Search
Find a vulnerability
Search criteria
17650 vulnerabilities
CVE-2026-98384 (GCVE-0-2026-98384)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
sk_protocol lives in struct sock, not in struct sock_common. A timewait
or request sock handed to bpf_sock_destroy() by the tcp iterator is
neither, so reading sk->sk_protocol runs past the object:
==================================================================
BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0
Read of size 2 at addr ffff8881047d11b4 by task test_progs/428
Tainted: [W]=WARN
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
print_report+0xd1/0x630
kasan_report+0xf3/0x130
__asan_report_load2_noabort+0x14/0x30
bpf_sock_destroy+0xc7/0xe0
bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7
bpf_iter_run_prog+0x538/0xde0
bpf_iter_tcp_seq_show+0x26b/0x4b0
bpf_seq_read+0x424/0x1210
vfs_read+0x197/0xe40
ksys_read+0x119/0x240
__x64_sys_read+0x72/0xc0
x64_sys_call+0x647/0x27e0
do_syscall_64+0xe5/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Only check sk_protocol on full socks. tcp_abort() already knows how to
deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it
never matched the code.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 5b4eb82475ae17d55974235c09e97044829426a8
(git)
Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < a9651704c6fd64590b5ad4fbe7c3768accf95993 (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 91a482a81eabddebf5430cbbdf12027e1a91b767 (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 2534a5e5d360c2b10203cfa80f4ab9d021e48f2f (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 01b245ba016d44861690594e10f67e026ce8552f (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b4eb82475ae17d55974235c09e97044829426a8",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "a9651704c6fd64590b5ad4fbe7c3768accf95993",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "91a482a81eabddebf5430cbbdf12027e1a91b767",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "2534a5e5d360c2b10203cfa80f4ab9d021e48f2f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "01b245ba016d44861690594e10f67e026ce8552f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk-\u003esk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:23.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8"
},
{
"url": "https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993"
},
{
"url": "https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767"
},
{
"url": "https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f"
},
{
"url": "https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f"
}
],
"title": "bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98384",
"datePublished": "2026-10-09T07:34:23.097Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:23.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98383 (GCVE-0-2026-98383)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 0f38472a2aa8704a6b514c0dfa9c32f3672b8f32
(git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < cae8674489f26edf7553fdd660599466cbb4c32f (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 9f9e57b5a3a033f95f49ef9d541340cdbcb80abb (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < df0072be6fc373cb22f9ea854d458b04e32a03cf (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < b9bb0e735460751b620156f800a4279a28573392 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 37b18688cd18fd86d2f35c212df1611862a26cd5 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < fca71ead7a20290af1e2046983eeafae43d21af1 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 (git) |
|
| Linux | Linux |
Affected:
4.18
Unaffected: 0 , < 4.18 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "b9bb0e735460751b620156f800a4279a28573392",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb-\u003ehead, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:22.408Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32"
},
{
"url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f"
},
{
"url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb"
},
{
"url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf"
},
{
"url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392"
},
{
"url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5"
},
{
"url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1"
},
{
"url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"
}
],
"title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98383",
"datePublished": "2026-10-09T07:34:22.408Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:22.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98382 (GCVE-0-2026-98382)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Reject dev-bound-only programs on other devices
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject dev-bound-only programs on other devices
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
unrelated netdevs compare equal. A bound-only program on an
offload-registered netdev can instead inherit a real offdev and match a
sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
specialized for the bound driver on the target driver's xdp_buff. Running a
veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
Call Trace:
...
tun_build_skb (drivers/net/tun.c:1739)
tun_get_user (drivers/net/tun.c:1856)
tun_chr_write_iter (drivers/net/tun.c:2091)
vfs_write (fs/read_write.c:595 fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the
shared-offdev fallback only for genuinely offloaded multi-port programs.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < e57f04194361574493e3e6cf0b9e9c69e4ae9791
(git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 0dceda331180617aeeb22381e8480b37f18ba08b (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 940b626854de200e6187777d42114727daca617c (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < bb375f3c5990e29851894f20ebc4b9dbc6676126 (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 6db1ce73e9853f533eb7f413f14ba00f8ec6f80d (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e57f04194361574493e3e6cf0b9e9c69e4ae9791",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "0dceda331180617aeeb22381e8480b37f18ba08b",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "940b626854de200e6187777d42114727daca617c",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "bb375f3c5990e29851894f20ebc4b9dbc6676126",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "6db1ce73e9853f533eb7f413f14ba00f8ec6f80d",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs on other devices\n\n__bpf_offload_dev_match() falls back to comparing offdev pointers after an\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so\nunrelated netdevs compare equal. A bound-only program on an\noffload-registered netdev can instead inherit a real offdev and match a\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs\nspecialized for the bound driver on the target driver\u0027s xdp_buff. Running a\nveth-bound program on tun reads beyond tun\u0027s bare stack xdp_buff as a\nveth_xdp_buff.\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)\n Call Trace:\n ...\n tun_build_skb (drivers/net/tun.c:1739)\n tun_get_user (drivers/net/tun.c:1856)\n tun_chr_write_iter (drivers/net/tun.c:2091)\n vfs_write (fs/read_write.c:595 fs/read_write.c:687)\n ksys_write (fs/read_write.c:739)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nRestrict non-offloaded programs to exact netdev matches and retain the\nshared-offdev fallback only for genuinely offloaded multi-port programs."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:21.718Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e57f04194361574493e3e6cf0b9e9c69e4ae9791"
},
{
"url": "https://git.kernel.org/stable/c/0dceda331180617aeeb22381e8480b37f18ba08b"
},
{
"url": "https://git.kernel.org/stable/c/940b626854de200e6187777d42114727daca617c"
},
{
"url": "https://git.kernel.org/stable/c/bb375f3c5990e29851894f20ebc4b9dbc6676126"
},
{
"url": "https://git.kernel.org/stable/c/6db1ce73e9853f533eb7f413f14ba00f8ec6f80d"
}
],
"title": "bpf: Reject dev-bound-only programs on other devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98382",
"datePublished": "2026-10-09T07:34:21.718Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:21.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98381 (GCVE-0-2026-98381)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
veth: manage XDP program pointers during channel resize
Summary
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog. If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
include/net/xdp.h:696 drivers/net/veth.c:820)
Call Trace:
veth_xdp_rcv (drivers/net/veth.c:941)
veth_poll (drivers/net/veth.c:986)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
Kernel panic - not syncing: Fatal exception in interrupt
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 7a8e143109ff2736dc79e41dcd55af7ceab7520a
(git)
Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 25bb7c36225220d30f404d7e29d2e052bc5f4b99 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 43f6b647f209591b1e3f726bb16b8dcba6b95908 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 7104a370714346b667712913dc16abf14bbc97ed (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "7104a370714346b667712913dc16abf14bbc97ed",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq-\u003exdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n BUG: unable to handle page fault for address: ffffc90000256048\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n include/net/xdp.h:696 drivers/net/veth.c:820)\n Call Trace:\n veth_xdp_rcv (drivers/net/veth.c:941)\n veth_poll (drivers/net/veth.c:986)\n __napi_poll (net/core/dev.c:7787)\n net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n handle_softirqs (kernel/softirq.c:645)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:21.029Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a"
},
{
"url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758"
},
{
"url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6"
},
{
"url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9"
},
{
"url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99"
},
{
"url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908"
},
{
"url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed"
}
],
"title": "veth: manage XDP program pointers during channel resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98381",
"datePublished": "2026-10-09T07:34:21.029Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:21.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98380 (GCVE-0-2026-98380)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
net/sched: reject IDR error pointers when deleting actions
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject IDR error pointers when deleting actions
tcf_action_delete() drops the reference held by its lookup before calling
tcf_idr_delete_index() with the saved action index. An unlocked
classifier can remove that action and reserve the same IDR slot with
ERR_PTR(-EBUSY) in between.
tcf_idr_delete_index() only checks the lookup result for NULL. It
therefore treats the reservation as a tc_action and dereferences
tcfa_bindcnt. A hardware execution breakpoint was used to schedule the
interleaving without changing the kernel source. KASAN reported this
decoded trace:
BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010
Read of size 4 at addr 0000000000000010 by task poc/150
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002
RIP: tca_action_gd+0x5c0/0x1010:
arch_atomic_read at arch/x86/include/asm/atomic.h:23
raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457
atomic_read at include/linux/atomic/atomic-instrumented.h:33
tcf_idr_delete_index at net/sched/act_api.c:766
tcf_action_delete at net/sched/act_api.c:1859
tcf_del_notify at net/sched/act_api.c:2014
tca_action_gd at net/sched/act_api.c:2064
R13: 0000000000000010 R15: fffffffffffffff0
Kernel panic - not syncing: Fatal exception
R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces
the address in R13. With the guard applied, the same reproducer returned
-ENOENT without a KASAN report or panic. Treat error pointers as absent
and return -ENOENT.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0190c1d452a91c38a3462abdd81752be1b9006a8 , < 39b751a210bf61a374afa82749afc7a77a08bf1d
(git)
Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < dd80a7519824b72c8fcfd3cc50cb93f7e2d90923 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 6bf076258aac4e0af69ef317656c31ce6444d647 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 6c9f07bf8800171de2cd3f02815cebe1f4d45f2d (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 259caa711b7688365676442e2fdb286b8aceaa80 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 968550a439f64bd1a6c0d88efb92e4f082f84a26 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < a9551f26287debe6d8aa6e8841974661065b975f (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < c82b797abe668d0b668601a93ba2c0b071a63574 (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "39b751a210bf61a374afa82749afc7a77a08bf1d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "dd80a7519824b72c8fcfd3cc50cb93f7e2d90923",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6bf076258aac4e0af69ef317656c31ce6444d647",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6c9f07bf8800171de2cd3f02815cebe1f4d45f2d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "259caa711b7688365676442e2fdb286b8aceaa80",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "968550a439f64bd1a6c0d88efb92e4f082f84a26",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "a9551f26287debe6d8aa6e8841974661065b975f",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "c82b797abe668d0b668601a93ba2c0b071a63574",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject IDR error pointers when deleting actions\n\ntcf_action_delete() drops the reference held by its lookup before calling\ntcf_idr_delete_index() with the saved action index. An unlocked\nclassifier can remove that action and reserve the same IDR slot with\nERR_PTR(-EBUSY) in between.\n\ntcf_idr_delete_index() only checks the lookup result for NULL. It\ntherefore treats the reservation as a tc_action and dereferences\ntcfa_bindcnt. A hardware execution breakpoint was used to schedule the\ninterleaving without changing the kernel source. KASAN reported this\ndecoded trace:\n\n BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010\n Read of size 4 at addr 0000000000000010 by task poc/150\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002\n RIP: tca_action_gd+0x5c0/0x1010:\n arch_atomic_read at arch/x86/include/asm/atomic.h:23\n raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457\n atomic_read at include/linux/atomic/atomic-instrumented.h:33\n tcf_idr_delete_index at net/sched/act_api.c:766\n tcf_action_delete at net/sched/act_api.c:1859\n tcf_del_notify at net/sched/act_api.c:2014\n tca_action_gd at net/sched/act_api.c:2064\n R13: 0000000000000010 R15: fffffffffffffff0\n Kernel panic - not syncing: Fatal exception\n\nR15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces\nthe address in R13. With the guard applied, the same reproducer returned\n-ENOENT without a KASAN report or panic. Treat error pointers as absent\nand return -ENOENT."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:20.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/39b751a210bf61a374afa82749afc7a77a08bf1d"
