CVE-2026-89530 (GCVE-0-2026-89530)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-21 12:47
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more scatter/gather entries than the device's Send Queue supports, svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size bytes, while the reply on this path is bounded only by the client's request, so svc_rdma_xb_linearize() copies past the end of the buffer and corrupts adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, so the device also reads beyond the mapped region. The SGE-exhaustion branch is the only pull-up path that can exceed the buffer: the threshold branch pulls up only replies smaller than RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE budget are sent directly without linearization. Make svc_rdma_pull_up_needed() report -E2BIG when the reply it would pull up cannot fit sc_max_req_size, and fail the request with ERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping the connection. The helper no longer answers a simple yes/no question: it now reports pull-up, no pull-up, or -E2BIG for a reply too large to linearize. Rename svc_rdma_pull_up_needed() to svc_rdma_check_pull_up() so its name no longer implies a boolean predicate.
References
Impacted products
Vendor Product Version
Linux Linux Version: e248aa7be86e8179f20ac0931774ecd746f3f5bf
Version: e248aa7be86e8179f20ac0931774ecd746f3f5bf
Version: e248aa7be86e8179f20ac0931774ecd746f3f5bf
Version: e248aa7be86e8179f20ac0931774ecd746f3f5bf
Version: e248aa7be86e8179f20ac0931774ecd746f3f5bf
Version: 9b65b18f817d9ada2bf67351f24bdcce6789a0bb
Version: d564356e1919d1178568c19af410cfc1a9076663
Version: 4.19.22   ≤
Version: 4.20.9   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89530",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:07.762867Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:41.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_sendto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8068358f445a11296328ffa7c524701596814a17",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "fcd91b9957462d398792201c239dffaeff1cc8b2",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "1949dd1576f7a8aa161b1330c6125df9d53046d5",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "lessThan": "0fbe20dfe74b783d255bf389a6ea77aa25dc7860",
              "status": "affected",
              "version": "e248aa7be86e8179f20ac0931774ecd746f3f5bf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b65b18f817d9ada2bf67351f24bdcce6789a0bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d564356e1919d1178568c19af410cfc1a9076663",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.22",
              "versionType": "semver"
            },
            {
              "lessThan": "4.21",
              "status": "affected",
              "version": "4.20.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_sendto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.20.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice\u0027s Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client\u0027s\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device\u0027s SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote NFS/RDMA client reaches svc_rdma_sendto over InfiniBand, RoCE, or iWARP, including IP-routable RoCEv2/iWARP and Soft-RoCE, so this is a network attack.\nAC:L - The attacker fully controls omitting the Write list and Reply chunk and the NFS READ size; with the default 4096-byte pull-up buffer and ~5 Send SGEs, a multi-page inline READ deterministically takes the SGE-exhaustion pull-up path and overflows, with no race or uncontrollable layout.\nPR:N - RDMA-CM accept has no credential check, and AUTH_NULL/AUTH_UNIX need no real account; default NFS exports accept those flavors, so a fabric peer can drive a large READ reply without local or init-namespace privileges.\nUI:N - Exploitation requires only attacker-sent RPC-over-RDMA Calls that elicit a large inline reply; no victim mount, click, or other user action is needed beyond nfsd already listening on RDMA.\nS:U - The kmalloc overflow and oversized RDMA Send stay inside the host kernel\u0027s security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - svc_rdma_xb_linearize() copies past kmalloc sc_xprt_buf, then the inflated sc_sges[0].length is posted with the PD local DMA lkey, so the device reads adjacent kernel memory onto the wire; the heap smash is also leveragable for disclosure.\nI:H - The unbounded memcpy is a heap out-of-bounds write of attacker-influenced NFS READ payload into adjacent slab objects, enabling corruption of neighboring kernel state and control-flow hijacking.\nA:H - Overflowing a 4KB send buffer by up to the NFS/RDMA max payload smashes adjacent slab and can oops or panic, and posting an SGE longer than the DMA mapping can also fault the device or kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:42.592Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"
        }
      ],
      "title": "svcrdma: Reject inline replies that overflow the pull-up buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89530",
    "datePublished": "2026-09-11T19:44:10.024Z",
    "dateReserved": "2026-09-11T19:38:34.719Z",
