114597b7949e90f4fa181342cf01400b8a5a75",
"status": "affected",
"version": "2a5193119269062608582418deba7af82844159a",
"versionType": "git"
},
{
"lessThan": "e67dc2b8d5ac4bb804000b6732768a9ae678912f",
"status": "affected",
"version": "2a5193119269062608582418deba7af82844159a",
"versionType": "git"
},
{
"lessThan": "99d2e850c643e2c70fa165b722a1ad28347a8b3a",
"status": "affected",
"version": "2a5193119269062608582418deba7af82844159a",
"versionType": "git"
},
{
"lessThan": "c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6",
"status": "affected",
"version": "2a5193119269062608582418deba7af82844159a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()\n\nIf the test against IEEE80211_MAX_SSID_LEN fails, then \u0027creq\u0027 leaks.\nUse the existing error handling path to fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:04.216Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4114597b7949e90f4fa181342cf01400b8a5a75"
},
{
"url": "https://git.kernel.org/stable/c/e67dc2b8d5ac4bb804000b6732768a9ae678912f"
},
{
"url": "https://git.kernel.org/stable/c/99d2e850c643e2c70fa165b722a1ad28347a8b3a"
},
{
"url": "https://git.kernel.org/stable/c/c6659f66d4ee4841aafae5659d2ef5e4c5c63cb6"
}
],
"title": "wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68412",
"datePublished": "2026-08-10T12:04:32.486Z",
"dateReserved": "2026-07-30T09:28:09.391Z",
"dateUpdated": "2026-10-21T12:44:04.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38597 (GCVE-0-2025-38597)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2026-10-30 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
Each window of a vop2 is usable by a specific set of video ports, so while
binding the vop2, we look through the list of available windows trying to
find one designated as primary-plane and usable by that specific port.
The code later wants to use drm_crtc_init_with_planes with that found
primary plane, but nothing has checked so far if a primary plane was
actually found.
For whatever reason, the rk3576 vp2 does not have a usable primary window
(if vp0 is also in use) which brought the issue to light and ended in a
null-pointer dereference further down.
As we expect a primary-plane to exist for a video-port, add a check at
the end of the window-iteration and fail probing if none was found.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 604be85547ce4d61b89292d2f9a78c721b778c16 Version: 604be85547ce4d61b89292d2f9a78c721b778c16 Version: 604be85547ce4d61b89292d2f9a78c721b778c16 Version: 604be85547ce4d61b89292d2f9a78c721b778c16 Version: 604be85547ce4d61b89292d2f9a78c721b778c16 Version: 604be85547ce4d61b89292d2f9a78c721b778c16 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/rockchip/rockchip_drm_vop2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93857359a07e425b643178ce3c6e60a9e4605cac",
"status": "affected",
"version": "604be85547ce4d61b89292d2f9a78c721b778c16",
"versionType": "git"
},
{
"lessThan": "45be183b9944f765b77623daffb024cb38d192bf",
"status": "affected",
"version": "604be85547ce4d61b89292d2f9a78c721b778c16",
"versionType": "git"
},
{
"lessThan": "8fc974776c668fef1fc73fefbf573a076bb073e8",
"status": "affected",
"version": "604be85547ce4d61b89292d2f9a78c721b778c16",
"versionType": "git"
},
{
"lessThan": "e1eef239399927b368f70a716044fb10085627c8",
"status": "affected",
"version": "604be85547ce4d61b89292d2f9a78c721b778c16",
"versionType": "git"
},
{
"lessThan": "38682edbbad272b5f8c7bf55128b42cd10626f73",
"status": "affected",
"version": "604be85547ce4d61b89292d2f9a78c721b778c16",
"versionType": "git"
},
{
"lessThan": "f9f68bf1d0efeadb6c427c9dbb30f307a7def19b",
"status": "affected",
"version": "604be85547ce4d61b89292d2f9a78c721b778c16",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/rockchip/rockchip_drm_vop2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port\n\nEach window of a vop2 is usable by a specific set of video ports, so while\nbinding the vop2, we look through the list of available windows trying to\nfind one designated as primary-plane and usable by that specific port.\n\nThe code later wants to use drm_crtc_init_with_planes with that found\nprimary plane, but nothing has checked so far if a primary plane was\nactually found.\n\nFor whatever reason, the rk3576 vp2 does not have a usable primary window\n(if vp0 is also in use) which brought the issue to light and ended in a\nnull-pointer dereference further down.\n\nAs we expect a primary-plane to exist for a video-port, add a check at\nthe end of the window-iteration and fail probing if none was found."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:07.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93857359a07e425b643178ce3c6e60a9e4605cac"
},
{
"url": "https://git.kernel.org/stable/c/45be183b9944f765b77623daffb024cb38d192bf"
},
{
"url": "https://git.kernel.org/stable/c/8fc974776c668fef1fc73fefbf573a076bb073e8"
},
{
"url": "https://git.kernel.org/stable/c/e1eef239399927b368f70a716044fb10085627c8"
},
{
"url": "https://git.kernel.org/stable/c/38682edbbad272b5f8c7bf55128b42cd10626f73"
},
{
"url": "https://git.kernel.org/stable/c/f9f68bf1d0efeadb6c427c9dbb30f307a7def19b"
}
],
"title": "drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38597",
"datePublished": "2025-08-19T17:03:32.380Z",
"dateReserved": "2025-04-16T04:51:24.028Z",
"dateUpdated": "2026-10-30T12:22:07.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39789 (GCVE-0-2025-39789)
Vulnerability from cvelistv5
Published
2025-09-11 16:56
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: x86/aegis - Add missing error checks
The skcipher_walk functions can allocate memory and can fail, so
checking for errors is necessary.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/crypto/aegis128-aesni-glue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "74d3b91f1598eedf87a977702f9f55e32698206d",
"status": "affected",
"version": "1d373d4e8e15b358f08de52956b32e0e38a11f84",
"versionType": "git"
},
{
"lessThan": "b4ba650125d21e937f82fcafcd2738fe31209c05",
"status": "affected",
"version": "1d373d4e8e15b358f08de52956b32e0e38a11f84",
"versionType": "git"
},
{
"lessThan": "475104178f4d30e749ee4f5473c87f692b93bebb",
"status": "affected",
"version": "1d373d4e8e15b358f08de52956b32e0e38a11f84",
"versionType": "git"
},
{
"lessThan": "3d9eb180fbe8828cce43bce4c370124685b205c3",
"status": "affected",
"version": "1d373d4e8e15b358f08de52956b32e0e38a11f84",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/crypto/aegis128-aesni-glue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.4",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: x86/aegis - Add missing error checks\n\nThe skcipher_walk functions can allocate memory and can fail, so\nchecking for errors is necessary."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The AEGIS-128 AEAD is driven from the local crypto API \u2014 an unprivileged user reaches it directly via an AF_ALG/algif_aead socket, and in-kernel consumers (dm-crypt, xfrm ESP) are configured locally. A remote peer cannot itself supply input that reaches the failing allocation, so this is local.\nAC:L - The failure requires a memory allocation failure inside skcipher_walk, but the attacker can both force the allocating slow path on every walk step (by submitting scatterlists fragmented below the 16-byte chunksize) and induce the memory pressure, then retry the operation arbitrarily many times; the GFP_ATOMIC variant used by softirq consumers fails readily under attacker-generated load.\nPR:L - Binding an AF_ALG socket to \"aegis128\" and issuing encrypt requests requires only an unprivileged local account \u2014 no capability, and module autoload happens on the user\u0027s behalf.\nUI:N - The attacker triggers the encrypt/decrypt path entirely on their own; no victim action is needed.\nS:U - The faulty error handling and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - On the unchecked error path the encrypt call returns success without encrypting, so the \"ciphertext\" handed to the caller is the raw plaintext (in-place operations) or stale kernel buffer contents (out-of-place, e.g. dm-crypt/ESP buffers), disclosing data that was supposed to be protected to disk, network peers, or backups.\nI:H - The kernel reports a successful AEAD operation while producing unencrypted, partially encrypted, or stale output with a mismatched tag, so data written to encrypted storage or an encrypted tunnel is silently wrong and cannot be distinguished from valid output by the caller.\nA:L - No kernel crash, hang, or corruption occurs; the impact is that the silently bad ciphertext/tag causes downstream rejection \u2014 dropped IPsec packets, I/O errors on integrity-protected volumes, and unrecoverable stored blocks \u2014 which is a limited interruption rather than a full loss of availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:21.691Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/74d3b91f1598eedf87a977702f9f55e32698206d"
},
{
"url": "https://git.kernel.org/stable/c/b4ba650125d21e937f82fcafcd2738fe31209c05"
},
{
"url": "https://git.kernel.org/stable/c/475104178f4d30e749ee4f5473c87f692b93bebb"
},
{
"url": "https://git.kernel.org/stable/c/3d9eb180fbe8828cce43bce4c370124685b205c3"
}
],
"title": "crypto: x86/aegis - Add missing error checks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39789",
"datePublished": "2025-09-11T16:56:37.912Z",
"dateReserved": "2025-04-16T07:20:57.131Z",
"dateUpdated": "2026-10-21T12:37:21.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98148 (GCVE-0-2026-98148)
Vulnerability from cvelistv5
Published
2026-09-25 10:36
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: validate GUD_ROTATION_0 is present in supported rotations
The rotation argument to drm_plane_create_rotation_property() is set to
DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as
the supported_rotations argument. The driver never validates that
GUD_ROTATION_0 is present, so a device that omits it from its
GUD_PROPERTY_ROTATION triggers the
WARN_ON(rotation & ~supported_rotations) in
drm_plane_create_rotation_property()
Fix this by skipping the creation of rotation property if the device
doesn't have the GUD_ROTATION_0 bit
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gud/gud_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce7da178f1af4e9cbac4d0440c4002785546bfb5",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "962cdf2eedb2708eb99c25ffb56c6d6981d41ed6",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "b2cd682324b889011874cf844b7c7efa97c97296",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "876b33d8a9a00e9d4bbcbb7f55ad2c05974850de",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "cb732d027aa18e1fcf9d2797f47d20b179ebc59c",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gud/gud_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: validate GUD_ROTATION_0 is present in supported rotations\n\nThe rotation argument to drm_plane_create_rotation_property() is set to\nDRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as\nthe supported_rotations argument. The driver never validates that\nGUD_ROTATION_0 is present, so a device that omits it from its\nGUD_PROPERTY_ROTATION triggers the\nWARN_ON(rotation \u0026 ~supported_rotations) in\ndrm_plane_create_rotation_property()\n\nFix this by skipping the creation of rotation property if the device\ndoesn\u0027t have the GUD_ROTATION_0 bit"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:42.819Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce7da178f1af4e9cbac4d0440c4002785546bfb5"
},
{
"url": "https://git.kernel.org/stable/c/962cdf2eedb2708eb99c25ffb56c6d6981d41ed6"
},
{
"url": "https://git.kernel.org/stable/c/b2cd682324b889011874cf844b7c7efa97c97296"
},
{
"url": "https://git.kernel.org/stable/c/876b33d8a9a00e9d4bbcbb7f55ad2c05974850de"
},
{
"url": "https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"
}
],
"title": "drm/gud: validate GUD_ROTATION_0 is present in supported rotations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98148",
"datePublished": "2026-09-25T10:36:21.562Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-10-21T12:54:42.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90345 (GCVE-0-2026-90345)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-30 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix P2P action frame handling without device vif
Some P2P action frame paths assume the P2P device vif is always
available. That is not true when userspace sends non-P2P public action
frames through the primary interface, or when action-frame abort runs
after the P2P device vif has not been created.