},
{
"url": "https://git.kernel.org/stable/c/dd80a7519824b72c8fcfd3cc50cb93f7e2d90923"
},
{
"url": "https://git.kernel.org/stable/c/6bf076258aac4e0af69ef317656c31ce6444d647"
},
{
"url": "https://git.kernel.org/stable/c/6c9f07bf8800171de2cd3f02815cebe1f4d45f2d"
},
{
"url": "https://git.kernel.org/stable/c/259caa711b7688365676442e2fdb286b8aceaa80"
},
{
"url": "https://git.kernel.org/stable/c/968550a439f64bd1a6c0d88efb92e4f082f84a26"
},
{
"url": "https://git.kernel.org/stable/c/a9551f26287debe6d8aa6e8841974661065b975f"
},
{
"url": "https://git.kernel.org/stable/c/c82b797abe668d0b668601a93ba2c0b071a63574"
}
],
"title": "net/sched: reject IDR error pointers when deleting actions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98380",
"datePublished": "2026-10-09T07:34:20.218Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:20.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98379 (GCVE-0-2026-98379)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rpfilter: reject routes without inet6_dev
ip6_route_lookup() can return an error-free route whose rt6i_idev is
NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears
down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects
in the FIB. An unprivileged user can construct this state with rtnetlink
in a private user and network namespace, then trigger a NULL dereference
through an IPv6 rpfilter lookup:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)
Call Trace:
ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
nf_hook_slow (net/netfilter/core.c:619)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6216)
process_backlog (net/core/dev.c:6680)
__napi_poll (net/core/dev.c:7739)
net_rx_action (net/core/dev.c:7959)
handle_softirqs (kernel/softirq.c:622)
do_softirq.part.0 (kernel/softirq.c:523)
__local_bh_enable_ip (kernel/softirq.c:450)
__dev_queue_xmit (net/core/dev.c:4913)
packet_sendmsg (net/packet/af_packet.c:3139)
__sys_sendto (net/socket.c:2252)
__x64_sys_sendto (net/socket.c:2259)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Reject routes without an inet6_dev immediately after lookup. Such routes
are not eligible for reverse-path filtering, and the check protects all
later rt6i_idev dereferences.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < f4de78756b0fddbd125b2b1b77c74f2eccc8e977
(git)
Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 1681ab6dd1271f2f36047490793b78b1848bbcc9 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 65487e9e99431ffcf05024a817f51ee4e3bd9b47 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < f49da48bd679cfee646d6a40dd02b1933de577d1 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < eafe081ea77d25b5c8e601680671b4ecb4520e7d (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 3a7384bc2e66217c9a01a392281334f4423740a0 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 1b9b5323725e458906c7620a3bc10398b51ad954 (git) |
|
| Linux | Linux |
Affected:
3.3
Unaffected: 0 , < 3.3 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4de78756b0fddbd125b2b1b77c74f2eccc8e977",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1681ab6dd1271f2f36047490793b78b1848bbcc9",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "65487e9e99431ffcf05024a817f51ee4e3bd9b47",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "f49da48bd679cfee646d6a40dd02b1933de577d1",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "eafe081ea77d25b5c8e601680671b4ecb4520e7d",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "3a7384bc2e66217c9a01a392281334f4423740a0",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1b9b5323725e458906c7620a3bc10398b51ad954",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject routes without inet6_dev\n\nip6_route_lookup() can return an error-free route whose rt6i_idev is\nNULL. Lowering an external nexthop device\u0027s MTU below IPV6_MIN_MTU tears\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects\nin the FIB. An unprivileged user can construct this state with rtnetlink\nin a private user and network namespace, then trigger a NULL dereference\nthrough an IPv6 rpfilter lookup:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)\n Call Trace:\n ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)\n nf_hook_slow (net/netfilter/core.c:619)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6216)\n process_backlog (net/core/dev.c:6680)\n __napi_poll (net/core/dev.c:7739)\n net_rx_action (net/core/dev.c:7959)\n handle_softirqs (kernel/softirq.c:622)\n do_softirq.part.0 (kernel/softirq.c:523)\n __local_bh_enable_ip (kernel/softirq.c:450)\n __dev_queue_xmit (net/core/dev.c:4913)\n packet_sendmsg (net/packet/af_packet.c:3139)\n __sys_sendto (net/socket.c:2252)\n __x64_sys_sendto (net/socket.c:2259)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nReject routes without an inet6_dev immediately after lookup. Such routes\nare not eligible for reverse-path filtering, and the check protects all\nlater rt6i_idev dereferences."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:19.425Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4de78756b0fddbd125b2b1b77c74f2eccc8e977"
},
{
"url": "https://git.kernel.org/stable/c/1681ab6dd1271f2f36047490793b78b1848bbcc9"
},
{
"url": "https://git.kernel.org/stable/c/65487e9e99431ffcf05024a817f51ee4e3bd9b47"
},
{
"url": "https://git.kernel.org/stable/c/f49da48bd679cfee646d6a40dd02b1933de577d1"
},
{
"url": "https://git.kernel.org/stable/c/290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40"
},
{
"url": "https://git.kernel.org/stable/c/eafe081ea77d25b5c8e601680671b4ecb4520e7d"
},
{
"url": "https://git.kernel.org/stable/c/3a7384bc2e66217c9a01a392281334f4423740a0"
},
{
"url": "https://git.kernel.org/stable/c/1b9b5323725e458906c7620a3bc10398b51ad954"
}
],
"title": "netfilter: ip6t_rpfilter: reject routes without inet6_dev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98379",
"datePublished": "2026-10-09T07:34:19.425Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:19.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98378 (GCVE-0-2026-98378)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Skip unsettled links in link iterator
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip unsettled links in link iterator
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
succeeds and before bpf_link_settle() publishes the ID in link->id.
bpf_link_by_id() treats such an ID-zero link as unsettled, but the link
iterator takes a reference without this check.
If anon_inode_getfile() then fails, the creator removes the ID and frees
its still-private link directly. The iterator is left with a dangling
reference and its next bpf_link_put() accesses freed memory.
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as
bpf_link_by_id() does.
BUG: KASAN: slab-use-after-free in bpf_link_put
Write of size 8 by task exp/384
Call Trace:
bpf_link_put kernel/bpf/syscall.c:3372
bpf_link_seq_next kernel/bpf/link_iter.c:33
bpf_seq_read kernel/bpf/bpf_iter.c:158
vfs_read fs/read_write.c:572
ksys_read fs/read_write.c:716
do_syscall_64 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 68930f8d40ab4c10ca3b019f076136758fd100a8
(git)
Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < c251ed48bd9063cf7de6049421e78b6de989060f (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 798a61edbc436cacdb659927d067368eeb1e30e2 (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 6e271f093d15d323f42de26f66556af53fa8e19f (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 87ce4b53b7436b50fc984f0a6afaf77f68ac5573 (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 50e80e2bb5e2be8515205b9c496b9640ddefa434 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68930f8d40ab4c10ca3b019f076136758fd100a8",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "c251ed48bd9063cf7de6049421e78b6de989060f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "798a61edbc436cacdb659927d067368eeb1e30e2",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "6e271f093d15d323f42de26f66556af53fa8e19f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "87ce4b53b7436b50fc984f0a6afaf77f68ac5573",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "50e80e2bb5e2be8515205b9c496b9640ddefa434",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link-\u003eid.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:18.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8"
},
{
"url": "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f"
},
{
"url": "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2"
},
{
"url": "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f"
},
{
"url": "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573"
},
{
"url": "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434"
}
],
"title": "bpf: Skip unsettled links in link iterator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98378",
"datePublished": "2026-10-09T07:34:18.626Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:18.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98377 (GCVE-0-2026-98377)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),
never that mac_len bytes of MAC header are present. Its ETH_HLEN
wrappers - __vlan_insert_tag() under skb_vlan_push(), and
vlan_insert_tag() under validate_xmit_vlan() on the generic transmit
path - therefore rewrite the first 16 bytes at skb->data: a 12-byte
memmove plus two 2-byte stores at +12 and +14. No caller supplies the
bound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().
An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a
one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a
hwaccel tag; the next - clsact "action vlan push" or
bpf_skb_vlan_push() - enters the helper with skb->len still 1. The
head comes from skbuff_small_head without __GFP_ZERO, so each push
drags bytes from beyond skb->tail into the frame. After three the
one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised
slab:
0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81
`------------------------------'
only 0x5a was sent; the rest is slab, here the top 56 bits of a
linear-map address
Require the MAC header the helper rewrites to be present, so such a
frame is dropped rather than transmitted.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 40a5cc4b7251c74f3341332a226d02200e96bccf
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f42562dd027dc4ed103fae17b2206e73ea1963c4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40a5cc4b7251c74f3341332a226d02200e96bccf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f42562dd027dc4ed103fae17b2206e73ea1963c4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: require the MAC header to be present in __vlan_insert_inner_tag()\n\n__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),\nnever that mac_len bytes of MAC header are present. Its ETH_HLEN\nwrappers - __vlan_insert_tag() under skb_vlan_push(), and\nvlan_insert_tag() under validate_xmit_vlan() on the generic transmit\npath - therefore rewrite the first 16 bytes at skb-\u003edata: a 12-byte\nmemmove plus two 2-byte stores at +12 and +14. No caller supplies the\nbound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().\n\nAn IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a\none-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a\nhwaccel tag; the next - clsact \"action vlan push\" or\nbpf_skb_vlan_push() - enters the helper with skb-\u003elen still 1. The\nhead comes from skbuff_small_head without __GFP_ZERO, so each push\ndrags bytes from beyond skb-\u003etail into the frame. After three the\none-byte send leaves as 13 bytes carrying 11 bytes of uninitialised\nslab:\n\n 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81\n `------------------------------\u0027\n only 0x5a was sent; the rest is slab, here the top 56 bits of a\n linear-map address\n\nRequire the MAC header the helper rewrites to be present, so such a\nframe is dropped rather than transmitted."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:17.832Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40a5cc4b7251c74f3341332a226d02200e96bccf"
},
{
"url": "https://git.kernel.org/stable/c/f42562dd027dc4ed103fae17b2206e73ea1963c4"
},
{
"url": "https://git.kernel.org/stable/c/59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc"
},
{
"url": "https://git.kernel.org/stable/c/ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a"
}
],
"title": "vlan: require the MAC header to be present in __vlan_insert_inner_tag()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98377",
"datePublished": "2026-10-09T07:34:17.832Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:17.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98376 (GCVE-0-2026-98376)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Use array_map_meta_equal for percpu array inner map replacement
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use array_map_meta_equal for percpu array inner map replacement
percpu_array_map_ops.map_meta_equal points to the generic
bpf_map_meta_equal(), which does not compare max_entries. When a
percpu array serves as an inner map, replacing it with one that has
fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()
inlines the original template's index_mask as a JIT immediate, a lookup
on the replacement map can access pptrs[] out of bounds.
Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),
which already enforces the max_entries equality check.
Add a selftest to verify that replacing a percpu array inner map with
a differently-sized one is rejected.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "593980175389a05793f6060aa20e626330960395",
"status": "affected",
"version": "db69718b8efac802c7cc20d5a6c7dfc913f99c43",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use array_map_meta_equal for percpu array inner map replacement\n\npercpu_array_map_ops.map_meta_equal points to the generic\nbpf_map_meta_equal(), which does not compare max_entries. When a\npercpu array serves as an inner map, replacing it with one that has\nfewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()\ninlines the original template\u0027s index_mask as a JIT immediate, a lookup\non the replacement map can access pptrs[] out of bounds.\n\nPoint percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),\nwhich already enforces the max_entries equality check.\n\nAdd a selftest to verify that replacing a percpu array inner map with\na differently-sized one is rejected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:17.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"
}
],
"title": "bpf: Use array_map_meta_equal for percpu array inner map replacement",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98376",
"datePublished": "2026-10-09T07:34:17.043Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:17.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98375 (GCVE-0-2026-98375)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:10 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
xen/netfront: drop RX packets with a short Ethernet header
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: drop RX packets with a short Ethernet header
handle_incoming_queue() pulls pull_to bytes into the head before
calling eth_type_trans(). pull_to is the length of the first RX slot,
capped at RX_COPY_THRESHOLD, and that length comes from the backend.