    "dateUpdated": "2026-10-21T12:47:42.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89530\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:23:07.762867Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:23:08.699Z\"}}], \"cna\": {\"title\": \"svcrdma: Reject inline replies that overflow the pull-up buffer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA server transport; a remote NFS/RDMA client reaches svc_rdma_sendto over InfiniBand, RoCE, or iWARP, including IP-routable RoCEv2/iWARP and Soft-RoCE, so this is a network attack.\\nAC:L - The attacker fully controls omitting the Write list and Reply chunk and the NFS READ size; with the default 4096-byte pull-up buffer and ~5 Send SGEs, a multi-page inline READ deterministically takes the SGE-exhaustion pull-up path and overflows, with no race or uncontrollable layout.\\nPR:N - RDMA-CM accept has no credential check, and AUTH_NULL/AUTH_UNIX need no real account; default NFS exports accept those flavors, so a fabric peer can drive a large READ reply without local or init-namespace privileges.\\nUI:N - Exploitation requires only attacker-sent RPC-over-RDMA Calls that elicit a large inline reply; no victim mount, click, or other user action is needed beyond nfsd already listening on RDMA.\\nS:U - The kmalloc overflow and oversized RDMA Send stay inside the host kernel\u0027s security authority; this is not a VM, IOMMU, or sandbox escape.\\nC:H - svc_rdma_xb_linearize() copies past kmalloc sc_xprt_buf, then the inflated sc_sges[0].length is posted with the PD local DMA lkey, so the device reads adjacent kernel memory onto the wire; the heap smash is also leveragable for disclosure.\\nI:H - The unbounded memcpy is a heap out-of-bounds write of attacker-influenced NFS READ payload into adjacent slab objects, enabling corruption of neighboring kernel state and control-flow hijacking.\\nA:H - Overflowing a 4KB send buffer by up to the NFS/RDMA max payload smashes adjacent slab and can oops or panic, and posting an SGE longer than the DMA mapping can also fault the device or kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e248aa7be86e8179f20ac0931774ecd746f3f5bf\", \"lessThan\": \"8068358f445a11296328ffa7c524701596814a17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e248aa7be86e8179f20ac0931774ecd746f3f5bf\", \"lessThan\": \"fcd91b9957462d398792201c239dffaeff1cc8b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e248aa7be86e8179f20ac0931774ecd746f3f5bf\", \"lessThan\": \"1949dd1576f7a8aa161b1330c6125df9d53046d5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e248aa7be86e8179f20ac0931774ecd746f3f5bf\", \"lessThan\": \"8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e248aa7be86e8179f20ac0931774ecd746f3f5bf\", \"lessThan\": \"0fbe20dfe74b783d255bf389a6ea77aa25dc7860\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9b65b18f817d9ada2bf67351f24bdcce6789a0bb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d564356e1919d1178568c19af410cfc1a9076663\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.22\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.20.9\", \"lessThan\": \"4.21\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/sunrpc/xprtrdma/svc_rdma_sendto.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sunrpc/xprtrdma/svc_rdma_sendto.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17\"}, {\"url\": \"https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2\"}, {\"url\": \"https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5\"}, {\"url\": \"https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf\"}, {\"url\": \"https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsvcrdma: Reject inline replies that overflow the pull-up buffer\\n\\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\\npayload, without providing a Write list or a Reply chunk to carry\\nit. When such a reply needs more scatter/gather entries than the\\ndevice\u0027s Send Queue supports, svc_rdma_pull_up_needed() selects\\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\\nreply into sctxt-\u003esc_xprt_buf. That buffer is only sc_max_req_size\\nbytes, while the reply on this path is bounded only by the client\u0027s\\nrequest, so svc_rdma_xb_linearize() copies past the end of the\\nbuffer and corrupts adjacent slab memory. The oversized length is\\nthen stored in sc_sges[0].length and posted, so the device also\\nreads beyond the mapped region.\\n\\nThe SGE-exhaustion branch is the only pull-up path that can exceed\\nthe buffer: the threshold branch pulls up only replies smaller\\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device\u0027s SGE\\nbudget are sent directly without linearization. Make\\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\\npull up cannot fit sc_max_req_size, and fail the request with\\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\\nthe connection.\\n\\nThe helper no longer answers a simple yes/no question: it now\\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\\nlinearize. Rename svc_rdma_pull_up_needed() to\\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\\npredicate.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.160\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.109\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.50\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.22\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.20.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-21T12:47:42.592Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89530\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T12:47:42.592Z\", \"dateReserved\": \"2026-09-11T19:38:34.719Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:44:10.024Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.