Fall back to the primary vif when aborting an action frame without a P2P
device vif, and guard P2P device saved IE access before using it for
peer channel search.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b Version: 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b Version: 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b Version: 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b Version: 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b Version: 6eda4e2c54255cd26a58d2fcec73ec3bff7a515b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb01b8c85682e531516adf6fb632bf2ccb67ec1d",
"status": "affected",
"version": "6eda4e2c54255cd26a58d2fcec73ec3bff7a515b",
"versionType": "git"
},
{
"lessThan": "66b89c6a7da47efb38a9b839c2ae221b23a1c88b",
"status": "affected",
"version": "6eda4e2c54255cd26a58d2fcec73ec3bff7a515b",
"versionType": "git"
},
{
"lessThan": "6641ba636bf675b2634c49fe818931cf6ca8f547",
"status": "affected",
"version": "6eda4e2c54255cd26a58d2fcec73ec3bff7a515b",
"versionType": "git"
},
{
"lessThan": "f334b26b884dff5d0a558dc464fa55f300868a68",
"status": "affected",
"version": "6eda4e2c54255cd26a58d2fcec73ec3bff7a515b",
"versionType": "git"
},
{
"lessThan": "f26e1b16904555e171292e183c3cfc1c38159fc5",
"status": "affected",
"version": "6eda4e2c54255cd26a58d2fcec73ec3bff7a515b",
"versionType": "git"
},
{
"lessThan": "1b1edb9ebed49099bdc924cef49a9aea8b552199",
"status": "affected",
"version": "6eda4e2c54255cd26a58d2fcec73ec3bff7a515b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P action frame handling without device vif\n\nSome P2P action frame paths assume the P2P device vif is always\navailable. That is not true when userspace sends non-P2P public action\nframes through the primary interface, or when action-frame abort runs\nafter the P2P device vif has not been created.\n\nFall back to the primary vif when aborting an action frame without a P2P\ndevice vif, and guard P2P device saved IE access before using it for\npeer channel search."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:35:17.441Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb01b8c85682e531516adf6fb632bf2ccb67ec1d"
},
{
"url": "https://git.kernel.org/stable/c/66b89c6a7da47efb38a9b839c2ae221b23a1c88b"
},
{
"url": "https://git.kernel.org/stable/c/6641ba636bf675b2634c49fe818931cf6ca8f547"
},
{
"url": "https://git.kernel.org/stable/c/f334b26b884dff5d0a558dc464fa55f300868a68"
},
{
"url": "https://git.kernel.org/stable/c/f26e1b16904555e171292e183c3cfc1c38159fc5"
},
{
"url": "https://git.kernel.org/stable/c/1b1edb9ebed49099bdc924cef49a9aea8b552199"
}
],
"title": "wifi: brcmfmac: fix P2P action frame handling without device vif",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90345",
"datePublished": "2026-09-17T16:08:54.958Z",
"dateReserved": "2026-09-11T19:38:34.805Z",
"dateUpdated": "2026-10-30T12:35:17.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43034 (GCVE-0-2026-43034)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: set backing store type from query type
bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the
firmware response in ctxm->type and later uses that value to index
fixed backing-store metadata arrays such as ctx_arr[] and
bnxt_bstore_to_trace[].
ctxm->type is fixed by the current backing-store query type and matches
the array index of ctx->ctx_arr. Set ctxm->type from the current loop
variable instead of depending on resp->type.
Also update the loop to advance type from next_valid_type in the for
statement, which keeps the control flow simpler for non-valid and
unchanged entries.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43034",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:26:40.782752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:27.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c66a27ca534580de1d28cf568f59fe5f50d43e15",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
},
{
"lessThan": "c8d53b70166d1dc463ef42adb7293e1a770822c7",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
},
{
"lessThan": "29732b68a6816a815d58e9ab229844c23617e1e0",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
},
{
"lessThan": "4ee937107d52f9e5c350e4b5e629760e328b3d9f",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: set backing store type from query type\n\nbnxt_hwrm_func_backing_store_qcaps_v2() stores resp-\u003etype from the\nfirmware response in ctxm-\u003etype and later uses that value to index\nfixed backing-store metadata arrays such as ctx_arr[] and\nbnxt_bstore_to_trace[].\n\nctxm-\u003etype is fixed by the current backing-store query type and matches\nthe array index of ctx-\u003ectx_arr. Set ctxm-\u003etype from the current loop\nvariable instead of depending on resp-\u003etype.\n\nAlso update the loop to advance type from next_valid_type in the for\nstatement, which keeps the control flow simpler for non-valid and\nunchanged entries."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:53.398Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c66a27ca534580de1d28cf568f59fe5f50d43e15"
},
{
"url": "https://git.kernel.org/stable/c/c8d53b70166d1dc463ef42adb7293e1a770822c7"
},
{
"url": "https://git.kernel.org/stable/c/29732b68a6816a815d58e9ab229844c23617e1e0"
},
{
"url": "https://git.kernel.org/stable/c/4ee937107d52f9e5c350e4b5e629760e328b3d9f"
}
],
"title": "bnxt_en: set backing store type from query type",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43034",
"datePublished": "2026-05-01T14:15:33.260Z",
"dateReserved": "2026-05-01T14:12:55.977Z",
"dateUpdated": "2026-11-06T15:32:27.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68421 (GCVE-0-2026-68421)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
put_prev_task_scx() warns when a runnable task drops to a lower sched_class
without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have
kept it running. Core scheduling breaks that: a forced-idle SMT sibling
reschedules through the core_pick fast path in pick_next_task(), which skips
pick_task_scx() and thus balance_one(), so a runnable task can drop to idle
with ENQ_LAST unset.
Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core
scheduling forced the idle, while a match (or core scheduling off) still
catches a genuine missing-ENQ_LAST drop.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6267ebee9f2f3e26f4968bf6dc29d350620fa320",
"status": "affected",
"version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
"versionType": "git"
},
{
"lessThan": "2907e9d0f05b506dfd58aec589a23042a56ef36b",
"status": "affected",
"version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
"versionType": "git"
},
{
"lessThan": "e2f188cdbf8312289532c36eb4e9eb1c9544d43a",
"status": "affected",
"version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
"versionType": "git"
},
{
"lessThan": "b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da",
"status": "affected",
"version": "7c65ae81ea86a6ed8086e1a5651acd766187f19b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don\u0027t warn on core-sched forced idle in put_prev_task_scx()\n\nput_prev_task_scx() warns when a runnable task drops to a lower sched_class\nwithout SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have\nkept it running. Core scheduling breaks that: a forced-idle SMT sibling\nreschedules through the core_pick fast path in pick_next_task(), which skips\npick_task_scx() and thus balance_one(), so a runnable task can drop to idle\nwith ENQ_LAST unset.\n\nGate the warning on sched_cpu_cookie_match(): a cookie mismatch means core\nscheduling forced the idle, while a match (or core scheduling off) still\ncatches a genuine missing-ENQ_LAST drop."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:06.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6267ebee9f2f3e26f4968bf6dc29d350620fa320"
},
{
"url": "https://git.kernel.org/stable/c/2907e9d0f05b506dfd58aec589a23042a56ef36b"
},
{
"url": "https://git.kernel.org/stable/c/e2f188cdbf8312289532c36eb4e9eb1c9544d43a"
},
{
"url": "https://git.kernel.org/stable/c/b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da"
}
],
"title": "sched_ext: Don\u0027t warn on core-sched forced idle in put_prev_task_scx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68421",
"datePublished": "2026-08-10T12:04:41.946Z",
"dateReserved": "2026-07-30T09:28:09.392Z",
"dateUpdated": "2026-10-21T12:44:06.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90240 (GCVE-0-2026-90240)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
domain_context_clear_one() and device_pasid_table_teardown() are both
invoked once per DMA alias of a device. Each function locates the context
entry using the bus/devfn pair provided by the pci_for_each_dma_alias()
callback, then calls intel_context_flush_no_pasid(), which constructs a
device-selective context-cache invalidation from info->bus and
info->devfn (that is, always the requester ID of the device itself).
As a result, for every alias other than the device’s own RID, the context
entry that was just cleared in memory is never invalidated in the context
cache. Hardware may continue using that stale cached entry. In the
scalable-mode teardown path, intel_pasid_free_table() can then free the
PASID directory still referenced by that stale entry, allowing the IOMMU
to walk freed memory.
Fix this by passing the source ID of the entry being torn down to
intel_context_flush_no_pasid(), instead of deriving it from @info.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c",
"drivers/iommu/intel/iommu.h",
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3eb6ad14ef359e426cff14942e220de101cdbe84",
"status": "affected",
"version": "f90584f4beb84211c4d21b319cc13f391fe9f3c2",
"versionType": "git"
},
{
"lessThan": "a803141597d61dc0511f7cd849625e17d042ca8a",
"status": "affected",
"version": "f90584f4beb84211c4d21b319cc13f391fe9f3c2",
"versionType": "git"
},
{
"lessThan": "5baddf100b3be730912485648cbaae5e3a251923",
"status": "affected",
"version": "f90584f4beb84211c4d21b319cc13f391fe9f3c2",
"versionType": "git"
},
{
"lessThan": "c54e4ae971b98e8d650400137d332cee56c03f55",
"status": "affected",
"version": "f90584f4beb84211c4d21b319cc13f391fe9f3c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c",
"drivers/iommu/intel/iommu.h",
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Flush context cache with correct SID when tearing down aliases\n\ndomain_context_clear_one() and device_pasid_table_teardown() are both\ninvoked once per DMA alias of a device. Each function locates the context\nentry using the bus/devfn pair provided by the pci_for_each_dma_alias()\ncallback, then calls intel_context_flush_no_pasid(), which constructs a\ndevice-selective context-cache invalidation from info-\u003ebus and\ninfo-\u003edevfn (that is, always the requester ID of the device itself).\n\nAs a result, for every alias other than the device\u2019s own RID, the context\nentry that was just cleared in memory is never invalidated in the context\ncache. Hardware may continue using that stale cached entry. In the\nscalable-mode teardown path, intel_pasid_free_table() can then free the\nPASID directory still referenced by that stale entry, allowing the IOMMU\nto walk freed memory.\n\nFix this by passing the source ID of the entry being torn down to\nintel_context_flush_no_pasid(), instead of deriving it from @info."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - domain_context_clear_one() and device_pasid_table_teardown() run from local VFIO_DEVICE_DETACH_IOMMUFD_PT/ATTACH_IOMMUFD_PT (vfio_df_ioctl_detach_pt \u2192 iommufd_device_detach \u2192 blocking_domain_attach_dev \u2192 device_block_translation) and from intel_iommu_release_device on PCI removal. The bug is intel_context_flush_no_pasid() using the wrong SID, not bytes from a remote protocol.\nAC:L - For every pci_for_each_dma_alias() RID other than info-\u003ebus/info-\u003edevfn, intel_context_flush_no_pasid() issues DMA_CCMD_DEVICE_INVL with the device\u0027s own RID, so the alias context-cache entry is never invalidated. A VFIO user who owns a dma_alias_mask or PCI-bridge-aliased device then DMAs with that alias SID; there is no uncontrolled race.\nPR:L - vfio_device_fops_unl_ioctl handles VFIO_DEVICE_DETACH_IOMMUFD_PT with no capable() check; vfio_group_fops_open requires CAP_SYS_RAWIO only for VFIO_NO_IOMMU groups. A tenant VMM with a passed-through aliased PCI device (device-file access, not init-namespace root) can detach while keeping DMA active.\nUI:N - The attacker issues VFIO_DEVICE_DETACH_IOMMUFD_PT or closes the vfio device fd themselves, then continues DMA using the unflushed alias RID. No separate victim action such as mounting a filesystem is required.\nS:C - After the missed alias-SID flush, hardware keeps a Present context for that RID while intel_pasid_free_table() (scalable mode) or domain teardown (legacy domain_context_clear_one) frees the PASID directory or page tables. The IOMMU then walks those freed translation structures for device DMA, crossing the VT-d DMA isolation boundary.\nC:H - A stale cached context for the alias SID still points at the PASID directory that intel_pasid_free_table() just freed, or at second-level page tables already torn down. Device DMA with that RID is translated through attacker-influencable freed pages, reading host memory outside the assigned domain.\nI:H - The same leftover cached page-table or PASID-directory pointer for the unflushed alias SID lets the device DMA-write host memory that software has already freed or reassigned, giving an arbitrary cross-domain write primitive.\nA:H - IOMMU walks of the freed PASID directory or page tables via the stale alias-SID context cause DMAR faults, translation failures, and host oops/panic; the commit documents hardware continuing to use that cached entry after teardown."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:36.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3eb6ad14ef359e426cff14942e220de101cdbe84"
},
{
"url": "https://git.kernel.org/stable/c/a803141597d61dc0511f7cd849625e17d042ca8a"
},
{
"url": "https://git.kernel.org/stable/c/5baddf100b3be730912485648cbaae5e3a251923"
},
{
"url": "https://git.kernel.org/stable/c/c54e4ae971b98e8d650400137d332cee56c03f55"
}
],
"title": "iommu/vt-d: Flush context cache with correct SID when tearing down aliases",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90240",
"datePublished": "2026-09-17T16:07:44.445Z",
"dateReserved": "2026-09-11T19:38:34.795Z",
"dateUpdated": "2026-10-21T12:50:36.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72031 (GCVE-0-2026-72031)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus
after entering Device-Initiated Slumber during idle. With the default
med_power_with_dipm policy the link goes down (SStatus 1 SControl 300)
and does not recover, forcing the filesystem read-only. Forcing
max_performance keeps the link stable across prolonged idle.