Nothing checks it against ETH_HLEN.
If the first slot is shorter than ETH_HLEN and more slots follow, the
head ends up shorter than an Ethernet header while skb->len is longer,
and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is
shorter than ETH_HLEN, eth_type_trans() reads the header past the end
of the data instead.
Pull at least ETH_HLEN, and drop the packet if that fails, which also
drops packets too short to hold an Ethernet header. This also checks
the return value of the pull, which was ignored.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "089e58805c452e52179482b1025a8e309a57f801",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc7",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc7",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb-\u003elen is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:16.178Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801"
}
],
"title": "xen/netfront: drop RX packets with a short Ethernet header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98375",
"datePublished": "2026-10-09T07:10:45.930Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:16.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98374 (GCVE-0-2026-98374)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:01 – Updated: 2026-10-07 13:01
VLAI
EPSS
VEX
Title
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.
The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue(). An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:
BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
Read of size 4 at addr ffff88800604d928 by task swapper/1/0
Call Trace:
tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
Sync the hint to the copy.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c31b70c9968fe9c4194d1b5d06d07596a3b680de , < fad6d429651e748365e93ca54645accc212f0018
(git)
Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < c5b4da1f403a658c1c19766be2b426003ada419f (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 71d45049b0d631dfdbf3c65305f7fca676de023b (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < e3ea71cb1408a013ed4e8a757b815f1a919324bd (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 631aa4cb45099f09e9385dd786bd291c6270bfc4 (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 0f87720c7e4bcab07c24888b3cf12bfe857bb90e (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < fe99bbeee5c5dbd3abc30721a8079ced59649d97 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fad6d429651e748365e93ca54645accc212f0018",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "c5b4da1f403a658c1c19766be2b426003ada419f",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "71d45049b0d631dfdbf3c65305f7fca676de023b",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "e3ea71cb1408a013ed4e8a757b815f1a919324bd",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "631aa4cb45099f09e9385dd786bd291c6270bfc4",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "0f87720c7e4bcab07c24888b3cf12bfe857bb90e",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "fe99bbeee5c5dbd3abc30721a8079ced59649d97",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:01:48.600Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"
},
{
"url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"
},
{
"url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"
},
{
"url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"
},
{
"url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"
},
{
"url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"
},
{
"url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"
}
],
"title": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98374",
"datePublished": "2026-10-07T13:01:48.600Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-07T13:01:48.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98373 (GCVE-0-2026-98373)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:01 – Updated: 2026-10-07 13:01
VLAI
EPSS
VEX
Title
mm/hugetlb: preserve mremap address delta when skipping page tables
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: preserve mremap address delta when skipping page tables
move_hugetlb_page_tables() optimizes mremap() by advancing to the last
entry in the page table when the source page table does not exist, either
initially or after unsharing a PMD table. The common loop increment then
steps to the first entry in the next page table.
However, the code advances both the source and destination addresses to
the last entries in their respective page tables, which is wrong. The
destination address must be advanced only by the same amount as the source
address.
If the source and destination offsets within their page tables differ, the
destination address can be advanced too far, causing follow-up issues.
Fix this by advancing the destination address by the source advance
distance.
With a reproducer, we were able to trigger a kernel panic on x86-64. With
this fix in place, we can no longer reproduce the issue.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff
(git)
Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 850cc4a84b36a0062dcd0391acd2450e20ab0767 (git) Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 480a39b0a12c977ed6e755f3d12a23424c57d11f (git) Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 9bdad082d44bdcf93716973dcba6be77e8a06e7b (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "850cc4a84b36a0062dcd0391acd2450e20ab0767",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "480a39b0a12c977ed6e755f3d12a23424c57d11f",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "9bdad082d44bdcf93716973dcba6be77e8a06e7b",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: preserve mremap address delta when skipping page tables\n\nmove_hugetlb_page_tables() optimizes mremap() by advancing to the last\nentry in the page table when the source page table does not exist, either\ninitially or after unsharing a PMD table. The common loop increment then\nsteps to the first entry in the next page table.\n\nHowever, the code advances both the source and destination addresses to\nthe last entries in their respective page tables, which is wrong. The\ndestination address must be advanced only by the same amount as the source\naddress.\n\nIf the source and destination offsets within their page tables differ, the\ndestination address can be advanced too far, causing follow-up issues. \nFix this by advancing the destination address by the source advance\ndistance.\n\nWith a reproducer, we were able to trigger a kernel panic on x86-64. With\nthis fix in place, we can no longer reproduce the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:01:47.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff"
},
{
"url": "https://git.kernel.org/stable/c/850cc4a84b36a0062dcd0391acd2450e20ab0767"
},
{
"url": "https://git.kernel.org/stable/c/480a39b0a12c977ed6e755f3d12a23424c57d11f"
},
{
"url": "https://git.kernel.org/stable/c/9bdad082d44bdcf93716973dcba6be77e8a06e7b"
}
],
"title": "mm/hugetlb: preserve mremap address delta when skipping page tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98373",
"datePublished": "2026-10-07T13:01:47.433Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-07T13:01:47.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98372 (GCVE-0-2026-98372)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
iptfs_skb_reset_frag_walk() advances to the fragment containing @offset
with an unbounded loop:
while (offset >= walk->past + walk->frags[walk->fragi].len)
walk->past += walk->frags[walk->fragi++].len;
walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced
without ever checking fragi against walk->nr_frags. When the requested
offset is at or beyond the total length spanned by the walk's fragments,
fragi runs past nr_frags and off the end of the fixed-size on-stack
frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.
The two callers behave differently: iptfs_skb_add_frags() already guards
against this with
if (!walk->nr_frags ||
offset >= walk->total + walk->initial_offset)
return len;
but iptfs_skb_can_add_frags() has no such guard and calls
iptfs_skb_reset_frag_walk() unconditionally, so it performs the
out-of-range walk. Its own "fragi < walk->nr_frags" bound check runs only
afterwards, too late to prevent the read.
This is reachable from the receive path: a crafted IP-TFS (AGGFRAG)
payload delivered to an IPTFS SA drives iptfs_reassem_cont() ->
iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:
BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250
Read of size 4 at addr ffff888008ad7210 by task repro/345
iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392
iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420
iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902
iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280
iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741
xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700
xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104
ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612
Give iptfs_skb_can_add_frags() the same up-front guard that
iptfs_skb_add_frags() already has, so the walk is never entered with an
out-of-range offset. When it triggers, the caller falls back to the
existing linearize-and-copy path, which is safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 , < 7e1c6884a0b494b7e3f204877f94c1e07a117bf7
(git)
Affected: 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 , < da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3 (git) Affected: 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 , < d042487dc118e494db2e2c1382310255c90ff544 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e1c6884a0b494b7e3f204877f94c1e07a117bf7",
"status": "affected",
"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7",
"versionType": "git"
},
{
"lessThan": "da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3",
"status": "affected",
"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7",
"versionType": "git"
},
{
"lessThan": "d042487dc118e494db2e2c1382310255c90ff544",
"status": "affected",
"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\niptfs_skb_reset_frag_walk() advances to the fragment containing @offset\nwith an unbounded loop:\n\n\twhile (offset \u003e= walk-\u003epast + walk-\u003efrags[walk-\u003efragi].len)\n\t\twalk-\u003epast += walk-\u003efrags[walk-\u003efragi++].len;\n\nwalk-\u003efragi is advanced and walk-\u003efrags[walk-\u003efragi] is dereferenced\nwithout ever checking fragi against walk-\u003enr_frags. When the requested\noffset is at or beyond the total length spanned by the walk\u0027s fragments,\nfragi runs past nr_frags and off the end of the fixed-size on-stack\nfrags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.\n\nThe two callers behave differently: iptfs_skb_add_frags() already guards\nagainst this with\n\n\tif (!walk-\u003enr_frags ||\n\t offset \u003e= walk-\u003etotal + walk-\u003einitial_offset)\n\t\treturn len;\n\nbut iptfs_skb_can_add_frags() has no such guard and calls\niptfs_skb_reset_frag_walk() unconditionally, so it performs the\nout-of-range walk. Its own \"fragi \u003c walk-\u003enr_frags\" bound check runs only\nafterwards, too late to prevent the read.\n\nThis is reachable from the receive path: a crafted IP-TFS (AGGFRAG)\npayload delivered to an IPTFS SA drives iptfs_reassem_cont() -\u003e\niptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:\n\n BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250\n Read of size 4 at addr ffff888008ad7210 by task repro/345\n iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392\n iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420\n iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902\n iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280\n iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741\n xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700\n xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104\n ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612\n\nGive iptfs_skb_can_add_frags() the same up-front guard that\niptfs_skb_add_frags() already has, so the walk is never entered with an\nout-of-range offset. When it triggers, the caller falls back to the\nexisting linearize-and-copy path, which is safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:56.529Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e1c6884a0b494b7e3f204877f94c1e07a117bf7"
},
{
"url": "https://git.kernel.org/stable/c/da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3"
},
{
"url": "https://git.kernel.org/stable/c/d042487dc118e494db2e2c1382310255c90ff544"
}
],
"title": "xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98372",
"datePublished": "2026-10-06T08:46:56.529Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-06T08:46:56.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98371 (GCVE-0-2026-98371)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
xfrm: iptfs: fix runt reassembly panic from short inner tot_len
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix runt reassembly panic from short inner tot_len
When the start of an inner packet is split across two outer packets
such that fewer than 4 bytes land at the end of the first one,
__input_process_payload() saves those bytes as a runt and skips the
iplen/iphlen validation performed for in-place packets. When the
continuation packet arrives, iptfs_reassem_cont() only requires the
declared inner length to be >= sizeof(ra_runt) (6) before allocating
the reassembly skb with that attacker-controlled length.
However, __iptfs_iphlen() always returns the fixed minimum IP header
size (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in
[6, 19] the header-completion copy writes past the declared packet
length, and the subsequent "ipremain -= copylen" underflows to ~4GB,
leaving the payload copy length bounded only by blkoff (up to 64KB).
At runtime the skb_put() tailroom check turns this into
skb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable
locally via userns+netns IPTFS SAs and remotely against IPTFS VPN
gateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,
tun/tap delivery).
Align the runt path with the normal path by requiring the declared
inner length to cover at least the IP header size. This also subsumes
the previous >= sizeof(ra_runt) check, since the minimum IP header
is always larger than the runt buffer.