Add a NOLPM quirk so link power management is disabled for this drive
specifically, leaving it intact for other devices on the host.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/libata-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb94157a86cef9a151ccd4bc52faae1853d0fa0c",
"status": "affected",
"version": "7627a0edef548c4c4dea62df51cc26bfe5bbcab8",
"versionType": "git"
},
{
"lessThan": "0a2c89d538fd4fca07c6ebe4fe03cc932f962441",
"status": "affected",
"version": "7627a0edef548c4c4dea62df51cc26bfe5bbcab8",
"versionType": "git"
},
{
"lessThan": "299739909c486bcea7445f5c3b066fdbc0d2df96",
"status": "affected",
"version": "7627a0edef548c4c4dea62df51cc26bfe5bbcab8",
"versionType": "git"
},
{
"lessThan": "462775c620197adaabc983ce847e5b9878ff4cb0",
"status": "affected",
"version": "7627a0edef548c4c4dea62df51cc26bfe5bbcab8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/libata-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD\n\nThe PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus\nafter entering Device-Initiated Slumber during idle. With the default\nmed_power_with_dipm policy the link goes down (SStatus 1 SControl 300)\nand does not recover, forcing the filesystem read-only. Forcing\nmax_performance keeps the link stable across prolonged idle.\n\nAdd a NOLPM quirk so link power management is disabled for this drive\nspecifically, leaving it intact for other devices on the host."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:19.607Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb94157a86cef9a151ccd4bc52faae1853d0fa0c"
},
{
"url": "https://git.kernel.org/stable/c/0a2c89d538fd4fca07c6ebe4fe03cc932f962441"
},
{
"url": "https://git.kernel.org/stable/c/299739909c486bcea7445f5c3b066fdbc0d2df96"
},
{
"url": "https://git.kernel.org/stable/c/462775c620197adaabc983ce847e5b9878ff4cb0"
}
],
"title": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72031",
"datePublished": "2026-08-15T05:51:53.824Z",
"dateReserved": "2026-08-09T03:40:39.901Z",
"dateUpdated": "2026-10-21T12:44:19.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80905 (GCVE-0-2026-80905)
Vulnerability from cvelistv5
Published
2026-09-04 17:19
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tap: fix wrong transport_header when sending VLAN-tagged frame
In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.
ETH_P_8021Q), skb_set_network_header() is called first to advance
network_header past the VLAN tag to the inner protocol header.
skb_probe_transport_header() is then called with skb->protocol still
set to ETH_P_8021Q, while nhoff (derived from skb_network_offset())
already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff
points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it
reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),
but that offset contains the inner protocol header (e.g. an IP header).
The bytes are misinterpreted as a VLAN header, yielding a garbage
encapsulated EtherType that matches no known protocol. The dissector
returns false, so skb_probe_transport_header() never calls
skb_set_transport_header(), leaving transport_header at its uninitialized
sentinel value (~0U).
Move skb_set_network_header() to after skb_probe_transport_header(). At
the time skb_probe_transport_header() is called, network_header still
points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the
flow dissector can parse the VLAN header, extract the inner EtherType,
and advance nhoff to the inner protocol header, allowing transport_header
to be set correctly.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8c76e77f9069f10505c08e02646c3ee11ad79038 Version: 8c76e77f9069f10505c08e02646c3ee11ad79038 Version: 8c76e77f9069f10505c08e02646c3ee11ad79038 Version: 8c76e77f9069f10505c08e02646c3ee11ad79038 Version: 8c76e77f9069f10505c08e02646c3ee11ad79038 Version: 8c76e77f9069f10505c08e02646c3ee11ad79038 Version: 3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1 Version: 4.20.1 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a8f49e83e4447b885376e6a937d62df883cc8824",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "c0376820922d255ae1d103c32345a6ec4c3266f7",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "f1d297cad5c1eacd9fadfd0346ad97405ffbf97c",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"lessThan": "cbb35cbe8db268fefe34c23df15348cf99025298",
"status": "affected",
"version": "8c76e77f9069f10505c08e02646c3ee11ad79038",
"versionType": "git"
},
{
"status": "affected",
"version": "3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1",
"versionType": "git"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tap: fix wrong transport_header when sending VLAN-tagged frame\n\nIn tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.\nETH_P_8021Q), skb_set_network_header() is called first to advance\nnetwork_header past the VLAN tag to the inner protocol header.\nskb_probe_transport_header() is then called with skb-\u003eprotocol still\nset to ETH_P_8021Q, while nhoff (derived from skb_network_offset())\nalready points past the VLAN tag to the inner protocol header.\n\nIn __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff\npoints past the VLAN tag. When the dissector hits case ETH_P_8021Q, it\nreads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),\nbut that offset contains the inner protocol header (e.g. an IP header).\nThe bytes are misinterpreted as a VLAN header, yielding a garbage\nencapsulated EtherType that matches no known protocol. The dissector\nreturns false, so skb_probe_transport_header() never calls\nskb_set_transport_header(), leaving transport_header at its uninitialized\nsentinel value (~0U).\n\nMove skb_set_network_header() to after skb_probe_transport_header(). At\nthe time skb_probe_transport_header() is called, network_header still\npoints to the VLAN header (offset ETH_HLEN), so nhoff is correct and the\nflow dissector can parse the VLAN header, extract the inner EtherType,\nand advance nhoff to the inner protocol header, allowing transport_header\nto be set correctly."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:24.447Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a8f49e83e4447b885376e6a937d62df883cc8824"
},
{
"url": "https://git.kernel.org/stable/c/c0376820922d255ae1d103c32345a6ec4c3266f7"
},
{
"url": "https://git.kernel.org/stable/c/f1d297cad5c1eacd9fadfd0346ad97405ffbf97c"
},
{
"url": "https://git.kernel.org/stable/c/5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b"
},
{
"url": "https://git.kernel.org/stable/c/88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3"
},
{
"url": "https://git.kernel.org/stable/c/cbb35cbe8db268fefe34c23df15348cf99025298"
}
],
"title": "net: tap: fix wrong transport_header when sending VLAN-tagged frame",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80905",
"datePublished": "2026-09-04T17:19:15.289Z",
"dateReserved": "2026-08-26T14:34:25.800Z",
"dateUpdated": "2026-10-30T12:31:24.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93230 (GCVE-0-2026-93230)
Vulnerability from cvelistv5
Published
2026-09-24 15:29
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
Gigantic bootmem HugeTLB pages are currently initialized from
hugetlb_init(), but page_alloc_init_late() runs earlier and walks
pageblocks to determine zone contiguity.
If a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can
observe still-uninitialized struct pages through
__pageblock_pfn_to_page(). This may not trigger an immediate failure, but
it can make set_zone_contiguous() compute the wrong zone contiguity state.
If extra poisoned-page checks are added in this path, such as
PF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot
panic.
Initialize gigantic bootmem HugeTLB struct pages from
page_alloc_init_late(), before zone contiguity is evaluated, so later page
allocator setup only sees valid struct page state. This also makes the
initialization order more natural, as struct pages should be initialized
before later code inspects them.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/hugetlb.h",
"mm/hugetlb.c",
"mm/mm_init.c",
"mm/sparse-vmemmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "326de479ab5942fb4a4aa4f20c716045434fcd6b",
"status": "affected",
"version": "fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40",
"versionType": "git"
},
{
"lessThan": "09505232eced5f1c42902d8f28740f070c3fc6dc",
"status": "affected",
"version": "fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40",
"versionType": "git"
},
{
"lessThan": "29968bc7aefb3cf1e72aa7c5f52697a6b0527094",
"status": "affected",
"version": "fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40",
"versionType": "git"
},
{
"lessThan": "b1b7c045e808c761b1cc8c19b3040fadedda3fef",
"status": "affected",
"version": "fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/hugetlb.h",
"mm/hugetlb.c",
"mm/mm_init.c",
"mm/sparse-vmemmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier\n\nGigantic bootmem HugeTLB pages are currently initialized from\nhugetlb_init(), but page_alloc_init_late() runs earlier and walks\npageblocks to determine zone contiguity.\n\nIf a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can\nobserve still-uninitialized struct pages through\n__pageblock_pfn_to_page(). This may not trigger an immediate failure, but\nit can make set_zone_contiguous() compute the wrong zone contiguity state.\nIf extra poisoned-page checks are added in this path, such as\nPF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot\npanic.\n\nInitialize gigantic bootmem HugeTLB struct pages from\npage_alloc_init_late(), before zone contiguity is evaluated, so later page\nallocator setup only sees valid struct page state. This also makes the\ninitialization order more natural, as struct pages should be initialized\nbefore later code inspects them."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:25.122Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/326de479ab5942fb4a4aa4f20c716045434fcd6b"
},
{
"url": "https://git.kernel.org/stable/c/09505232eced5f1c42902d8f28740f070c3fc6dc"
},
{
"url": "https://git.kernel.org/stable/c/29968bc7aefb3cf1e72aa7c5f52697a6b0527094"
},
{
"url": "https://git.kernel.org/stable/c/b1b7c045e808c761b1cc8c19b3040fadedda3fef"
}
],
"title": "mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93230",
"datePublished": "2026-09-24T15:29:16.067Z",
"dateReserved": "2026-09-17T16:02:15.094Z",
"dateUpdated": "2026-10-21T12:52:25.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74449 (GCVE-0-2026-74449)
Vulnerability from cvelistv5
Published
2026-08-15 12:26
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
If a plane reaches calculate_mcache_setting with a zero-area viewport,
calculate_mcache_setting exits early with num_mcaches == 0 and
mvmpg_width/height == 0. This will cause a divide-by-zero panic and can
also cause an underflow on num_mcaches.
Fix this by changing calculate_mcache_setting to bool and adding guards
after each calculate_mcache_row_bytes call. If num_mcaches or
mvmpg_width/height is zero, return a false. Callers will propagate the
failure as a rejected mode, which prevents the panic.
(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:56:48.300764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:46.407Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70f5f4ddba0d2d89e77ec13b79cdcfbef33be0d9",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "23a541c31b45fa813b33269376f6bd53535429a8",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "1f93537881fd22712732a60ad12572a3fd40c0ec",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "f327e389c07cfc3a2f6ff54f6214e1a52d457edc",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport\n\nIf a plane reaches calculate_mcache_setting with a zero-area viewport,\ncalculate_mcache_setting exits early with num_mcaches == 0 and\nmvmpg_width/height == 0. This will cause a divide-by-zero panic and can\nalso cause an underflow on num_mcaches.\n\nFix this by changing calculate_mcache_setting to bool and adding guards\nafter each calculate_mcache_row_bytes call. If num_mcaches or\nmvmpg_width/height is zero, return a false. Callers will propagate the\nfailure as a rejected mode, which prevents the panic.\n\n(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached during DRM atomic display validation on AMDGPU DCN4.x (dml21 path): userspace ioctl \u2192 amdgpu_dm atomic commit \u2192 dc_validate_global_state/dc_validate_with_context \u2192 dcn401/dcn42_validate_bandwidth \u2192 dml2_validate \u2192 dml21_validate \u2192 dml2_check_mode_supported \u2192 dml2_core_calcs_mode_support_ex \u2192 calculate_mcache_setting; no network or physical bus is involved.\nAC:L - An attacker with DRM card access can submit atomic commits that configure DCC-enabled planes and repeatedly probe scaler/viewport edge cases (including degenerate zero-area viewports or zero mvmpg dimensions) to reach calculate_mcache_setting; once triggered, num_mcaches==0 deterministically underflows loop bounds and causes divide-by-zero without races or uncontrollable heap layout.\nPR:L - Exploitation requires only standard local DRM display privileges to perform atomic modeset ioctl on /dev/dri/card* (typical for session-owning desktop users in the video/render group), not init-namespace root/CAP_SYS_ADMIN; user namespaces do not grant independent access to the host GPU display stack.\nUI:N - No victim interaction is required beyond the attacker issuing their own DRM atomic commit to configure a plane with DCC compression enabled; the kernel panic/corruption occurs during in-kernel DML bandwidth validation, not from another user opening files or mounting filesystems.\nS:U - The vulnerability corrupts kernel memory and can enable local privilege escalation within the same host kernel running the AMDGPU display driver; it does not cross a VM, IOMMU, or sandbox boundary such as KVM guest-to-host escape.\nC:H - When num_mcaches is zero, unsigned underflow in loop bounds (n \u003c *num_mcaches_l - 1) and indexing (mcache_offsets_l[*num_mcaches_l - 1]) performs massive out-of-bounds reads/writes past the fixed-size mcache_offsets arrays in kernel DML state, enabling disclosure of adjacent kernel heap memory rather than a pure crash with no data exposure.\nI:H - The same num_mcaches underflow drives unbounded out-of-bounds writes into mode_lib mcache offset arrays and related DML structures during calculate_mcache_setting, providing attacker-influenced kernel memory corruption primitives that could be leveraged for control-flow hijacking beyond a simple denial-of-service fault.\nA:H - The vulnerable path performs integer divide-by-zero on zero mvmpg_access_width/num_mcaches and executes out-of-bounds mcache offset writes, either of which can immediately trigger a kernel oops or panic during display mode validation, denying service to all users on affected AMD DCN4.x systems until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:40.556Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70f5f4ddba0d2d89e77ec13b79cdcfbef33be0d9"
},
{
"url": "https://git.kernel.org/stable/c/23a541c31b45fa813b33269376f6bd53535429a8"
},
{
"url": "https://git.kernel.org/stable/c/1f93537881fd22712732a60ad12572a3fd40c0ec"
},
{
"url": "https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc"
}
],
"title": "drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74449",
"datePublished": "2026-08-15T12:26:54.519Z",
"dateReserved": "2026-08-15T05:44:03.899Z",
"dateUpdated": "2026-10-21T12:45:40.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80761 (GCVE-0-2026-80761)
Vulnerability from cvelistv5
Published
2026-09-04 15:12
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: zero the sockaddr before returning it in getname
iso_sock_getname() fills a struct sockaddr_iso in place and returns its
size without clearing it first, so bytes it does not write are copied to
user space from the kernel stack. The getsockname(2) and getpeername(2)
paths both run through do_getsockname(), which hands getname() an
uninitialized sockaddr_storage on the stack and copies back up to the
number of bytes getname() returns, so the driver has to initialize every
byte it accounts for.
Two ranges are left uninitialized:
- struct sockaddr_iso is 10 bytes but only 9 are written (family,
iso_bdaddr, iso_bdaddr_type), leaking the trailing pad byte on every
call.
- for a broadcast peer (BIS_LINK or PA_LINK) the returned length grows
by sizeof(struct sockaddr_iso_bc), but only bc_sid, bc_num_bis and
bc_bis are filled; bc_bdaddr and bc_bdaddr_type, the first 7 bytes of
that structure, are never written.
An unprivileged process can open a BTPROTO_ISO socket and reach the pad
leak with getsockname(); the broadcast leak needs an established BIS/PA
connection. l2cap and rfcomm already memset their sockaddr in getname
for the same reason; do the same here.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a Version: ccf74f2390d60a2f9a75ef496d2564abb478f46a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "182d3ef350c437b1e4ae07e45f82e271e2033bd7",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "90be10604936c9042dc6238d8836abafca471811",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "554594d032aa4356ca4be75d0cb46e13d350dbd2",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "1f6d1f2611af0eb36b133a41d29ffd2cc2601615",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "9069be87c67f290783b332c4284e09fb89cb9ea7",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "190b719b787eb4ca6c25b12fab224806f9108b06",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
},
{
"lessThan": "884cf2cc957da7ac178a0e6c6c69ddfec0481cc8",
"status": "affected",
"version": "ccf74f2390d60a2f9a75ef496d2564abb478f46a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: zero the sockaddr before returning it in getname\n\niso_sock_getname() fills a struct sockaddr_iso in place and returns its\nsize without clearing it first, so bytes it does not write are copied to\nuser space from the kernel stack. The getsockname(2) and getpeername(2)\npaths both run through do_getsockname(), which hands getname() an\nuninitialized sockaddr_storage on the stack and copies back up to the\nnumber of bytes getname() returns, so the driver has to initialize every\nbyte it accounts for.\n\nTwo ranges are left uninitialized:\n\n - struct sockaddr_iso is 10 bytes but only 9 are written (family,\n iso_bdaddr, iso_bdaddr_type), leaking the trailing pad byte on every\n call.\n\n - for a broadcast peer (BIS_LINK or PA_LINK) the returned length grows\n by sizeof(struct sockaddr_iso_bc), but only bc_sid, bc_num_bis and\n bc_bis are filled; bc_bdaddr and bc_bdaddr_type, the first 7 bytes of\n that structure, are never written.\n\nAn unprivileged process can open a BTPROTO_ISO socket and reach the pad\nleak with getsockname(); the broadcast leak needs an established BIS/PA\nconnection. l2cap and rfcomm already memset their sockaddr in getname\nfor the same reason; do the same here."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:06.484Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/182d3ef350c437b1e4ae07e45f82e271e2033bd7"
},
{
"url": "https://git.kernel.org/stable/c/90be10604936c9042dc6238d8836abafca471811"
},
{
"url": "https://git.kernel.org/stable/c/554594d032aa4356ca4be75d0cb46e13d350dbd2"
},
{
"url": "https://git.kernel.org/stable/c/1f6d1f2611af0eb36b133a41d29ffd2cc2601615"
},
{
"url": "https://git.kernel.org/stable/c/9069be87c67f290783b332c4284e09fb89cb9ea7"
},
{
"url": "https://git.kernel.org/stable/c/190b719b787eb4ca6c25b12fab224806f9108b06"
},
{
"url": "https://git.kernel.org/stable/c/884cf2cc957da7ac178a0e6c6c69ddfec0481cc8"
}
],
"title": "Bluetooth: ISO: zero the sockaddr before returning it in getname",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80761",
"datePublished": "2026-09-04T15:12:33.345Z",
"dateReserved": "2026-08-26T14:34:25.791Z",
"dateUpdated": "2026-10-30T12:31:06.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68105 (GCVE-0-2026-68105)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix kernel panic during driver load failure
Avoid kernel panic if MES init fails during driver load. The KIQ ring is
falsely marked as ready as ASICs that use MES, KIQ is owned by MES.
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu]
Call Trace:
gfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu]
amdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu]
amdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu]
amdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu]
amdgpu_gart_unbind+0x72/0x90 [amdgpu]
amdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu]
amdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu]
amdttm_tt_unpopulate+0x29/0x70 [amdttm]
ttm_bo_put+0x1eb/0x360 [amdttm]
amdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu]
amdgpu_ih_ring_fini+0x5a/0x90 [amdgpu]
amdgpu_irq_fini_hw+0x58/0x80 [amdgpu]
amdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu]
amdgpu_driver_load_kms+0x60/0xa0 [amdgpu]
amdgpu_pci_probe+0x28e/0x6d0 [amdgpu]
pci_device_probe+0x19f/0x220
really_probe+0x1ed/0x340
driver_probe_device+0x1e/0x80
__driver_attach+0xd3/0x1a0
bus_for_each_dev+0x68/0xa0
bus_add_driver+0x19f/0x270
driver_register+0x5d/0xf0
do_one_initcall+0xac/0x200
do_init_module+0x1ec/0x280
__se_sys_finit_module+0x2de/0x310
do_syscall_64+0x6a/0x250
entry_SYSCALL_64_after_hwframe+0x4b/0x53
(cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c",
"drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b437e9b88b47fdf6d8d9d02651b8b56b9162de9a",
"status": "affected",
"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38",
"versionType": "git"
},
{
"lessThan": "f7e744bac9a720740a60d19319e8e5ed5e5c3c76",
"status": "affected",
"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38",
"versionType": "git"
},
{
"lessThan": "5bc93f907bad7e076d814664dfab8fc230efca3d",
"status": "affected",
"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38",
"versionType": "git"
},
{
"lessThan": "a279bd143b3c184358b658e43a057e31ee8c4de5",
"status": "affected",
"version": "52cb80c12e8a647aa9c903903d58916e6c1c4d38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c",
"drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix kernel panic during driver load failure\n\nAvoid kernel panic if MES init fails during driver load. The KIQ ring is\nfalsely marked as ready as ASICs that use MES, KIQ is owned by MES.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu]\nCall Trace:\n gfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu]\n amdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu]\n amdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu]\n amdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu]\n amdgpu_gart_unbind+0x72/0x90 [amdgpu]\n amdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu]\n amdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu]\n amdttm_tt_unpopulate+0x29/0x70 [amdttm]\n ttm_bo_put+0x1eb/0x360 [amdttm]\n amdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu]\n amdgpu_ih_ring_fini+0x5a/0x90 [amdgpu]\n amdgpu_irq_fini_hw+0x58/0x80 [amdgpu]\n amdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu]\n amdgpu_driver_load_kms+0x60/0xa0 [amdgpu]\n amdgpu_pci_probe+0x28e/0x6d0 [amdgpu]\n pci_device_probe+0x19f/0x220\n really_probe+0x1ed/0x340\n driver_probe_device+0x1e/0x80\n __driver_attach+0xd3/0x1a0\n bus_for_each_dev+0x68/0xa0\n bus_add_driver+0x19f/0x270\n driver_register+0x5d/0xf0\n do_one_initcall+0xac/0x200\n do_init_module+0x1ec/0x280\n __se_sys_finit_module+0x2de/0x310\n do_syscall_64+0x6a/0x250\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n(cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:29.891Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b437e9b88b47fdf6d8d9d02651b8b56b9162de9a"
},
{
"url": "https://git.kernel.org/stable/c/f7e744bac9a720740a60d19319e8e5ed5e5c3c76"
},
{
"url": "https://git.kernel.org/stable/c/5bc93f907bad7e076d814664dfab8fc230efca3d"
},
{
"url": "https://git.kernel.org/stable/c/a279bd143b3c184358b658e43a057e31ee8c4de5"
}
],
"title": "drm/amdgpu: Fix kernel panic during driver load failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68105",
"datePublished": "2026-08-10T11:58:22.101Z",
"dateReserved": "2026-07-30T09:28:09.368Z",
"dateUpdated": "2026-10-21T12:43:29.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38284 (GCVE-0-2025-38284)
Vulnerability from cvelistv5
Published
2025-07-10 07:42
Modified
2026-11-05 21:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: configure manual DAC mode via PCI config API only
To support 36-bit DMA, configure chip proprietary bit via PCI config API
or chip DBI interface. However, the PCI device mmap isn't set yet and
the DBI is also inaccessible via mmap, so only if the bit can be accessible
via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to
32-bit DMA.