This issue was found by the autokbug dynamic kernel fuzzer at
Tencent Yunding Lab.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
07569476544681816335099929ff3494dfbf6b05 , < a7018ee0ea8622ed59edc064be4e0f2c26464f53
(git)
Affected: 07569476544681816335099929ff3494dfbf6b05 , < 5b8afb56ccb7c014b0f1ac40341708b200443c2d (git) Affected: 07569476544681816335099929ff3494dfbf6b05 , < dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7018ee0ea8622ed59edc064be4e0f2c26464f53",
"status": "affected",
"version": "07569476544681816335099929ff3494dfbf6b05",
"versionType": "git"
},
{
"lessThan": "5b8afb56ccb7c014b0f1ac40341708b200443c2d",
"status": "affected",
"version": "07569476544681816335099929ff3494dfbf6b05",
"versionType": "git"
},
{
"lessThan": "dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c",
"status": "affected",
"version": "07569476544681816335099929ff3494dfbf6b05",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix runt reassembly panic from short inner tot_len\n\nWhen the start of an inner packet is split across two outer packets\nsuch that fewer than 4 bytes land at the end of the first one,\n__input_process_payload() saves those bytes as a runt and skips the\niplen/iphlen validation performed for in-place packets. When the\ncontinuation packet arrives, iptfs_reassem_cont() only requires the\ndeclared inner length to be \u003e= sizeof(ra_runt) (6) before allocating\nthe reassembly skb with that attacker-controlled length.\n\nHowever, __iptfs_iphlen() always returns the fixed minimum IP header\nsize (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in\n[6, 19] the header-completion copy writes past the declared packet\nlength, and the subsequent \"ipremain -= copylen\" underflows to ~4GB,\nleaving the payload copy length bounded only by blkoff (up to 64KB).\nAt runtime the skb_put() tailroom check turns this into\nskb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable\nlocally via userns+netns IPTFS SAs and remotely against IPTFS VPN\ngateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,\ntun/tap delivery).\n\nAlign the runt path with the normal path by requiring the declared\ninner length to cover at least the IP header size. This also subsumes\nthe previous \u003e= sizeof(ra_runt) check, since the minimum IP header\nis always larger than the runt buffer.\n\nThis issue was found by the autokbug dynamic kernel fuzzer at\nTencent Yunding Lab."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:55.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7018ee0ea8622ed59edc064be4e0f2c26464f53"
},
{
"url": "https://git.kernel.org/stable/c/5b8afb56ccb7c014b0f1ac40341708b200443c2d"
},
{
"url": "https://git.kernel.org/stable/c/dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c"
}
],
"title": "xfrm: iptfs: fix runt reassembly panic from short inner tot_len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98371",
"datePublished": "2026-10-06T08:46:55.753Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:55.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98370 (GCVE-0-2026-98370)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
xfrm: fix compat ALLOCSPI request use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix compat ALLOCSPI request use-after-free
xfrm_state_netlink() builds the ALLOCSPI response with
dump_one_state(), which already calls alloc_compat() with the response
skb and header.
xfrm_alloc_userspi() then calls alloc_compat() again, but passes the
original request skb and its header. For a compat request, the
translator therefore interprets the 228-byte compat xfrm_userspi_info
as the 232-byte native layout and reads four bytes past the declared
payload. It also publishes the translated child through the request's
frag_list.
A multicast clone of the request shares skb_shared_info and can observe
that child. xfrm_user_rcv_msg() frees it after the request handler
returns, racing a compat receiver which may still be copying from it and
resulting in a use-after-free.
Remove the redundant conversion. The response keeps its correct compat
translation from dump_one_state(), and no child is attached to the
inbound request.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 494f2bee9d8d0ebcfa249ac41bed7fed26d119b4
(git)
Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 17893987e52918c23945c42e47e894a936305a25 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < bb63ab52a18273ec68340ac49aebbaa7b514ccd5 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 248433942155b42a0ef04a5806c8aca024ea7c33 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < e70f639aee2ff0def155c256cace9e0f81d998e2 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "494f2bee9d8d0ebcfa249ac41bed7fed26d119b4",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "17893987e52918c23945c42e47e894a936305a25",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "bb63ab52a18273ec68340ac49aebbaa7b514ccd5",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "248433942155b42a0ef04a5806c8aca024ea7c33",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "e70f639aee2ff0def155c256cace9e0f81d998e2",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request\u0027s\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:54.981Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4"
},
{
"url": "https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25"
},
{
"url": "https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810"
},
{
"url": "https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718"
},
{
"url": "https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5"
},
{
"url": "https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33"
},
{
"url": "https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2"
},
{
"url": "https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320"
}
],
"title": "xfrm: fix compat ALLOCSPI request use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98370",
"datePublished": "2026-10-06T08:46:54.981Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:54.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98369 (GCVE-0-2026-98369)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():
WARNING: suspicious RCU usage in ip6_pkt_drop
include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!
Call Trace:
__in6_dev_get_safely include/net/addrconf.h:389 [inline]
ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620
ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651
xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through
workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue,
the reinjection loop ceased running in softirq context. Workqueue workers
run in process context where local_bh_disable() does not enter an RCU
read-side critical section under CONFIG_PREEMPT_RCU.
Because finish callbacks (such as ip6_rcv_finish) expect to run under an
RCU read lock (performing route lookups, l3mdev lookups, and accessing
RCU-protected data structures), invoking them in workqueue context without
rcu_read_lock() triggers RCU lockdep warnings.
Furthermore, packets queued to the workqueue via xfrm_trans_queue_net()
may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).
Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev
with blackhole_netdev, so dst entries do not keep skb->dev alive while
queued in the workqueue.
Fix these issues by:
1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the
caller's RCU section to ensure dst is reference-counted before queuing.
2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue
deferral so skb->dev remains valid during finish() callback processing.
3. Acquiring rcu_read_lock() around the finish callback invocation loop in
xfrm_trans_reinject().
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7d98b26684cb2390729525b341ea099f0badbe18 , < 41e47f1664be86c91326f0afe0504a1162d00907
(git)
Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 6601d91a85761f33351c71e04ec0bbd294ca07ce (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 0cda8273265d30cac6423834fd7d4acb75f04fdb (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 68a317b4aec8ca1868a39d69e40f9e29baa4f40a (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 6eb3b071be8e260543c604550c54dac66e6b174b (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 664fc0941df7c1918b2cd4de6ee00469ba77d8e4 (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < d2f5082f9e84653fa1a9e8aebaaff23e688f5e19 (git) Affected: f520075da484306bbb8425afd2c42404ba74816f (git) Affected: 130d9e5017ade1b81d16783563edb38c12a2eab7 (git) Affected: 5.15.75 , < 5.15.222 (semver) Affected: 5.19.17 , < 5.20 (semver) Affected: 6.0.3 , < 6.1 (semver) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41e47f1664be86c91326f0afe0504a1162d00907",
"status": "affected",
"version": "7d98b26684cb2390729525b341ea099f0badbe18",
"versionType": "git"
},
{
"lessThan": "6601d91a85761f33351c71e04ec0bbd294ca07ce",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "0cda8273265d30cac6423834fd7d4acb75f04fdb",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "68a317b4aec8ca1868a39d69e40f9e29baa4f40a",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "6eb3b071be8e260543c604550c54dac66e6b174b",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "664fc0941df7c1918b2cd4de6ee00469ba77d8e4",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "d2f5082f9e84653fa1a9e8aebaaff23e688f5e19",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"status": "affected",
"version": "f520075da484306bbb8425afd2c42404ba74816f",
"versionType": "git"
},
{
"status": "affected",
"version": "130d9e5017ade1b81d16783563edb38c12a2eab7",
"versionType": "git"
},
{
"lessThan": "5.15.222",
"status": "affected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n\nsyzbot reported a suspicious RCU usage warning in ip6_pkt_drop():\n\n WARNING: suspicious RCU usage in ip6_pkt_drop\n include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!\n\n Call Trace:\n __in6_dev_get_safely include/net/addrconf.h:389 [inline]\n ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620\n ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651\n xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n\nWhen commit 4f4920669d21 (\"xfrm: Reinject transport-mode packets through\nworkqueue\") converted xfrm_trans_reinject from a tasklet to a workqueue,\nthe reinjection loop ceased running in softirq context. Workqueue workers\nrun in process context where local_bh_disable() does not enter an RCU\nread-side critical section under CONFIG_PREEMPT_RCU.\n\nBecause finish callbacks (such as ip6_rcv_finish) expect to run under an\nRCU read lock (performing route lookups, l3mdev lookups, and accessing\nRCU-protected data structures), invoking them in workqueue context without\nrcu_read_lock() triggers RCU lockdep warnings.\n\nFurthermore, packets queued to the workqueue via xfrm_trans_queue_net()\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst-\u003edev\nwith blackhole_netdev, so dst entries do not keep skb-\u003edev alive while\nqueued in the workqueue.\n\nFix these issues by:\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the\n caller\u0027s RCU section to ensure dst is reference-counted before queuing.\n2. Holding a reference on skb-\u003edev via dev_hold()/dev_put() across workqueue\n deferral so skb-\u003edev remains valid during finish() callback processing.\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in\n xfrm_trans_reinject()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The use-after-free happens only when a queued packet\u0027s net_device or noref dst is freed before xfrm_trans_reinject() runs. A remote ESP peer sends the packet but cannot unregister the device or change routes, so the attacker who controls the whole race is local: they create the netns, veth and XFRM SA through xfrm_user netlink.\nAC:L - The attacker does both sides of the race. They send ESP transport-mode packets that xfrm4_transport_finish/xfrm6_transport_finish queue through xfrm_trans_queue(), then delete the veth or route while the workqueue is still behind. Flooding the queue up to max_backlog widens the window.\nPR:L - xfrm_user_rcv_msg checks netlink_net_capable(CAP_NET_ADMIN), which an unprivileged user gets in a new user and network namespace (unshare -Urn). That lets them create the SA, the veth devices and the routes the trigger needs.\nUI:N - No victim action is needed. The attacker sets up the namespace, sends the packets and tears down the device or route themselves.\nS:U - The freed net_device, dst_entry and RCU-protected route data are kernel memory, and the impact stays within the kernel\u0027s own security authority.\nC:H - ip6_rcv_finish and dst_input in xfrm_trans_reinject() read a freed skb-\u003edev or noref dst_entry with no reference and no RCU lock. If an attacker reclaims that memory, these use-after-free reads can leak kernel memory.\nI:H - The freed dst_entry holds an input function pointer that dst_input() calls, and net_device is full of ops pointers. Reclaiming either object with attacker-controlled data gives a path to hijacking control flow.\nA:H - A use-after-free of the net_device or dst in the xfrm_trans_reinject worker crashes the kernel, and syzbot hit the missing-RCU path in ip6_pkt_drop. The attacker can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:23.071Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907"
},
{
"url": "https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce"
},
{
"url": "https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb"
},
{
"url": "https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a"
},
{
"url": "https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b"
},
{
"url": "https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4"
},
{
"url": "https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19"
}
],
"title": "xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98369",
"datePublished": "2026-10-06T08:46:54.188Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:23.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98368 (GCVE-0-2026-98368)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
esp: downgrade zerocopy managed frags before mutating skb frags
Summary
In the Linux kernel, the following vulnerability has been resolved:
esp: downgrade zerocopy managed frags before mutating skb frags
On the out-of-place output path (esp->inplace == false) ESP rewrites the
skb frag array: esp_output_head() appends a trailer frag and
esp_output_tail() replaces the frags with a destination page, both
referenced with get_page().
When the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the
payload frags are owned by the ubuf and must not be referenced or
unreferenced individually, but ESP mutates the frag array without ever
downgrading the skb. This breaks the managed-frag invariant two ways:
- esp_ssg_unref() walks the source scatterlist and drops a page
reference for every frag, including the ubuf-owned payload frags,
pushing their refcount below the GUP pin bias while the pages are
still pinned, i.e. a use-after-free of the zerocopy pages;
- esp_output_tail() installs its destination page as frag 0 with
get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so
skb_release_data() takes the skip_unref branch and never drops that
reference, leaking the x->xfrag page at packet rate.