With NULL mmap address, kernel throws trace:
BUG: unable to handle page fault for address: 0000000000001090
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: Oops: 0002 [#1] PREEMPT SMP PTI
CPU: 1 UID: 0 PID: 71 Comm: irq/26-pciehp Tainted: G OE 6.14.2-061402-generic #202504101348
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
RIP: 0010:rtw89_pci_ops_write16+0x12/0x30 [rtw89_pci]
RSP: 0018:ffffb0ffc0acf9d8 EFLAGS: 00010206
RAX: ffffffffc158f9c0 RBX: ffff94865e702020 RCX: 0000000000000000
RDX: 0000000000000718 RSI: 0000000000001090 RDI: ffff94865e702020
RBP: ffffb0ffc0acf9d8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015
R13: 0000000000000719 R14: ffffb0ffc0acfa1f R15: ffffffffc1813060
FS: 0000000000000000(0000) GS:ffff9486f3480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000001090 CR3: 0000000090440001 CR4: 00000000000626f0
Call Trace:
<TASK>
rtw89_pci_read_config_byte+0x6d/0x120 [rtw89_pci]
rtw89_pci_cfg_dac+0x5b/0xb0 [rtw89_pci]
rtw89_pci_probe+0xa96/0xbd0 [rtw89_pci]
? __pfx___device_attach_driver+0x10/0x10
? __pfx___device_attach_driver+0x10/0x10
local_pci_probe+0x47/0xa0
pci_call_probe+0x5d/0x190
pci_device_probe+0xa7/0x160
really_probe+0xf9/0x370
? pm_runtime_barrier+0x55/0xa0
__driver_probe_device+0x8c/0x140
driver_probe_device+0x24/0xd0
__device_attach_driver+0xcd/0x170
bus_for_each_drv+0x99/0x100
__device_attach+0xb4/0x1d0
device_attach+0x10/0x20
pci_bus_add_device+0x59/0x90
pci_bus_add_devices+0x31/0x80
pciehp_configure_device+0xaa/0x170
pciehp_enable_slot+0xd6/0x240
pciehp_handle_presence_or_link_change+0xf1/0x180
pciehp_ist+0x162/0x1c0
irq_thread_fn+0x24/0x70
irq_thread+0xef/0x1c0
? __pfx_irq_thread_fn+0x10/0x10
? __pfx_irq_thread_dtor+0x10/0x10
? __pfx_irq_thread+0x10/0x10
kthread+0xfc/0x230
? __pfx_kthread+0x10/0x10
ret_from_fork+0x47/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:53:06.851108Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:02:30.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7436f230c11acf64543dcb8c2ecbb3e9aa14fc22",
"status": "affected",
"version": "1fd4b3fe52efd5ad1647966f619c10988e7a4457",
"versionType": "git"
},
{
"lessThan": "e1e0f046041474004dc6ebce5ce1d3e86556291d",
"status": "affected",
"version": "1fd4b3fe52efd5ad1647966f619c10988e7a4457",
"versionType": "git"
},
{
"lessThan": "a70cf04b08f44f41bce14659aa7012674b15d9de",
"status": "affected",
"version": "1fd4b3fe52efd5ad1647966f619c10988e7a4457",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: configure manual DAC mode via PCI config API only\n\nTo support 36-bit DMA, configure chip proprietary bit via PCI config API\nor chip DBI interface. However, the PCI device mmap isn\u0027t set yet and\nthe DBI is also inaccessible via mmap, so only if the bit can be accessible\nvia PCI config API, chip can support 36-bit DMA. Otherwise, fallback to\n32-bit DMA.\n\nWith NULL mmap address, kernel throws trace:\n\n BUG: unable to handle page fault for address: 0000000000001090\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0002 [#1] PREEMPT SMP PTI\n CPU: 1 UID: 0 PID: 71 Comm: irq/26-pciehp Tainted: G OE 6.14.2-061402-generic #202504101348\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n RIP: 0010:rtw89_pci_ops_write16+0x12/0x30 [rtw89_pci]\n RSP: 0018:ffffb0ffc0acf9d8 EFLAGS: 00010206\n RAX: ffffffffc158f9c0 RBX: ffff94865e702020 RCX: 0000000000000000\n RDX: 0000000000000718 RSI: 0000000000001090 RDI: ffff94865e702020\n RBP: ffffb0ffc0acf9d8 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015\n R13: 0000000000000719 R14: ffffb0ffc0acfa1f R15: ffffffffc1813060\n FS: 0000000000000000(0000) GS:ffff9486f3480000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000001090 CR3: 0000000090440001 CR4: 00000000000626f0\n Call Trace:\n \u003cTASK\u003e\n rtw89_pci_read_config_byte+0x6d/0x120 [rtw89_pci]\n rtw89_pci_cfg_dac+0x5b/0xb0 [rtw89_pci]\n rtw89_pci_probe+0xa96/0xbd0 [rtw89_pci]\n ? __pfx___device_attach_driver+0x10/0x10\n ? __pfx___device_attach_driver+0x10/0x10\n local_pci_probe+0x47/0xa0\n pci_call_probe+0x5d/0x190\n pci_device_probe+0xa7/0x160\n really_probe+0xf9/0x370\n ? pm_runtime_barrier+0x55/0xa0\n __driver_probe_device+0x8c/0x140\n driver_probe_device+0x24/0xd0\n __device_attach_driver+0xcd/0x170\n bus_for_each_drv+0x99/0x100\n __device_attach+0xb4/0x1d0\n device_attach+0x10/0x20\n pci_bus_add_device+0x59/0x90\n pci_bus_add_devices+0x31/0x80\n pciehp_configure_device+0xaa/0x170\n pciehp_enable_slot+0xd6/0x240\n pciehp_handle_presence_or_link_change+0xf1/0x180\n pciehp_ist+0x162/0x1c0\n irq_thread_fn+0x24/0x70\n irq_thread+0xef/0x1c0\n ? __pfx_irq_thread_fn+0x10/0x10\n ? __pfx_irq_thread_dtor+0x10/0x10\n ? __pfx_irq_thread+0x10/0x10\n kthread+0xfc/0x230\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x47/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:57.962Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7436f230c11acf64543dcb8c2ecbb3e9aa14fc22"
},
{
"url": "https://git.kernel.org/stable/c/e1e0f046041474004dc6ebce5ce1d3e86556291d"
},
{
"url": "https://git.kernel.org/stable/c/a70cf04b08f44f41bce14659aa7012674b15d9de"
}
],
"title": "wifi: rtw89: pci: configure manual DAC mode via PCI config API only",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38284",
"datePublished": "2025-07-10T07:42:01.667Z",
"dateReserved": "2025-04-16T04:51:24.000Z",
"dateUpdated": "2026-11-05T21:02:30.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89987 (GCVE-0-2026-89987)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-30 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
zap_huge_pmd_folio() propagates the pmd young bit to the folio for the
file case, but not the dirty bit. The pte path does propagate it, in
zap_present_folio_ptes() and so does the pmd split path, in
__split_huge_pmd_locked().
For most file mappings the omission is harmless, because writing to a
shared file mapping goes through page_mkwrite(), which dirties the folio.
tmpfs is different: it has no page_mkwrite(), and vma_wants_writenotify()
is false for it, so a *read* fault on a MAP_SHARED tmpfs mapping installs
a writable pmd via do_read_fault(). do_read_fault() does not call
fault_dirty_shared_page(), so subsequent stores through that mapping set
only the hardware dirty bit in the pmd and never call folio_mark_dirty().
A shmem folio allocated by a fault is marked uptodate but not dirty (see
the clear: block in shmem_get_folio_gfp()), so PG_dirty is never set at
all.
Unmapping such a folio - munmap(), or exit_mmap() when the process dies -
then loses the only record that it was written, because zap_huge_pmd()
drops the pmd without transferring the dirty bit. Reclaim afterwards sees
a clean shmem folio: the whole swap-out block in shrink_folio_list() is
inside "if (folio_test_dirty(folio))", so pageout() is skipped and the
folio falls into __remove_mapping(). There, folio_is_file_lru() is false
for a swapbacked folio, so no shadow entry is created and
__filemap_remove_folio(folio, NULL) simply empties the i_pages slot. The
data is freed without ever being written to swap, and the next fault on
that index returns a freshly zeroed folio.
This is silent data loss for any process that keeps state in a MAP_SHARED
tmpfs segment across an unmap - for example a cache handed from one
process generation to the next through /dev/shm. It requires the folio to
be PMD-mapped, so it only shows up once shmem THP is enabled (which is
what we did in Meta fleet and started noticing crashes); with THP off the
pte path transfers the dirty bit correctly. It also only becomes visible
when swap is enabled, because with no swap device shmem folios (which are
on the anon LRU) are not scanned by reclaim at all, so the clean folio is
never dropped.
Reproduced on x86_64 with a tmpfs mounted huge=within_size: read-fault a
2MB-backed region, write a known pattern through the resulting mapping,
munmap, force reclaim of the cgroup, then re-map and read back. Without
this patch the region reads back as zeros and vmstat shows zswpout 0 - the
data was discarded rather than swapped. With this patch the region reads
back correctly and the pages are swapped out as expected. With
huge=never, or when the first touch is a write, the test passes either
way.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e Version: b5072380eb619786990cd9eab3ade05d09ccd89e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79d8c89baa10612c1675972a632c65cdbe0936f6",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "13f4910d81b62a214cdb28b47237198fa96078a2",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "7a4c3f7b47ba34b021a7747081f330bfb76a4271",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "6e904f9e8cb0e39f60e1cdbea679f89346a563c2",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "fd720d3906877b3d2118cd480027e4bc6648f0c5",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "effe3cc6d4fdd407457eb30f7b0ef094393f0d64",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "9435cddf1378d149d826bd7bd1448a44bf96868d",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
},
{
"lessThan": "fe6cf984939d8e12cb33a99673c8d026c5135e68",
"status": "affected",
"version": "b5072380eb619786990cd9eab3ade05d09ccd89e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: transfer the pmd dirty bit to the folio on zap\n\nzap_huge_pmd_folio() propagates the pmd young bit to the folio for the\nfile case, but not the dirty bit. The pte path does propagate it, in\nzap_present_folio_ptes() and so does the pmd split path, in\n__split_huge_pmd_locked().\n\nFor most file mappings the omission is harmless, because writing to a\nshared file mapping goes through page_mkwrite(), which dirties the folio. \ntmpfs is different: it has no page_mkwrite(), and vma_wants_writenotify()\nis false for it, so a *read* fault on a MAP_SHARED tmpfs mapping installs\na writable pmd via do_read_fault(). do_read_fault() does not call\nfault_dirty_shared_page(), so subsequent stores through that mapping set\nonly the hardware dirty bit in the pmd and never call folio_mark_dirty(). \nA shmem folio allocated by a fault is marked uptodate but not dirty (see\nthe clear: block in shmem_get_folio_gfp()), so PG_dirty is never set at\nall.\n\nUnmapping such a folio - munmap(), or exit_mmap() when the process dies -\nthen loses the only record that it was written, because zap_huge_pmd()\ndrops the pmd without transferring the dirty bit. Reclaim afterwards sees\na clean shmem folio: the whole swap-out block in shrink_folio_list() is\ninside \"if (folio_test_dirty(folio))\", so pageout() is skipped and the\nfolio falls into __remove_mapping(). There, folio_is_file_lru() is false\nfor a swapbacked folio, so no shadow entry is created and\n__filemap_remove_folio(folio, NULL) simply empties the i_pages slot. The\ndata is freed without ever being written to swap, and the next fault on\nthat index returns a freshly zeroed folio.\n\nThis is silent data loss for any process that keeps state in a MAP_SHARED\ntmpfs segment across an unmap - for example a cache handed from one\nprocess generation to the next through /dev/shm. It requires the folio to\nbe PMD-mapped, so it only shows up once shmem THP is enabled (which is\nwhat we did in Meta fleet and started noticing crashes); with THP off the\npte path transfers the dirty bit correctly. It also only becomes visible\nwhen swap is enabled, because with no swap device shmem folios (which are\non the anon LRU) are not scanned by reclaim at all, so the clean folio is\nnever dropped.\n\nReproduced on x86_64 with a tmpfs mounted huge=within_size: read-fault a\n2MB-backed region, write a known pattern through the resulting mapping,\nmunmap, force reclaim of the cgroup, then re-map and read back. Without\nthis patch the region reads back as zeros and vmstat shows zswpout 0 - the\ndata was discarded rather than swapped. With this patch the region reads\nback correctly and the pages are swapped out as expected. With\nhuge=never, or when the first touch is a write, the test passes either\nway."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:33:41.932Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79d8c89baa10612c1675972a632c65cdbe0936f6"
},
{
"url": "https://git.kernel.org/stable/c/13f4910d81b62a214cdb28b47237198fa96078a2"
},
{
"url": "https://git.kernel.org/stable/c/7a4c3f7b47ba34b021a7747081f330bfb76a4271"
},
{
"url": "https://git.kernel.org/stable/c/6e904f9e8cb0e39f60e1cdbea679f89346a563c2"
},
{
"url": "https://git.kernel.org/stable/c/fd720d3906877b3d2118cd480027e4bc6648f0c5"
},
{
"url": "https://git.kernel.org/stable/c/effe3cc6d4fdd407457eb30f7b0ef094393f0d64"
},
{
"url": "https://git.kernel.org/stable/c/9435cddf1378d149d826bd7bd1448a44bf96868d"
},
{
"url": "https://git.kernel.org/stable/c/fe6cf984939d8e12cb33a99673c8d026c5135e68"
}
],
"title": "mm/huge_memory: transfer the pmd dirty bit to the folio on zap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89987",
"datePublished": "2026-09-16T10:33:02.270Z",
"dateReserved": "2026-09-11T19:38:34.779Z",
"dateUpdated": "2026-10-30T12:33:41.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68470 (GCVE-0-2026-68470)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: validate extension-frame layout before RX
Extension frames only have the extension header at the regular 802.11
header offset. The generic RX path can still reach helpers and interface
dispatch code that read regular header address fields before unsupported
extension subtypes are dropped.
mac80211 currently only handles S1G beacon extension frames. Drop other
extension subtypes before they can reach regular-header RX processing.
For S1G beacons, linearize the SKB with the management-frame path and
require the fixed S1G beacon header, including optional fixed fields
indicated by frame control, before generic RX dispatch.
Route S1G beacons through the station/default-link RX path without
regular-header station lookup. Avoid regular-header address reads in the
mac80211 RX paths that process S1G extension beacons, including
accept-frame, duplicate-detection, address-copy, and MLO
address-translation paths.
Also make ieee80211_get_bssid() length-safe before returning the S1G
source-address pointer.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68470",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:31.046994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:11.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c",
"net/mac80211/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7aba69b611007e11b9b93118ff8fe88998c3107f",
"status": "affected",
"version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
"versionType": "git"
},
{
"lessThan": "1c3d9c6bd5b795f3b952b40d574c8e424e14a39b",
"status": "affected",
"version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
"versionType": "git"
},
{
"lessThan": "625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed",
"status": "affected",
"version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
"versionType": "git"
},
{
"lessThan": "57d503ce32eccfa7650065ca4c560f7e29a2e676",
"status": "affected",
"version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c",
"net/mac80211/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Malformed 802.11 extension/S1G frames reach mac80211 via the normal WiFi RX path (driver -\u003e ieee80211_rx_list -\u003e __ieee80211_rx_handle_packet); an attacker within radio range can inject frames over the air without routing through the Internet.\nAC:L - The attacker fully controls crafted extension-frame length, subtype, and frame-control flags; only 4 bytes are validated before code reads up to 24 bytes of presumed 802.11 addresses, so triggering the bug is reliable and does not depend on victim-specific timing or memory layout.\nPR:N - Exploitation requires only transmitting WiFi frames to a victim with an active mac80211 interface; no local account, capability, or association/authentication is needed because vulnerable header parsing runs before extension subtype filtering and RX handler dispatch.\nUI:N - The victim does not need to click links, join networks, or perform any deliberate action beyond having WiFi enabled; passive reception of attacker-injected extension frames on AP, STA, or mesh interfaces is sufficient to reach the vulnerable code.\nS:U - Impact is confined to kernel mac80211 RX processing on the receiving host (OOB skb reads/writes and possible crash/privilege escalation); it does not cross a VM, container, or IOMMU security boundary into another authority.\nC:H - Pre-fix code reads regular-header addr1/addr2/addr3/seq_ctrl and copies 18 bytes of addrs on extension frames whose layout differs and may be shorter than 24 bytes, causing out-of-bounds reads and disclosure of adjacent skb/heap memory via ieee80211_get_bssid(), accept-frame, duplicate detection, and MLO prep paths.\nI:H - ieee80211_prepare_and_rx_handle can perform ether_addr_copy() MLO address translation on S1G/extension frames because ieee80211_is_beacon() is false for FTYPE_EXT, writing attacker-influenced MAC bytes into wrong skb offsets and enabling memory corruption that could be developed into arbitrary kernel write/code execution.\nA:H - Out-of-bounds access while parsing short or malformed extension frames can provoke kernel oops/panic or destabilize RX processing; even failed exploitation still enables repeatable remote DoS against any reachable WiFi interface by retransmitting malicious extension frames."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:15.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7aba69b611007e11b9b93118ff8fe88998c3107f"
},
{
"url": "https://git.kernel.org/stable/c/1c3d9c6bd5b795f3b952b40d574c8e424e14a39b"
},
{
"url": "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed"
},
{
"url": "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"
}
],
"title": "wifi: mac80211: validate extension-frame layout before RX",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68470",
"datePublished": "2026-08-15T05:51:28.211Z",
"dateReserved": "2026-07-30T09:28:09.396Z",
"dateUpdated": "2026-10-21T12:44:15.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53091 (GCVE-0-2026-53091)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdisc_pkt_len_segs_init()
Most ndo_start_xmit() methods expects headers of gso packets
to be already in skb->head.
net/core/tso.c users are particularly at risk, because tso_build_hdr()
does a memcpy(hdr, skb->data, hdr_len);
qdisc_pkt_len_segs_init() already does a dissection of gso packets.
Use pskb_may_pull() instead of skb_header_pointer() to make
sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can
drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.53.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.162.1.rt7.503.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.162.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s handling of Generic Segmentation Offload (GSO) packet headers. This vulnerability occurs when the `qdisc_pkt_len_segs_init()` function does not properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. A remote attacker could exploit this by sending specially crafted malicious packets, potentially causing a denial of service (DoS) or other unexpected system behavior."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T12:04:34.429Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53091"
},
{
"name": "RHBZ#2492270",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492270"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65334"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67150"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66325"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66324"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:67150: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:66325: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:66324: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net: pull headers in qdisc_pkt_len_segs_init()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:25:34.531794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131 Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:24.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/dropreason-core.h",
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5895cfc76924a629c6eaa5e5f049de642860045f",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
},
{
"lessThan": "7564dc804d8289d2e5c6edb8173754051b71bff4",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
},
{
"lessThan": "9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
},
{
"lessThan": "7fb4c19670110f052c04e1ec1d2b953b9f4f57e4",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/dropreason-core.h",
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pull headers in qdisc_pkt_len_segs_init()\n\nMost ndo_start_xmit() methods expects headers of gso packets\nto be already in skb-\u003ehead.\n\nnet/core/tso.c users are particularly at risk, because tso_build_hdr()\ndoes a memcpy(hdr, skb-\u003edata, hdr_len);\n\nqdisc_pkt_len_segs_init() already does a dissection of gso packets.\n\nUse pskb_may_pull() instead of skb_header_pointer() to make\nsure drivers do not have to reimplement this.\n\nSome malicious packets could be fed, detect them so that we can\ndrop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local transmit paths such as AF_PACKET, TUN/TAP, or guest virtio/tap injection where an attacker can supply GSO metadata. Ordinary remote packets do not carry this malformed skb/GSO state on the wire.\nAC:L - No race or external timing condition is required. The attacker controls the GSO header metadata and packet layout needed to make qdisc accept a header that later TX code expects to be linear.\nPR:L - AF_PACKET requires CAP_NET_RAW in the target network namespace, and TUN/TAP style paths require CAP_NET_ADMIN or access to an existing tap/tun file descriptor. These are reachable as low privilege in user-namespace or guest/tap deployments rather than requiring init-namespace root in the highest reasonable scenario.\nUI:N - No victim user action is needed once the attacker can inject the crafted local/guest packet. The transmit path processes the skb automatically.\nS:C - In virtualization deployments, a guest-controlled GSO packet can be processed by the host kernel tap/vhost transmit path and affect host kernel memory or availability. That crosses the guest-to-host security boundary.\nC:H - TSO helpers copy header bytes directly from skb-\u003edata, so a header accepted via skb_header_pointer() but not pulled into skb-\u003ehead can leak adjacent kernel memory into transmitted segment headers. This is an out-of-bounds kernel read and is scored High.\nI:N - The investigated primitive is incorrect header linearity causing out-of-bounds reads and crashes, not a demonstrated attacker-controlled write or protected data modification. I did not find a reliable integrity-impacting write primitive from this fix.\nA:H - Malformed GSO packets can trigger kernel faults or invalid driver/TSO behavior during transmit, including panics reported for this issue. Repeated local injection can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:56.505Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5895cfc76924a629c6eaa5e5f049de642860045f"
},
{
"url": "https://git.kernel.org/stable/c/7564dc804d8289d2e5c6edb8173754051b71bff4"
},
{
"url": "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a"
},
{
"url": "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"
}
],
"title": "net: pull headers in qdisc_pkt_len_segs_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53091",
"datePublished": "2026-06-24T16:30:30.290Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-10-21T12:41:56.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98981 (GCVE-0-2026-98981)
Vulnerability from cvelistv5
Published
2026-10-23 12:19
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
namespace: unhash a dentry before detaching the mounts on it
unlink(), rmdir() and rename() remove the entry from the filesystem,
call detach_mounts() on the entry with the inode locked and then call
d_delete() once the inode is unlocked.
The thing is that between detach_mounts() and d_delete() the dentry is
still hashed and positive. But after detach_mounts() nothing covers the
dentry anymore. A lookup that finds this dentry in the dcache can
uncover what the mounts hid.
That's a problem when unlinking files or directories that are
mountpoints in other mount namespaces. Everybody who had the underlying
entry covered can race the detach_mount() call until d_delete() has run.
The race window isn't all that small. It encompasses namespace_unlock()
with a full synchronize_rcu_expedited() grace period and the
inode_unlock() of the entry.
In my experiments three walkers that kept trying read an overmounted
file in 11938 of the 16140 unlinks that removed its mountpoint from a
bind mount of the filesystem within a minute.
Fun fact, d_invalidate() has the same ordering problem but gets it
right. It unhashes the dentry first and detaches the mounts afterwards.
Let's do the same in __detach_mounts():
- A lookup that hasn't found the dentry yet misses it in the dcache and
waits for the directory lock that the caller holds until the name is
gone for good.
- A lockless lookup that found it already fails the mount_lock check
while the dentry still counts as a mountpoint and the d_seq check once
it doesn't, and retries.
This fixes the lockless path. We still need to fix the reference count
lookup in a follow-up patch.
So d_drop() the dentry. The dentry stays positive and held but can't be
found anymore. Then proceed with the detach and unlink.
Reproducer:
The reads were counted with the program below, three walkers for 60 s
in a VM with 4 CPUs. The race window is stretched with the debug patch
pasted here. fs.detach_race_walk_us sleeps in lookup_fast() once it
found a mountpoint dentry and before its mounts are crossed.
fs.detach_race_unlink_us sleeps in vfs_unlink() between detach_mounts()
and d_delete().
// SPDX-License-Identifier: GPL-2.0
/*
* unlink_covered: unlink a file that is a mountpoint in a detached copy of
* its mount, against lookups that open it through that copy.
*
* A is a tmpfs with the file f1 (content SECRET_F) and the plain file
* MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound
* on A'/f1, held through an O_PATH fd on its root once the tree fd is
* closed. Walkers open f1 through that fd while the driver unlinks A/f1,
* where nothing is mounted on it. A walker may read MARK_A or get ENOENT.
* A read of SECRET_F is a hit: the name was found after its mount was
* gone. The lockless walks use openat2(RESOLVE_CACHED).