Fix this the way every other frag-mutating site does (__ip_append_data(),
__ip6_append_data(), tcp_sendmsg_locked()) and call
skb_zcopy_downgrade_managed() before ESP touches the frag array: it takes
a real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,
so the per-frag unref in esp_ssg_unref() and the frag release in
skb_release_data() are both balanced and no mixed-ownership frag array is
left behind.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 2359264f377cdbdef2d95868cc8fb572949e48d3
(git)
Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 69a768c12398cada8528080332c822623fa7064d (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 6508304ac2c8cdafca2f4ab915df8c707893e134 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 6cab554f2c0f28773f712ed3a5479103f42ce844 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 0d0845ee61c5df47cc68bc446501f48f71e8dcc6 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < f89416eb3db151170a6f3c6dfc5239d26cdce4d2 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2359264f377cdbdef2d95868cc8fb572949e48d3",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "69a768c12398cada8528080332c822623fa7064d",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "6508304ac2c8cdafca2f4ab915df8c707893e134",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "6cab554f2c0f28773f712ed3a5479103f42ce844",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "0d0845ee61c5df47cc68bc446501f48f71e8dcc6",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "f89416eb3db151170a6f3c6dfc5239d26cdce4d2",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nesp: downgrade zerocopy managed frags before mutating skb frags\n\nOn the out-of-place output path (esp-\u003einplace == false) ESP rewrites the\nskb frag array: esp_output_head() appends a trailer frag and\nesp_output_tail() replaces the frags with a destination page, both\nreferenced with get_page().\n\nWhen the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the\npayload frags are owned by the ubuf and must not be referenced or\nunreferenced individually, but ESP mutates the frag array without ever\ndowngrading the skb. This breaks the managed-frag invariant two ways:\n\n - esp_ssg_unref() walks the source scatterlist and drops a page\n reference for every frag, including the ubuf-owned payload frags,\n pushing their refcount below the GUP pin bias while the pages are\n still pinned, i.e. a use-after-free of the zerocopy pages;\n\n - esp_output_tail() installs its destination page as frag 0 with\n get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so\n skb_release_data() takes the skip_unref branch and never drops that\n reference, leaking the x-\u003exfrag page at packet rate.\n\nFix this the way every other frag-mutating site does (__ip_append_data(),\n__ip6_append_data(), tcp_sendmsg_locked()) and call\nskb_zcopy_downgrade_managed() before ESP touches the frag array: it takes\na real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,\nso the per-frag unref in esp_ssg_unref() and the frag release in\nskb_release_data() are both balanced and no mixed-ownership frag array is\nleft behind."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Managed frags are set only by io_uring\u0027s io_sg_from_iter() for IORING_OP_SEND_ZC/SENDMSG_ZC with IORING_RECVSEND_FIXED_BUF, so a local process must submit the zerocopy send that esp_output_head()/esp6_output_head() then mutates; a remote peer cannot produce a SKBFL_MANAGED_FRAG_REFS skb.\nAC:L - The attacker picks every input: an uncloned UDP skb whose data_len+tailen fits in a page and lacks tailroom reliably takes the esp-\u003einplace=false branch, then esp_ssg_unref() drops refs on the ubuf-owned frags. No race or outside state is needed.\nPR:L - io_uring zerocopy send needs no privilege. The ESP SA/policy can be added inside an unprivileged user+net namespace because xfrm_user_rcv_msg only checks netlink_net_capable(CAP_NET_ADMIN); on a host with IPsec already set up, any local user\u0027s traffic hits it.\nUI:N - The attacker does everything with their own io_uring ring, registered buffer, socket and (namespaced) xfrm state; no other user has to act.\nS:U - The page refcount underflow and the freed page stay inside the kernel\u0027s own authority, so this is a normal local privilege escalation with no VM or sandbox boundary crossed.\nC:H - esp_ssg_unref() pushes the pinned registered-buffer pages\u0027 refcount below the GUP pin bias, so the page is freed while io_uring still has it mapped; once reallocated (e.g. as page tables or slab) the attacker can read kernel memory through the stale buffer.\nI:H - Writing through the still-registered fixed buffer into the freed and reallocated page is a page-level use-after-free write primitive (Dirty-Pagetable style), enough for arbitrary kernel memory corruption and privilege escalation.\nA:H - The page UAF leads to bad-page/refcount oopses, and the missing put_page on the x-\u003exfrag page installed by esp_output_tail() leaks memory at packet rate; both can take the system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:21.920Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3"
},
{
"url": "https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d"
},
{
"url": "https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134"
},
{
"url": "https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844"
},
{
"url": "https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6"
},
{
"url": "https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2"
}
],
"title": "esp: downgrade zerocopy managed frags before mutating skb frags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98368",
"datePublished": "2026-10-06T08:46:53.292Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:21.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98367 (GCVE-0-2026-98367)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
We need to clear cep before release state_lock as siw_qp_llp_close and
siw_qp_modify->siw_qp_llp_close did.
Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock
is released before the error path cleanup. A concurrent ibv_modify_qp()
transitioning the QP to ERROR can race in this window:
siw_accept() ibv_modify_qp(ERROR)
---------------------- ----------------------
siw_qp_modify() fails
up_write(&qp->state_lock)
down_write(&qp->state_lock)
nextstate_from_idle():
if (qp->cep)
siw_cep_put(qp->cep) <- frees cep
qp->cep = NULL
goto error
cep->qp = NULL <- UAF
Clear qp->cep and drop the association reference taken by siw_cep_get(),
all under the write lock held from the initial down_write(&qp->state_lock).
Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free
the cep before siw_accept() is done with it.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078
(git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < e3f039082856adab7e195dea1af45d93dd6a3f1c (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < ad50d19f3d1ce052b3a146143581e930a1efb33e (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 030306bbb9273af80f14d7af20129661964cd9a7 (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < df2584750314336edcbcc21fb388e04b260f35b7 (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 9dcc0f4e488b70cff81e0e5717a498c929cf5de3 (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < bfdc744bf20ae4c3ef2e470298de5237c5c9a13c (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 32cd87f54dd1070020e664ccb0312a9f0fea79b4 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "e3f039082856adab7e195dea1af45d93dd6a3f1c",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "ad50d19f3d1ce052b3a146143581e930a1efb33e",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "030306bbb9273af80f14d7af20129661964cd9a7",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "df2584750314336edcbcc21fb388e04b260f35b7",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "9dcc0f4e488b70cff81e0e5717a498c929cf5de3",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "bfdc744bf20ae4c3ef2e470298de5237c5c9a13c",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "32cd87f54dd1070020e664ccb0312a9f0fea79b4",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept\n\nWe need to clear cep before release state_lock as siw_qp_llp_close and\nsiw_qp_modify-\u003esiw_qp_llp_close did.\n\nOtherwise if siw_qp_modify() fails in siw_accept(), the QP\u0027s state_lock\nis released before the error path cleanup. A concurrent ibv_modify_qp()\ntransitioning the QP to ERROR can race in this window:\n\n siw_accept() ibv_modify_qp(ERROR)\n ---------------------- ----------------------\n siw_qp_modify() fails\n up_write(\u0026qp-\u003estate_lock)\n down_write(\u0026qp-\u003estate_lock)\n nextstate_from_idle():\n\t\t\t\t if (qp-\u003ecep)\n siw_cep_put(qp-\u003ecep) \u003c- frees cep\n qp-\u003ecep = NULL\n goto error\n cep-\u003eqp = NULL \u003c- UAF\n\nClear qp-\u003ecep and drop the association reference taken by siw_cep_get(),\nall under the write lock held from the initial down_write(\u0026qp-\u003estate_lock).\nThread B therefore sees qp-\u003ecep == NULL, skips its own put, and cannot free\nthe cep before siw_accept() is done with it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - siw_accept() is called through the ops.iw_accept hook from iw_cm_accept(), which a local process reaches with the RDMA_USER_CM_CMD_ACCEPT command on /dev/infiniband/rdma_cm. The racing side is the uverbs MODIFY_QP command (ibv_modify_qp to ERROR), also local. No wire message carries data that causes the siw_qp_modify() failure, so the attack is local.\nAC:L - The attacker does control both racing threads, since it owns the QP and issues the accept and modify_qp calls itself. Even so, AC is High: in siw_accept the only way siw_qp_modify() can fail is siw_qp_readq_init() hitting a vcalloc() ENOMEM, and IRD/ORD are capped at 128, so the allocations are small. That failure depends on system-wide memory exhaustion, which the attacker cannot produce on demand.\nPR:L - Running rdma_accept and ibv_modify_qp on a QP the user created on an existing siw device needs only ordinary access to the rdma_cm and uverbs device nodes. Creating the siw link through RDMA_NLDEV_CMD_NEWLINK is admin-only, but no privilege is needed to use a device that already exists.\nUI:N - The attacker drives both siw_accept() and the concurrent ibv_modify_qp(ERROR) through their own rdma_cm and verbs calls, and the connecting peer can be the attacker over loopback. No other user has to do anything.\nS:U - The freed siw_cep and the writes into it both stay inside the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - siw_qp_nextstate_from_idle() frees the siw_cep by calling siw_cep_put(qp-\u003ecep). The error path in siw_accept() then keeps using that freed object: it writes cep-\u003eqp = NULL, runs siw_free_cm_id, and calls siw_cep_set_free_and_put. A reclaimed object in that slot gives the attacker a use-after-free primitive that can be built into a kernel memory leak.\nI:H - After the free, the error path writes cep-\u003eqp = NULL and does kref and lock operations on the dead siw_cep. That corrupts whatever object has taken over the slot, and this kind of UAF write can be used to corrupt kernel data or hijack control flow.\nA:H - A kref_put or lock operation on the freed siw_cep in siw_cep_set_free_and_put can corrupt the slab or oops the kernel, and that crashes the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:20.775Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078"
},
{
"url": "https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c"
},
{
"url": "https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e"
},
{
"url": "https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7"
},
{
"url": "https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7"
},
{
"url": "https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3"
},
{
"url": "https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c"
},
{
"url": "https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4"
}
],
"title": "RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98367",
"datePublished": "2026-10-06T08:46:52.452Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:20.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98366 (GCVE-0-2026-98366)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/rxe: validate access flags before swapping the MR's PD
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: validate access flags before swapping the MR's PD
rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then
validates the IB_MR_REREG_ACCESS argument:
if (flags & IB_MR_REREG_PD) {
rxe_put(old_pd);
rxe_get(pd);
mr->ibmr.pd = ibpd;
}
if (flags & IB_MR_REREG_ACCESS) {
if (access & ~RXE_ACCESS_SUPPORTED_MR)
return ERR_PTR(-EOPNOTSUPP);
mr->access = access;
}
Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is
IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access
check with mr->ibmr.pd already reassigned.
mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the
success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error
without undoing the reassignment, so mr->pd == new_pd while the usecnts
still charge the MR to orig_pd. ib_dereg_mr_user() then decrements
new_pd, whose count can reach zero while a memory window still references
it; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()
writes to freed memory:
BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0
Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591
__rxe_put+0x31/0xa0
rxe_mw_cleanup+0x42/0x200
__rxe_cleanup+0x115/0x370
rxe_dealloc_mw+0x4c/0x80
Allocated by task 591:
ib_uverbs_alloc_pd+0x258/0x540
Freed by task 591:
ib_dealloc_pd_user+0x174/0x210
uverbs_free_pd+0x8d/0xc0
ib_uverbs_dealloc_pd+0x18e/0x1d0
Validate the access flags before mutating any state so the callback either
applies every requested change or none.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < 08f12745cb72981aa2cabe214af0c7a42a856f0a
(git)
Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < 7230cc456d4bb2221c20c5f1d22b38b8576aa16f (git) Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < fe602c91a52e161ace4afd5bdb8f33270c554c6f (git) Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < 4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8 (git) Affected: 544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c , < ae36a5b609ae79f4de966328b78d2584be9719a4 (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08f12745cb72981aa2cabe214af0c7a42a856f0a",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "7230cc456d4bb2221c20c5f1d22b38b8576aa16f",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "fe602c91a52e161ace4afd5bdb8f33270c554c6f",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "ae36a5b609ae79f4de966328b78d2584be9719a4",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: validate access flags before swapping the MR\u0027s PD\n\nrxe_rereg_user_mr() reassigns mr-\u003eibmr.pd first and only then\nvalidates the IB_MR_REREG_ACCESS argument:\n\n\tif (flags \u0026 IB_MR_REREG_PD) {\n\t\trxe_put(old_pd);\n\t\trxe_get(pd);\n\t\tmr-\u003eibmr.pd = ibpd;\n\t}\n\n\tif (flags \u0026 IB_MR_REREG_ACCESS) {\n\t\tif (access \u0026 ~RXE_ACCESS_SUPPORTED_MR)\n\t\t\treturn ERR_PTR(-EOPNOTSUPP);\n\t\tmr-\u003eaccess = access;\n\t}\n\nBoth flags pass the entry check because RXE_MR_REREG_SUPPORTED is\nIB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access\ncheck with mr-\u003eibmr.pd already reassigned.\n\nmr-\u003eibmr.pd is owned by the core, which adjusts pd-\u003eusecnt only on the\nsuccess path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error\nwithout undoing the reassignment, so mr-\u003epd == new_pd while the usecnts\nstill charge the MR to orig_pd. ib_dereg_mr_user() then decrements\nnew_pd, whose count can reach zero while a memory window still references\nit; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()\nwrites to freed memory:\n\n BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0\n Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591\n __rxe_put+0x31/0xa0\n rxe_mw_cleanup+0x42/0x200\n __rxe_cleanup+0x115/0x370\n rxe_dealloc_mw+0x4c/0x80\n Allocated by task 591:\n ib_uverbs_alloc_pd+0x258/0x540\n Freed by task 591:\n ib_dealloc_pd_user+0x174/0x210\n uverbs_free_pd+0x8d/0xc0\n ib_uverbs_dealloc_pd+0x18e/0x1d0\n\nValidate the access flags before mutating any state so the callback either\napplies every requested change or none."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad access_flags/pd_handle reach rxe_rereg_user_mr() only through a local IB_USER_VERBS_CMD_REREG_MR on /dev/infiniband/uverbsN via ib_uverbs_rereg_mr(); no RoCE packet carries rereg arguments, so a remote peer cannot drive it.\nAC:L - Deterministic: flags IB_MR_REREG_PD|IB_MR_REREG_ACCESS with access=IB_ACCESS_RELAXED_ORDERING passes core ib_check_mr_access() but fails RXE_ACCESS_SUPPORTED_MR after mr-\u003eibmr.pd was swapped; the attacker then deregs the MR and deallocs the PD its own MW still uses. No race.\nPR:L - uverbs_devnode() creates /dev/infiniband/uverbsN mode 0666 and there is no capability check from ib_uverbs_rereg_mr() to rxe_rereg_user_mr(); any unprivileged local user owning a PD/MR/MW triggers it. Only the one-time admin rxe link creation (RDMA_NL_ADMIN_PERM) is needed.\nUI:N - The attacker\u0027s own process issues alloc_pd, reg_mr, alloc_mw, the failing rereg_mr, dereg_mr and dealloc_pd; no other user or administrator action is involved.\nS:U - The freed rxe PD and the corrupted refcounts are kernel heap objects within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After uverbs_free_pd() frees the PD on usecnt alone, the surviving MW still holds a dangling pointer to it; reclaiming that slab object with sprayed data turns later accesses through the MW into a use-after-free read of attacker-shaped memory.\nI:H - rxe_mw_cleanup() -\u003e __rxe_put() writes (refcount decrement, KASAN write of size 4) into the freed PD, and the inconsistent mr-\u003epd vs usecnt state can be repeated; a decrement into reallocated slab memory is a usable corruption primitive toward privilege escalation.\nA:H - The use-after-free write in __rxe_put() during rxe_dealloc_mw() corrupts freed slab memory and can oops or panic the kernel, and an unprivileged user can repeat it at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:19.619Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08f12745cb72981aa2cabe214af0c7a42a856f0a"
},
{
"url": "https://git.kernel.org/stable/c/7230cc456d4bb2221c20c5f1d22b38b8576aa16f"
},
{
"url": "https://git.kernel.org/stable/c/fe602c91a52e161ace4afd5bdb8f33270c554c6f"
},
{
"url": "https://git.kernel.org/stable/c/4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8"
},
{
"url": "https://git.kernel.org/stable/c/ae36a5b609ae79f4de966328b78d2584be9719a4"
}
],
"title": "RDMA/rxe: validate access flags before swapping the MR\u0027s PD",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98366",
"datePublished": "2026-10-06T08:46:51.638Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:19.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98365 (GCVE-0-2026-98365)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
mr_check_range() validates that [iova, iova+length) falls within the
registered MR range using wraparound-prone arithmetic:
if (iova < mr->ibmr.iova ||
iova + length > mr->ibmr.iova + mr->ibmr.length)
A remote peer can craft an RDMA-Write/Read RETH so that iova + length
wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the
check. rxe_mr_iova_to_index() then computes a huge index (int idx, only
guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences
mr->page_info[huge], causing an out-of-bounds read/write and a kernel
oops that is triggerable by an unauthenticated remote peer.
Rewrite the check in overflow-safe form; the first two clauses guarantee
that the subsequent subtractions do not underflow:
if (iova < mr->ibmr.iova ||
length > mr->ibmr.length ||
iova - mr->ibmr.iova > mr->ibmr.length - length)
With the fix, mr_check_range() returns -EINVAL for the crafted iova and
the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8700e3e7c4857d28ebaa824509934556da0b3e76 , < b7d2118660545a00b21e83010ded1a231c6fb8c5
(git)
Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 5d9426a74fc8cb8f375fcdc19b465a030f9b8cab (git) Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 2f3b705144e3a3c14184fec6e354680081fe91ec (git) Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < 3431f525718f6b07da308cda6d44f8cb548bbd37 (git) Affected: 8700e3e7c4857d28ebaa824509934556da0b3e76 , < d10e2a08799e858d3e71ea4169bcd018f216d444 (git) |
|
| Linux | Linux |
Affected:
4.8
Unaffected: 0 , < 4.8 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7d2118660545a00b21e83010ded1a231c6fb8c5",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "5d9426a74fc8cb8f375fcdc19b465a030f9b8cab",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "2f3b705144e3a3c14184fec6e354680081fe91ec",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "3431f525718f6b07da308cda6d44f8cb548bbd37",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "d10e2a08799e858d3e71ea4169bcd018f216d444",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access\n\nmr_check_range() validates that [iova, iova+length) falls within the\nregistered MR range using wraparound-prone arithmetic:\n\n if (iova \u003c mr-\u003eibmr.iova ||\n iova + length \u003e mr-\u003eibmr.iova + mr-\u003eibmr.length)\n\nA remote peer can craft an RDMA-Write/Read RETH so that iova + length\nwraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the\ncheck. rxe_mr_iova_to_index() then computes a huge index (int idx, only\nguarded by WARN_ON) and rxe_mr_copy_xarray() dereferences\nmr-\u003epage_info[huge], causing an out-of-bounds read/write and a kernel\noops that is triggerable by an unauthenticated remote peer.\n\nRewrite the check in overflow-safe form; the first two clauses guarantee\nthat the subsequent subtractions do not underflow:\n\n if (iova \u003c mr-\u003eibmr.iova ||\n length \u003e mr-\u003eibmr.length ||\n iova - mr-\u003eibmr.iova \u003e mr-\u003eibmr.length - length)\n\nWith the fix, mr_check_range() returns -EINVAL for the crafted iova and\nthe responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bad iova and length come from the RETH header of a RoCEv2 RDMA WRITE/READ (UDP/IP, routable). qp_resp_from_reth() copies them into qp-\u003eresp, and check_rkey() hands them to mr_check_range(), where iova+length wraps past 2^64 and the bounds check passes.\nAC:L - The attacker is the connected RC peer, so it controls the QPN, PSN and RETH contents and chooses va near 2^64 to make iova+length wrap for any MR. The bug fires on the first packet, with no race or memory layout to win.\nPR:N - RoCE has no authentication. check_addr() only matches the peer\u0027s IP address, and services such as rtrs-srv send MR rkeys with IB_ACCESS_REMOTE_WRITE to any client that connects, without checking credentials.\nUI:N - No victim action is needed. The responder processes the attacker\u0027s RETH request entirely in kernel receive context once the QP is connected.\nS:U - The out-of-bounds access corrupts or discloses kernel memory on the same host, inside the kernel\u0027s own security authority. No VM or IOMMU boundary is crossed.\nC:H - For RDMA READ, rxe_mr_copy_xarray() memcpy()s from a struct page pointer read out of bounds of mr-\u003epage_info[], and that data is sent back to the remote peer. Choosing va moves the index over a window of about 2^20 entries.\nI:H - For RDMA WRITE, rxe_mr_copy_xarray() memcpy()s the peer\u0027s payload into the page pointed to by the out-of-bounds page_info[idx].page entry. That is a remote write into kernel-chosen memory, which can be used to hijack control flow.\nA:H - An out-of-bounds page_info index, past the WARN_ON in rxe_mr_iova_to_index(), dereferences garbage page pointers and oopses the kernel. A remote peer can repeat this at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:18.479Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7d2118660545a00b21e83010ded1a231c6fb8c5"
},
{
"url": "https://git.kernel.org/stable/c/5d9426a74fc8cb8f375fcdc19b465a030f9b8cab"
},
{
"url": "https://git.kernel.org/stable/c/2f3b705144e3a3c14184fec6e354680081fe91ec"
},
{
"url": "https://git.kernel.org/stable/c/3431f525718f6b07da308cda6d44f8cb548bbd37"
},
{
"url": "https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"
}
],
"title": "RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98365",
"datePublished": "2026-10-06T08:46:50.834Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:18.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98364 (GCVE-0-2026-98364)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
xfrm: hold net_device reference under RCU in bundle creation
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold net_device reference under RCU in bundle creation
xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into
a local pointer without taking a device reference, then pass it to
xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via
dst_dev_put() and frees the old net_device, causing a use-after-free
when xfrm6_fill_dst() later dereferences the stale dev pointer.
BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860
(net/ipv6/xfrm6_policy.c:86 netdev_hold())
Read of size 8 at addr ffff8880142fe588 by task exploit/153
Call Trace:
xfrm6_fill_dst+0x82c/0x860
xfrm_resolve_and_create_bundle+0x21d4/0x2bd0
xfrm_lookup_with_ifid+0x485/0x1640
ip6_dst_lookup_flow+0x19b/0x1e0
udpv6_sendmsg+0x1443/0x2dd0
Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU
read-side critical section active until xfrm_fill_dst() has taken the
required device references.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
25ee3286dcbc830a833354bb1d15567956844813 , < 8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807
(git)
Affected: 25ee3286dcbc830a833354bb1d15567956844813 , < 9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1 (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807",
"status": "affected",
"version": "25ee3286dcbc830a833354bb1d15567956844813",
"versionType": "git"
},
{
"lessThan": "9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1",
"status": "affected",
"version": "25ee3286dcbc830a833354bb1d15567956844813",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-\u003edev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst-\u003edev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n Read of size 8 at addr ffff8880142fe588 by task exploit/153\n Call Trace:\n xfrm6_fill_dst+0x82c/0x860\n xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n xfrm_lookup_with_ifid+0x485/0x1640\n ip6_dst_lookup_flow+0x19b/0x1e0\n udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst-\u003edev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Both sides of the race are local syscalls: sendmsg() (udpv6_sendmsg-\u003eip6_dst_lookup_flow-\u003exfrm_lookup_with_ifid-\u003exfrm_bundle_create) and an RTM_DELLINK rtnetlink request that frees the net_device. A remote peer cannot delete the link, so the network cannot cause the freed state.\nAC:L - The attacker controls both sides of the race: they repeatedly send through an xfrm-policy-matched route while deleting the link in a loop. The window between reading dst-\u003edev and netdev_hold() in xfrm_fill_dst() is short, but the attacker can retry as often as needed.\nPR:L - xfrm_user_rcv_msg only checks netlink_net_capable(CAP_NET_ADMIN), and RTM_DELLINK is also checked per namespace. An unprivileged user with unshare -Urn can create a device, install the XFRM policy and state, and delete the device inside their own network namespace.\nUI:N - No victim action is needed: the attacker sets up the namespace, the xfrm configuration, the sending socket and the link deletion entirely on their own.\nS:U - The use-after-free is inside the kernel\u0027s own networking code and the impact stays within the kernel\u0027s security authority; no VM or IOMMU boundary is crossed.\nC:H - xfrm6_fill_dst() reads dev-\u003eip6_ptr from the freed net_device through in6_dev_get() and stores the stale dev in a new dst. A reclaimed object controls those values, which can be used to disclose kernel memory.\nI:H - netdev_hold() increments a refcount inside the freed net_device, and in6_dev_get() increments a refcount on a pointer taken from the reclaimed object. Both are writes into attacker-reclaimable slab memory, usable to corrupt kernel data and hijack control flow.\nA:H - KASAN reports a slab-use-after-free in xfrm6_fill_dst(). On production kernels the stale dev stays attached to the new xfrm dst and is dereferenced later, which leads to an oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:17.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807"
},
{
"url": "https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"
}
],
"title": "xfrm: hold net_device reference under RCU in bundle creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98364",
"datePublished": "2026-10-06T08:46:50.051Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:17.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98363 (GCVE-0-2026-98363)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted
any larger value from the SCP firmware. The shared-memory reply only holds
MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array
and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).