*
* usage: unlink_covered [-t seconds] [-w walkers]
*/
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <stdatomic.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <linux/openat2.h>
#ifndef __NR_open_tree
#define __NR_open_tree 428
#endif
#ifndef __NR_move_mount
#define __NR_move_mount 429
#endif
#ifndef __NR_openat2
#define __NR_openat2 437
#endif
#ifndef OPEN_TREE_CLONE
#define OPEN_TREE_CLONE 1
#endif
#ifndef OPEN_TREE_CLOEXEC
#define OPEN_TREE_CLOEXEC O_CLOEXEC
#endif
#ifndef MOVE_MOUNT_F_EMPTY_PATH
#define MOVE_MOUNT_F_EMPTY_PATH 0x00000004
#endif
#define WORK "/tmp/uc"
#define ADIR WORK "/A"
static int duration = 60, nwalkers = 3;
static atomic_int stop, writer_waiting;
static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;
static int cur_fd = -1; /* the root of A', -1 wh
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe Version: 8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3fa3811ffffa130586c4ff8f7299b7fc69216d5",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "97cc290c57ea04337fd33912d780367add41525c",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "bb917ec497f6099c6cb9375596e085a5f6b52ff2",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "db90eecbde319527aa9480c039d32a0f5fe80574",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "8d71bfc9b3fc15d7103e82ea9dc5057541866e46",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "d29cd99db3db74cf3447be74d25740981789d461",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "8300de4aa5d09061bfcf2af5b52c0cdba3873185",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
},
{
"lessThan": "528b383dc35d1e5caf64ddf5d35f983ae543b0d0",
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: unhash a dentry before detaching the mounts on it\n\nunlink(), rmdir() and rename() remove the entry from the filesystem,\ncall detach_mounts() on the entry with the inode locked and then call\nd_delete() once the inode is unlocked.\n\nThe thing is that between detach_mounts() and d_delete() the dentry is\nstill hashed and positive. But after detach_mounts() nothing covers the\ndentry anymore. A lookup that finds this dentry in the dcache can\nuncover what the mounts hid.\n\nThat\u0027s a problem when unlinking files or directories that are\nmountpoints in other mount namespaces. Everybody who had the underlying\nentry covered can race the detach_mount() call until d_delete() has run.\n\nThe race window isn\u0027t all that small. It encompasses namespace_unlock()\nwith a full synchronize_rcu_expedited() grace period and the\ninode_unlock() of the entry.\n\nIn my experiments three walkers that kept trying read an overmounted\nfile in 11938 of the 16140 unlinks that removed its mountpoint from a\nbind mount of the filesystem within a minute.\n\nFun fact, d_invalidate() has the same ordering problem but gets it\nright. It unhashes the dentry first and detaches the mounts afterwards.\nLet\u0027s do the same in __detach_mounts():\n\n- A lookup that hasn\u0027t found the dentry yet misses it in the dcache and\n waits for the directory lock that the caller holds until the name is\n gone for good.\n\n- A lockless lookup that found it already fails the mount_lock check\n while the dentry still counts as a mountpoint and the d_seq check once\n it doesn\u0027t, and retries.\n\nThis fixes the lockless path. We still need to fix the reference count\nlookup in a follow-up patch.\n\nSo d_drop() the dentry. The dentry stays positive and held but can\u0027t be\nfound anymore. Then proceed with the detach and unlink.\n\nReproducer:\n\nThe reads were counted with the program below, three walkers for 60 s\nin a VM with 4 CPUs. The race window is stretched with the debug patch\npasted here. fs.detach_race_walk_us sleeps in lookup_fast() once it\nfound a mountpoint dentry and before its mounts are crossed.\nfs.detach_race_unlink_us sleeps in vfs_unlink() between detach_mounts()\nand d_delete().\n\n // SPDX-License-Identifier: GPL-2.0\n /*\n * unlink_covered: unlink a file that is a mountpoint in a detached copy of\n * its mount, against lookups that open it through that copy.\n *\n * A is a tmpfs with the file f1 (content SECRET_F) and the plain file\n * MARK_A. A\u0027 is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound\n * on A\u0027/f1, held through an O_PATH fd on its root once the tree fd is\n * closed. Walkers open f1 through that fd while the driver unlinks A/f1,\n * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.\n * A read of SECRET_F is a hit: the name was found after its mount was\n * gone. The lockless walks use openat2(RESOLVE_CACHED).\n *\n * usage: unlink_covered [-t seconds] [-w walkers]\n */\n #ifndef _GNU_SOURCE\n #define _GNU_SOURCE\n #endif\n #include \u003cerrno.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003cpthread.h\u003e\n #include \u003cstdatomic.h\u003e\n #include \u003cstdio.h\u003e\n #include \u003cstdlib.h\u003e\n #include \u003cstring.h\u003e\n #include \u003cunistd.h\u003e\n #include \u003csys/mount.h\u003e\n #include \u003csys/stat.h\u003e\n #include \u003csys/syscall.h\u003e\n #include \u003clinux/openat2.h\u003e\n\n #ifndef __NR_open_tree\n #define __NR_open_tree 428\n #endif\n #ifndef __NR_move_mount\n #define __NR_move_mount 429\n #endif\n #ifndef __NR_openat2\n #define __NR_openat2 437\n #endif\n #ifndef OPEN_TREE_CLONE\n #define OPEN_TREE_CLONE 1\n #endif\n #ifndef OPEN_TREE_CLOEXEC\n #define OPEN_TREE_CLOEXEC O_CLOEXEC\n #endif\n #ifndef MOVE_MOUNT_F_EMPTY_PATH\n #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004\n #endif\n\n #define WORK \"/tmp/uc\"\n #define ADIR WORK \"/A\"\n\n static int duration = 60, nwalkers = 3;\n static atomic_int stop, writer_waiting;\n static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;\n static int cur_fd = -1;\t\t/* the root of A\u0027, -1 wh\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger uses local unlinkat(), rmdir(), or renameat2() into vfs_unlink(), vfs_rmdir(), or vfs_rename(), which call the patched __detach_mounts(), while a concurrent openat2() path walk races the detach; no network data reaches this path.\nAC:L - The attacker controls both sides by unlinking the underlying entry while concurrent lookup_fast() walkers open it through the covered mount; the reproducer obtained 11,938 disclosures in 16,140 unlinks.\nPR:L - may_delete_dentry() requires ordinary write and execute permission on the parent, while may_mount() uses CAP_SYS_ADMIN in the mount namespace\u0027s user namespace; an unprivileged user can obtain that capability with a new user/mount namespace and mount tmpfs because it has FS_USERNS_MOUNT.\nUI:N - The attacker creates the mount arrangement and directly drives both the removal syscall and concurrent openat2() calls; no separate victim action is required.\nS:C - __detach_mounts() removes mounts attached to the shared dentry across namespaces, allowing a walk in the covered A\u0027 namespace to reach the underlying A object. This crosses the mount-namespace isolation boundary the covering mount enforced.\nC:H - The stale positive dentry accepted by lookup_fast() and step_into() can be opened and read after its covering mount disappears; the reproducer reads the complete SECRET_F contents rather than a bounded metadata fragment.\nI:H - The incorrectly uncovered dentry proceeds to do_open(), where may_open() permits O_WRONLY under normal inode permissions and O_TRUNC reaches handle_truncate(); thus a mount-hidden writable object, or the target of an uncovered symlink, can be modified or erased.\nA:H - A stale covered symlink can reach pick_link() and resolve a persistent target, after which do_open() can invoke handle_truncate() for O_TRUNC. Erasing a mount-hidden critical file can cause complete loss of the dependent resource or service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:41.226Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3fa3811ffffa130586c4ff8f7299b7fc69216d5"
},
{
"url": "https://git.kernel.org/stable/c/97cc290c57ea04337fd33912d780367add41525c"
},
{
"url": "https://git.kernel.org/stable/c/bb917ec497f6099c6cb9375596e085a5f6b52ff2"
},
{
"url": "https://git.kernel.org/stable/c/db90eecbde319527aa9480c039d32a0f5fe80574"
},
{
"url": "https://git.kernel.org/stable/c/8d71bfc9b3fc15d7103e82ea9dc5057541866e46"
},
{
"url": "https://git.kernel.org/stable/c/d29cd99db3db74cf3447be74d25740981789d461"
},
{
"url": "https://git.kernel.org/stable/c/8300de4aa5d09061bfcf2af5b52c0cdba3873185"
},
{
"url": "https://git.kernel.org/stable/c/528b383dc35d1e5caf64ddf5d35f983ae543b0d0"
}
],
"title": "namespace: unhash a dentry before detaching the mounts on it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98981",
"datePublished": "2026-10-23T12:19:58.507Z",
"dateReserved": "2026-09-25T10:25:14.384Z",
"dateUpdated": "2026-10-30T12:40:41.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53377 (GCVE-0-2026-53377)
Vulnerability from cvelistv5
Published
2026-07-19 10:02
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: always recover the gpu
Previously, in case there was no more work to do, recover worker
wouldn't trigger recovery and would instead rely on the gpu going to
sleep and then resuming when more work is submitted.
Recover_worker will first increment the fence of the hung ring so, if
there's only one job submitted to a ring and that causes an hang, it
will early out.
There's no guarantee that the gpu will suspend and resume before more
work is submitted and if the gpu is in a hung state it will stay in that
state and probably trigger a timeout again.
Just stop checking and always recover the gpu.
Patchwork: https://patchwork.freedesktop.org/patch/704066/
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8af219d18502c52319df8d4e3dcfe29a3ca31ab Version: c8af219d18502c52319df8d4e3dcfe29a3ca31ab Version: c8af219d18502c52319df8d4e3dcfe29a3ca31ab Version: c8af219d18502c52319df8d4e3dcfe29a3ca31ab Version: c8af219d18502c52319df8d4e3dcfe29a3ca31ab Version: c8af219d18502c52319df8d4e3dcfe29a3ca31ab |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8410426e46a8449a3734b037286cbafe0110033",
"status": "affected",
"version": "c8af219d18502c52319df8d4e3dcfe29a3ca31ab",
"versionType": "git"
},
{
"lessThan": "01930f94b8b13400f3346044cacf98f01d337f3d",
"status": "affected",
"version": "c8af219d18502c52319df8d4e3dcfe29a3ca31ab",
"versionType": "git"
},
{
"lessThan": "1c0034c1a614a118acbb4bdf7ab51490ee919ad2",
"status": "affected",
"version": "c8af219d18502c52319df8d4e3dcfe29a3ca31ab",
"versionType": "git"
},
{
"lessThan": "132b8d51f0ffbee6e4e1ebbe1a50330aaf2dbd5d",
"status": "affected",
"version": "c8af219d18502c52319df8d4e3dcfe29a3ca31ab",
"versionType": "git"
},
{
"lessThan": "2f5c90478749dfd9a32386100b6078a364298b01",
"status": "affected",
"version": "c8af219d18502c52319df8d4e3dcfe29a3ca31ab",
"versionType": "git"
},
{
"lessThan": "01a0d6cd7032e9993feea19fadb03ef9d5b488f2",
"status": "affected",
"version": "c8af219d18502c52319df8d4e3dcfe29a3ca31ab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: always recover the gpu\n\nPreviously, in case there was no more work to do, recover worker\nwouldn\u0027t trigger recovery and would instead rely on the gpu going to\nsleep and then resuming when more work is submitted.\n\nRecover_worker will first increment the fence of the hung ring so, if\nthere\u0027s only one job submitted to a ring and that causes an hang, it\nwill early out.\n\nThere\u0027s no guarantee that the gpu will suspend and resume before more\nwork is submitted and if the gpu is in a hung state it will stay in that\nstate and probably trigger a timeout again.\n\nJust stop checking and always recover the gpu.\n\nPatchwork: https://patchwork.freedesktop.org/patch/704066/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:06.437Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8410426e46a8449a3734b037286cbafe0110033"
},
{
"url": "https://git.kernel.org/stable/c/01930f94b8b13400f3346044cacf98f01d337f3d"
},
{
"url": "https://git.kernel.org/stable/c/1c0034c1a614a118acbb4bdf7ab51490ee919ad2"
},
{
"url": "https://git.kernel.org/stable/c/132b8d51f0ffbee6e4e1ebbe1a50330aaf2dbd5d"
},
{
"url": "https://git.kernel.org/stable/c/2f5c90478749dfd9a32386100b6078a364298b01"
},
{
"url": "https://git.kernel.org/stable/c/01a0d6cd7032e9993feea19fadb03ef9d5b488f2"
}
],
"title": "drm/msm: always recover the gpu",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53377",
"datePublished": "2026-07-19T10:02:00.168Z",
"dateReserved": "2026-06-09T07:44:35.401Z",
"dateUpdated": "2026-10-30T12:27:06.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68318 (GCVE-0-2025-68318)
Vulnerability from cvelistv5
Published
2025-12-16 15:39
Modified
2026-10-21 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
The AXI crossbar of TH1520 has no proper timeout handling, which means
gating AXI clocks can easily lead to bus timeout and thus system hang.
Set all AXI clock gates to CLK_IS_CRITICAL. All these clock gates are
ungated by default on system reset.
In addition, convert all current CLK_IGNORE_UNUSED usage to
CLK_IS_CRITICAL to prevent unwanted clock gating.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/thead/clk-th1520-ap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d816c00bb69fb2eecd3fccac067857f3a0dbc44e",
"status": "affected",
"version": "ae81b69fd2b1eb4885b352749b1fd1172e2f0f18",
"versionType": "git"
},
{
"lessThan": "bdec5e01fc2f3114d1fb1daeb1000911d783c4ae",
"status": "affected",
"version": "ae81b69fd2b1eb4885b352749b1fd1172e2f0f18",
"versionType": "git"
},
{
"lessThan": "c567bc5fc68c4388c00e11fc65fd14fe86b52070",
"status": "affected",
"version": "ae81b69fd2b1eb4885b352749b1fd1172e2f0f18",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/thead/clk-th1520-ap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL\n\nThe AXI crossbar of TH1520 has no proper timeout handling, which means\ngating AXI clocks can easily lead to bus timeout and thus system hang.\n\nSet all AXI clock gates to CLK_IS_CRITICAL. All these clock gates are\nungated by default on system reset.\n\nIn addition, convert all current CLK_IGNORE_UNUSED usage to\nCLK_IS_CRITICAL to prevent unwanted clock gating."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:38:11.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d816c00bb69fb2eecd3fccac067857f3a0dbc44e"
},
{
"url": "https://git.kernel.org/stable/c/bdec5e01fc2f3114d1fb1daeb1000911d783c4ae"
},
{
"url": "https://git.kernel.org/stable/c/c567bc5fc68c4388c00e11fc65fd14fe86b52070"
}
],
"title": "clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68318",
"datePublished": "2025-12-16T15:39:47.965Z",
"dateReserved": "2025-12-16T14:48:05.295Z",
"dateUpdated": "2026-10-21T12:38:11.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63999 (GCVE-0-2026-63999)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
rss_prepare_get() allocates the indirection table and hash key buffer
via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them.
If get_rxfh() fails, the function returns an error without freeing
the allocation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c5ed0eaddcbda56079091fc3876b140a6e70a548 Version: a065b996052656a65afc51ad82336dc55ae4c72f Version: 4f038a6a02d20859a3479293cbf172b0f14cbdd6 Version: 4f038a6a02d20859a3479293cbf172b0f14cbdd6 Version: 4f038a6a02d20859a3479293cbf172b0f14cbdd6 Version: 81a5174e64ce4fb7b7a2f6499b835c904c9451ee Version: ec9faff49a4ea27731de39cb887b7e590e93157b Version: adee9db710a6117b978a25ed4153846b7c56ec9a Version: 5eb3fdc4b6281b29e830300c866a36d90442b1f0 Version: 6.6.88 ≤ Version: 6.12.24 ≤ Version: 5.15.181 ≤ Version: 6.1.135 ≤ Version: 6.13.12 ≤ Version: 6.14.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ethtool/rss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14dbf22c397b799b3a80f63fc90c2fc0585bbeb3",
"status": "affected",
"version": "c5ed0eaddcbda56079091fc3876b140a6e70a548",
"versionType": "git"
},
{
"lessThan": "323faef6366349f57d4ad67d318a0c8906e360b3",
"status": "affected",
"version": "a065b996052656a65afc51ad82336dc55ae4c72f",
"versionType": "git"
},
{
"lessThan": "33d05c22d6f227c5ae171c46df2f6f8bf48047ea",
"status": "affected",
"version": "4f038a6a02d20859a3479293cbf172b0f14cbdd6",
"versionType": "git"
},
{
"lessThan": "80d95d92f828cfcace955d673637d944178b435f",
"status": "affected",
"version": "4f038a6a02d20859a3479293cbf172b0f14cbdd6",
"versionType": "git"
},
{
"lessThan": "266297692f97008ca48bc311775c087c59bd7fe3",
"status": "affected",
"version": "4f038a6a02d20859a3479293cbf172b0f14cbdd6",
"versionType": "git"
},
{
"status": "affected",
"version": "81a5174e64ce4fb7b7a2f6499b835c904c9451ee",
"versionType": "git"
},
{
"status": "affected",
"version": "ec9faff49a4ea27731de39cb887b7e590e93157b",
"versionType": "git"
},
{
"status": "affected",
"version": "adee9db710a6117b978a25ed4153846b7c56ec9a",
"versionType": "git"
},
{
"status": "affected",
"version": "5eb3fdc4b6281b29e830300c866a36d90442b1f0",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.114",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ethtool/rss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: rss: fix indir_table and hkey leak on get_rxfh failure\n\nrss_prepare_get() allocates the indirection table and hash key buffer\nvia rss_get_data_alloc(), then calls ops-\u003eget_rxfh() to populate them.\nIf get_rxfh() fails, the function returns an error without freeing\nthe allocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:52.556Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14dbf22c397b799b3a80f63fc90c2fc0585bbeb3"
},
{
"url": "https://git.kernel.org/stable/c/323faef6366349f57d4ad67d318a0c8906e360b3"
},
{
"url": "https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea"
},
{
"url": "https://git.kernel.org/stable/c/80d95d92f828cfcace955d673637d944178b435f"
},
{
"url": "https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"
}
],
"title": "ethtool: rss: fix indir_table and hkey leak on get_rxfh failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63999",
"datePublished": "2026-07-19T14:56:17.383Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-21T12:42:52.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68242 (GCVE-0-2026-68242)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
Avoid using intel_context_put() before intel_context_init() in
execlists_create_virtual() as the kref_put() inside would lead
to NULL deref on the IOCTL path when sched_engine allocation fails.
Discovered using AI-assisted static analysis confirmed by
Intel Product Security.
(cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3e28d37146db5dd49c469bc62a93ca791067d391 Version: 3e28d37146db5dd49c469bc62a93ca791067d391 Version: 3e28d37146db5dd49c469bc62a93ca791067d391 Version: 3e28d37146db5dd49c469bc62a93ca791067d391 Version: 3e28d37146db5dd49c469bc62a93ca791067d391 Version: 3e28d37146db5dd49c469bc62a93ca791067d391 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_execlists_submission.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ea0aaf8bf9fda6e101f2304391f066d99d0d054",
"status": "affected",
"version": "3e28d37146db5dd49c469bc62a93ca791067d391",
"versionType": "git"
},
{
"lessThan": "bedeee4612afc15c53f8d3c6da05897506b4ca24",
"status": "affected",
"version": "3e28d37146db5dd49c469bc62a93ca791067d391",
"versionType": "git"
},
{
"lessThan": "7214db3e62fa9f0be7981cba9039bd835a79c070",
"status": "affected",
"version": "3e28d37146db5dd49c469bc62a93ca791067d391",
"versionType": "git"
},
{
"lessThan": "c174969f6af6c22fc9c51aefcdb7f9183c3a329a",
"status": "affected",
"version": "3e28d37146db5dd49c469bc62a93ca791067d391",
"versionType": "git"
},
{
"lessThan": "edd4804f07b8369ed472de19272974e2bf2a6271",
"status": "affected",
"version": "3e28d37146db5dd49c469bc62a93ca791067d391",
"versionType": "git"
},
{
"lessThan": "82ec992c404c3dc774c5e9f3d4aa858e97187675",
"status": "affected",
"version": "3e28d37146db5dd49c469bc62a93ca791067d391",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_execlists_submission.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Fix NULL deref on sched_engine alloc failure\n\nAvoid using intel_context_put() before intel_context_init() in\nexeclists_create_virtual() as the kref_put() inside would lead\nto NULL deref on the IOCTL path when sched_engine allocation fails.\n\nDiscovered using AI-assisted static analysis confirmed by\nIntel Product Security.\n\n(cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:13.711Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ea0aaf8bf9fda6e101f2304391f066d99d0d054"
},
{
"url": "https://git.kernel.org/stable/c/bedeee4612afc15c53f8d3c6da05897506b4ca24"
},
{
"url": "https://git.kernel.org/stable/c/7214db3e62fa9f0be7981cba9039bd835a79c070"
},
{
"url": "https://git.kernel.org/stable/c/c174969f6af6c22fc9c51aefcdb7f9183c3a329a"
},
{
"url": "https://git.kernel.org/stable/c/edd4804f07b8369ed472de19272974e2bf2a6271"
},
{
"url": "https://git.kernel.org/stable/c/82ec992c404c3dc774c5e9f3d4aa858e97187675"
}
],
"title": "drm/i915/gt: Fix NULL deref on sched_engine alloc failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68242",
"datePublished": "2026-08-10T12:01:08.447Z",
"dateReserved": "2026-07-30T09:28:09.377Z",
"dateUpdated": "2026-10-30T12:28:13.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90156 (GCVE-0-2026-90156)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-30 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: safely discard unregistered deferred locks
When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on
rollback_list before allocating and registering the asynchronous work.
If either operation fails, rollback assumes that smb_lock->conn is
initialized and dereferences NULL. The deferred file_lock also remains
linked into the VFS blocked-lock state while it is freed.
Keep the lock off rollback_list until async setup succeeds. On setup
failures, explicitly unblock and wake the deferred lock before freeing it
and its ksmbd wrapper.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aaa51ac0d934cb4e2ab96e150fccc934e822009b",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "ecdcfa15b3d799476c685cecd433ebefc93015c8",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "77413400f083a959724de6f36348c9677ef9873a",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "52b91bc5253bb83665f3ea70565d0b2487dae643",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "d09af9a35ff7b77a950b507133d9092aadbfeff4",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "054bcca4cd9f00719b01f7108b51a2168fb94f15",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: safely discard unregistered deferred locks\n\nWhen vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on\nrollback_list before allocating and registering the asynchronous work.\nIf either operation fails, rollback assumes that smb_lock-\u003econn is\ninitialized and dereferences NULL. The deferred file_lock also remains\nlinked into the VFS blocked-lock state while it is freed.\n\nKeep the lock off rollback_list until async setup succeeds. On setup\nfailures, explicitly unblock and wake the deferred lock before freeing it\nand its ksmbd wrapper."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:34:29.152Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aaa51ac0d934cb4e2ab96e150fccc934e822009b"
},
{
"url": "https://git.kernel.org/stable/c/ecdcfa15b3d799476c685cecd433ebefc93015c8"
},
{
"url": "https://git.kernel.org/stable/c/77413400f083a959724de6f36348c9677ef9873a"
},
{
"url": "https://git.kernel.org/stable/c/52b91bc5253bb83665f3ea70565d0b2487dae643"
},
{
"url": "https://git.kernel.org/stable/c/d09af9a35ff7b77a950b507133d9092aadbfeff4"
},
{
"url": "https://git.kernel.org/stable/c/054bcca4cd9f00719b01f7108b51a2168fb94f15"
}
],
"title": "ksmbd: safely discard unregistered deferred locks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90156",
"datePublished": "2026-09-17T16:06:48.393Z",
"dateReserved": "2026-09-11T19:38:34.790Z",
"dateUpdated": "2026-10-30T12:34:29.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…