The missing upper bound dates back to the original SCPI DVFS support.
Reject zero and out-of-range counts in one check and return -EINVAL.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < e9887eeaa138c6b5697af3d2f7c71dc82407b154
(git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 1aadbef648e92ca642125f188f99b0a26628e3ba (git) Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 7daaa684097377b66b98a832de307688a7f3bbc7 (git) Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < f17865332cc4ceaac846bcd7c28badbaedfabeff (git) Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901 (git) Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 69ec03cd481973e4be44a7158ed6c0fa06a9a5f9 (git) Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < cc563a59aded6f3b02d75dcc3c0bc5e90755d99e (git) Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 32471d84a487c7fd74532bc96be56f8028cf4a3f (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9887eeaa138c6b5697af3d2f7c71dc82407b154",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "1aadbef648e92ca642125f188f99b0a26628e3ba",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "7daaa684097377b66b98a832de307688a7f3bbc7",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "f17865332cc4ceaac846bcd7c28badbaedfabeff",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "69ec03cd481973e4be44a7158ed6c0fa06a9a5f9",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "cc563a59aded6f3b02d75dcc3c0bc5e90755d99e",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "32471d84a487c7fd74532bc96be56f8028cf4a3f",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\n\nscpi_dvfs_get_info() already rejected a zero opp_count, but still trusted\nany larger value from the SCP firmware. The shared-memory reply only holds\nMAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array\nand then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).\nThe missing upper bound dates back to the original SCPI DVFS support.\n\nReject zero and out-of-range counts in one check and return -EINVAL."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:49.235Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9887eeaa138c6b5697af3d2f7c71dc82407b154"
},
{
"url": "https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba"
},
{
"url": "https://git.kernel.org/stable/c/7daaa684097377b66b98a832de307688a7f3bbc7"
},
{
"url": "https://git.kernel.org/stable/c/f17865332cc4ceaac846bcd7c28badbaedfabeff"
},
{
"url": "https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901"
},
{
"url": "https://git.kernel.org/stable/c/69ec03cd481973e4be44a7158ed6c0fa06a9a5f9"
},
{
"url": "https://git.kernel.org/stable/c/cc563a59aded6f3b02d75dcc3c0bc5e90755d99e"
},
{
"url": "https://git.kernel.org/stable/c/32471d84a487c7fd74532bc96be56f8028cf4a3f"
}
],
"title": "firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98363",
"datePublished": "2026-10-06T08:46:49.235Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:49.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98362 (GCVE-0-2026-98362)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
dvfs_get_idx() may return an out-of-range index if the SCP firmware is
buggy or returns a stale value. Only negative indexes were rejected, so a
large index walked past info->opps and could treat garbage as a clock rate
(KASAN OOB / wrong frequency to consumers). The missing upper bound dates
back to the original SCPI clock driver.
Treat indexes >= opp count as invalid and return 0, same as idx < 0.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cd52c2a4b5c43631e429d06dce12e08b0cab477f , < 6e3b55823da8ef0d99621efb422cc29f50d7f280
(git)
Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < 7204095917aeaac89db7377c29a457351a19b076 (git) Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < 0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a (git) Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < 56b7a9d89c67932bf11b71e3b6d17941fc24a393 (git) Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < a82b274697d0876b478594ca78ad1e6cb062467b (git) Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < e1188332a9110cf3635fe286481ee38305b3c2b6 (git) Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < 108c46e8dacc4a0e472a74f98171115d49cbc079 (git) Affected: cd52c2a4b5c43631e429d06dce12e08b0cab477f , < 70f4b78d560e592cbf3325b162424737d032fc1d (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e3b55823da8ef0d99621efb422cc29f50d7f280",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "7204095917aeaac89db7377c29a457351a19b076",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "56b7a9d89c67932bf11b71e3b6d17941fc24a393",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "a82b274697d0876b478594ca78ad1e6cb062467b",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "e1188332a9110cf3635fe286481ee38305b3c2b6",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "108c46e8dacc4a0e472a74f98171115d49cbc079",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "70f4b78d560e592cbf3325b162424737d032fc1d",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate\n\ndvfs_get_idx() may return an out-of-range index if the SCP firmware is\nbuggy or returns a stale value. Only negative indexes were rejected, so a\nlarge index walked past info-\u003eopps and could treat garbage as a clock rate\n(KASAN OOB / wrong frequency to consumers). The missing upper bound dates\nback to the original SCPI clock driver.\n\nTreat indexes \u003e= opp count as invalid and return 0, same as idx \u003c 0."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:48.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e3b55823da8ef0d99621efb422cc29f50d7f280"
},
{
"url": "https://git.kernel.org/stable/c/7204095917aeaac89db7377c29a457351a19b076"
},
{
"url": "https://git.kernel.org/stable/c/0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a"
},
{
"url": "https://git.kernel.org/stable/c/56b7a9d89c67932bf11b71e3b6d17941fc24a393"
},
{
"url": "https://git.kernel.org/stable/c/a82b274697d0876b478594ca78ad1e6cb062467b"
},
{
"url": "https://git.kernel.org/stable/c/e1188332a9110cf3635fe286481ee38305b3c2b6"
},
{
"url": "https://git.kernel.org/stable/c/108c46e8dacc4a0e472a74f98171115d49cbc079"
},
{
"url": "https://git.kernel.org/stable/c/70f4b78d560e592cbf3325b162424737d032fc1d"
}
],
"title": "clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98362",
"datePublished": "2026-10-06T08:46:48.426Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:48.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98361 (GCVE-0-2026-98361)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
Commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO
pages") dropped the access permission test from rxe_check_pagefault()
and left only HMM_PFN_VALID. A page faulted in read-only, for example
a page-cache folio behind a PROT_READ file mapping, then satisfies the
check and ODP write operations (RDMA WRITE, RDMA READ response, SEND
payload, atomics) modify it through kmap without ever breaking CoW.
An unprivileged user can register an ODP MR over such a mapping and
have incoming RDMA traffic overwrite the page cache of a file it only
holds O_RDONLY, including /etc/passwd or setuid binaries. This is the
same primitive class as Dirty COW and CVE-2022-2590.
mlx5 has the missing invariant: its ODP path sets the device write bit
only for pfns that carry HMM_PFN_WRITE. Restore it in rxe by requiring
HMM_PFN_WRITE in rxe_check_pagefault() for every operation except
RXE_PAGEFAULT_RDONLY. A write to a non-writable VMA now fails the one
fault attempt with -EPERM from hmm_vma_fault() instead of re-faulting
forever. For a writable VMA the fault breaks CoW and the write lands
in the private page.
Keep pmem flushes on the read-only check. arch_wb_cache_pmem() never
modifies memory, and the FLUSH access bits do not make the umem
writable, so classifying flushes as writes would make every flush
against a flush-only MR fail.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0b261d7c1cd32dc93cbc92425fb55e67b24c6638 , < c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425
(git)
Affected: 0b261d7c1cd32dc93cbc92425fb55e67b24c6638 , < 2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1 (git) Affected: 0b261d7c1cd32dc93cbc92425fb55e67b24c6638 , < 769001ce838d907ecaa95f1d0a4e8fc86f761f9f (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_odp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425",
"status": "affected",
"version": "0b261d7c1cd32dc93cbc92425fb55e67b24c6638",
"versionType": "git"
},
{
"lessThan": "2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1",
"status": "affected",
"version": "0b261d7c1cd32dc93cbc92425fb55e67b24c6638",
"versionType": "git"
},
{
"lessThan": "769001ce838d907ecaa95f1d0a4e8fc86f761f9f",
"status": "affected",
"version": "0b261d7c1cd32dc93cbc92425fb55e67b24c6638",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_odp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths\n\nCommit 0b261d7c1cd3 (\"RDMA/rxe: Break endless pagefault loop for RO\npages\") dropped the access permission test from rxe_check_pagefault()\nand left only HMM_PFN_VALID. A page faulted in read-only, for example\na page-cache folio behind a PROT_READ file mapping, then satisfies the\ncheck and ODP write operations (RDMA WRITE, RDMA READ response, SEND\npayload, atomics) modify it through kmap without ever breaking CoW.\n\nAn unprivileged user can register an ODP MR over such a mapping and\nhave incoming RDMA traffic overwrite the page cache of a file it only\nholds O_RDONLY, including /etc/passwd or setuid binaries. This is the\nsame primitive class as Dirty COW and CVE-2022-2590.\n\nmlx5 has the missing invariant: its ODP path sets the device write bit\nonly for pfns that carry HMM_PFN_WRITE. Restore it in rxe by requiring\nHMM_PFN_WRITE in rxe_check_pagefault() for every operation except\nRXE_PAGEFAULT_RDONLY. A write to a non-writable VMA now fails the one\nfault attempt with -EPERM from hmm_vma_fault() instead of re-faulting\nforever. For a writable VMA the fault breaks CoW and the write lands\nin the private page.\n\nKeep pmem flushes on the read-only check. arch_wb_cache_pmem() never\nmodifies memory, and the FLUSH access bits do not make the umem\nwritable, so classifying flushes as writes would make every flush\nagainst a flush-only MR fail."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug needs an ODP MR with remote write access, created by a local user through uverbs reg_user_mr (rxe_reg_user_mr -\u003e rxe_odp_mr_init_user) over their own PROT_READ file mapping. The RDMA WRITE/SEND/atomic that reaches rxe_odp_map_range_and_lock can come from the same user\u0027s QP on the same rxe device, and a remote peer cannot set up this state on its own.\nAC:L - Once an rxe device exists, the attacker controls every step: mmap a readable file PROT_READ, fault the pages in read-only, register the MR so the snapshot rxe_odp_init_pages() records them HMM_PFN_VALID without WRITE, then post an RDMA WRITE to it. rxe_check_pagefault() only tested VALID, so the result is deterministic with no race.\nPR:L - Registering an MR and QPs on /dev/infiniband/uverbs* needs no capability, and the device is normally world-accessible. Only creating the rxe link (rdma link add, RDMA_NL_ADMIN_PERM) needs CAP_NET_ADMIN in init_user_ns. The attacker needs only read access to the target file.\nUI:N - The attacker does everything with their own syscalls and RDMA operations on mappings they own; no other user or admin has to act at the time of the attack.\nS:U - The impact is writes to the page cache through kmap_local_page in __rxe_odp_mr_copy, inside the same kernel authority. It is a standard local privilege escalation and crosses no VM or IOMMU boundary.\nC:H - Overwriting the cached contents of root-owned files the user can only read (/etc/passwd, /etc/shadow handling, setuid binaries) leads to root, which exposes all data on the system, as with Dirty COW and CVE-2022-2590.\nI:H - __rxe_odp_mr_copy (RXE_TO_MR_OBJ) and rxe_odp_do_atomic_op/atomic_write write attacker-chosen bytes into read-only page-cache folios without breaking CoW, so arbitrary file contents can be modified and setuid binaries rewritten for code execution as root.\nA:H - With write access to the page cache of system binaries and libraries, the attacker can corrupt critical files such as init and libc, or take root, and make the system unusable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:16.164Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425"
},
{
"url": "https://git.kernel.org/stable/c/2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1"
},
{
"url": "https://git.kernel.org/stable/c/769001ce838d907ecaa95f1d0a4e8fc86f761f9f"
}
],
"title": "RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98361",
"datePublished": "2026-10-06T08:46:47.600Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:16.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98360 (GCVE-0-2026-98360)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
rxe_get_mcg() publishes a newly allocated multicast group in
rxe->mcg_tree before programming the backing Ethernet multicast address
with rxe_mcast_add(), which runs outside mcg_lock. A local userspace
RDMA client reaches this path with ATTACH_MCAST on a UD QP; if
rxe_mcast_add() then returns an error (for example -ENODEV when the
backing netdev has been removed, or a propagated dev_mc_add() error),
the unwind frees the published group without removing it from the tree.
A later lookup of the same MGID dereferences the freed struct rxe_mcg
from __rxe_lookup_mcg().
Fix this by keeping the new mcg private until rxe_mcast_add() succeeds.
Split the tree publication into __rxe_publish_mcg(), call rxe_mcast_add()
before taking the tree reference, and free the still-private mcg on
failure. Because the group is never visible in mcg_tree until the
multicast address is programmed, no concurrent caller can look it up or
attach a QP to a group that is about to be torn down, so the error path
needs no conditional unwind. If another caller publishes the same MGID
while the address is being programmed, the post-add re-check under
mcg_lock finds the winner; this caller then drops its private object and
balances its own rxe_mcast_add() with rxe_mcast_del() before returning
the winner.
Reproduced by forcing the rxe_mcast_add() error return under KASAN:
without the change the next attach to the same MGID reports a
slab-use-after-free in __rxe_lookup_mcg(); with it the forced failure
returns cleanly. A no-injection attach/detach regression, including a
two-QP shared join/leave and re-attach, stays KASAN- and leak-clean.
Severity
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a926a903b7dc39a8a949150258c09290998dd812 , < ddb43ac0926d4a931bc9b7744b93627f627457e5
(git)
Affected: a926a903b7dc39a8a949150258c09290998dd812 , < c79a789aa15180a1543b5db49c343d12e3ec214d (git) Affected: a926a903b7dc39a8a949150258c09290998dd812 , < faae1fb4ccf8205806a8802c008798dabeb0205b (git) Affected: a926a903b7dc39a8a949150258c09290998dd812 , < 02c0a2fa69c16248a7432af8a6d64ab2a73a5283 (git) Affected: a926a903b7dc39a8a949150258c09290998dd812 , < d4fc4e37f8a143b0fe83b42c8fb48cf542154fee (git) Affected: a926a903b7dc39a8a949150258c09290998dd812 , < 1caceeb2d74bbe88223aea55eb8626b4c5f076fd (git) |
|
| Linux | Linux |
Affected:
5.18
Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ddb43ac0926d4a931bc9b7744b93627f627457e5",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "c79a789aa15180a1543b5db49c343d12e3ec214d",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "faae1fb4ccf8205806a8802c008798dabeb0205b",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "02c0a2fa69c16248a7432af8a6d64ab2a73a5283",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "d4fc4e37f8a143b0fe83b42c8fb48cf542154fee",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "1caceeb2d74bbe88223aea55eb8626b4c5f076fd",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds\n\nrxe_get_mcg() publishes a newly allocated multicast group in\nrxe-\u003emcg_tree before programming the backing Ethernet multicast address\nwith rxe_mcast_add(), which runs outside mcg_lock. A local userspace\nRDMA client reaches this path with ATTACH_MCAST on a UD QP; if\nrxe_mcast_add() then returns an error (for example -ENODEV when the\nbacking netdev has been removed, or a propagated dev_mc_add() error),\nthe unwind frees the published group without removing it from the tree.\nA later lookup of the same MGID dereferences the freed struct rxe_mcg\nfrom __rxe_lookup_mcg().\n\nFix this by keeping the new mcg private until rxe_mcast_add() succeeds.\nSplit the tree publication into __rxe_publish_mcg(), call rxe_mcast_add()\nbefore taking the tree reference, and free the still-private mcg on\nfailure. Because the group is never visible in mcg_tree until the\nmulticast address is programmed, no concurrent caller can look it up or\nattach a QP to a group that is about to be torn down, so the error path\nneeds no conditional unwind. If another caller publishes the same MGID\nwhile the address is being programmed, the post-add re-check under\nmcg_lock finds the winner; this caller then drops its private object and\nbalances its own rxe_mcast_add() with rxe_mcast_del() before returning\nthe winner.\n\nReproduced by forcing the rxe_mcast_add() error return under KASAN:\nwithout the change the next attach to the same MGID reports a\nslab-use-after-free in __rxe_lookup_mcg(); with it the forced failure\nreturns cleanly. A no-injection attach/detach regression, including a\ntwo-QP shared join/leave and re-attach, stays KASAN- and leak-clean."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The faulty publish-then-free sequence is in rxe_get_mcg(), reached from the uverbs ATTACH_MCAST command (ib_uverbs_attach_mcast -\u003e ib_attach_mcast -\u003e rxe_attach_mcast) on a local UD QP. A remote RoCEv2 multicast packet (rxe_rcv_mcast_pkt -\u003e rxe_lookup_mcg) can only hit the stale node after a local caller has already caused the failure.\nAC:H - The dangling mcg is only left behind when rxe_mcast_add() fails after the group is published. That needs ib_device_get_netdev() to return NULL while the rxe netdev is being unregistered (an admin or hardware event), or a GFP_ATOMIC failure in __hw_addr_create(). An unprivileged user cannot produce either on demand.\nPR:L - ib_uverbs_attach_mcast() and rxe_attach_mcast() have no capability check, so any user who can open the rxe uverbs device and create a UD QP can drive rxe_get_mcg(). Creating the rxe link itself (RDMA_NL_ADMIN_PERM, checked with netlink_capable against the init namespace) is admin setup the attacker does not perform.\nUI:N - The attacker issues ATTACH_MCAST for the failing MGID and then the follow-up attach/detach/lookup themselves; no other user has to act.\nS:U - The freed rxe_mcg is kernel heap memory in the same kernel security authority; there is no VM, IOMMU or sandbox boundary crossed.\nC:H - The freed struct rxe_mcg stays linked in rxe-\u003emcg_tree. __rxe_lookup_mcg() walks its rb_node and mgid, and later code follows its qp_list, so reallocating that slab slot with attacker-chosen data gives a heap read primitive.\nI:H - After the free, __rxe_lookup_mcg() does kref_get() on the stale object, and rxe_attach_mcg() list_add()s an mca into its qp_list and updates qp_num. These are writes into reallocated memory, and the rb-tree insert/erase relinks through the freed node.\nA:H - The next ATTACH_MCAST, detach, or received multicast lookup for that MGID dereferences the freed rxe_mcg (KASAN slab-use-after-free in __rxe_lookup_mcg()), corrupting the rb-tree and crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:14.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ddb43ac0926d4a931bc9b7744b93627f627457e5"
},
{
"url": "https://git.kernel.org/stable/c/c79a789aa15180a1543b5db49c343d12e3ec214d"
},
{
"url": "https://git.kernel.org/stable/c/faae1fb4ccf8205806a8802c008798dabeb0205b"
},
{
"url": "https://git.kernel.org/stable/c/02c0a2fa69c16248a7432af8a6d64ab2a73a5283"
},
{
"url": "https://git.kernel.org/stable/c/d4fc4e37f8a143b0fe83b42c8fb48cf542154fee"
},
{
"url": "https://git.kernel.org/stable/c/1caceeb2d74bbe88223aea55eb8626b4c5f076fd"
}
],
"title": "RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98360",
"datePublished": "2026-10-06T08:46:46.743Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:14.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98359 (GCVE-0-2026-98359)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
ib_device_get_netdev() intentionally returns a referenced net_device even
when it is unregistering, so matching and cleanup callers can still find
the association. The reference keeps struct net_device allocated, but does
not guarantee that the device remains operational.
ib_get_eth_speed() uses the returned device operationally by invoking its
ethtool callback. Although that call is made under RTNL, the function does
not verify the registration state first. An asynchronous RDMA port query
can therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit
have completed.
Check for NETREG_REGISTERED while holding RTNL and return -ENODEV for a
device which is being unregistered. Keeping RTNL across the check and the
ethtool operation prevents unregister from starting between them.
Keep the speed fallback and warning under RTNL as well, so the warning can
safely read netdev->name. Drop the netdev reference before releasing RTNL
once all accesses to the device are complete.
Severity
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d41861942fc55c14b6280d9568a0d0112037f065 , < be4b44c8b47c67a04c08b1a0aba18006b749ae6a
(git)
Affected: d41861942fc55c14b6280d9568a0d0112037f065 , < 45c60ffc79771bad154f224a05753191cf1b37bc (git) Affected: d41861942fc55c14b6280d9568a0d0112037f065 , < 520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e (git) Affected: d41861942fc55c14b6280d9568a0d0112037f065 , < a219459fbd1b2598e63c81a52847eba6c28b72d2 (git) Affected: d41861942fc55c14b6280d9568a0d0112037f065 , < 5bd42f74ec3b4f4687fb600f367af0828d513b3c (git) Affected: d41861942fc55c14b6280d9568a0d0112037f065 , < ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5 (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be4b44c8b47c67a04c08b1a0aba18006b749ae6a",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "45c60ffc79771bad154f224a05753191cf1b37bc",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "a219459fbd1b2598e63c81a52847eba6c28b72d2",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "5bd42f74ec3b4f4687fb600f367af0828d513b3c",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev-\u003ename. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - ib_get_eth_speed() is reached via ib_query_port() -\u003e driver query_port (rxe_query_port, siw_query_port, irdma, bnxt_re, hns, mana, erdma...) from local uverbs QUERY_PORT ioctls on /dev/infiniband/uverbs*, RDMA_NLDEV_CMD_PORT_GET netlink or the ib cache work; no remote peer supplies data to this path.\nAC:H - The faulty call needs the port\u0027s bound netdev to be between NETDEV_UNREGISTER/ndo_uninit and the queued ib_unregister_device_queued() teardown. The querying user can hammer query_port, but unregistering that netdev is an admin or driver action they cannot arrange on demand.\nPR:L - The query side needs no capability: RDMA_NLDEV_CMD_PORT_GET has no RDMA_NL_ADMIN_PERM flag, and uverbs query_port only needs an open uverbs device. Binding rxe/siw via RDMA_NLDEV_CMD_NEWLINK needs init-ns CAP_NET_ADMIN, so the attacker relies on an existing RoCE/iWARP port.\nUI:N - No victim action is needed. The attacker only issues port queries, and the unregister event is a system state change (counted under AC:H), not a user being tricked into doing something.\nS:U - The bug and its impact are both in the host kernel. No VM, IOMMU or sandbox boundary is crossed.\nC:H - __ethtool_get_link_ksettings() runs on a netdev whose ndo_uninit has already run. For example, ipvlan_ethtool_get_link_ksettings() dereferences ipvlan-\u003ephy_dev after ipvlan_port_put() dropped the port\u0027s phy_dev reference, which lets freed net_device memory be read.\nI:H - The stale or freed lower net_device is used to load and call ethtool_ops-\u003eget_link_ksettings through a function pointer. A use-after-free that reaches an indirect call can be groomed toward control-flow hijack.\nA:H - syzbot hit this as a kernel crash. Calling ethtool callbacks on a torn-down device (freed pcpu/port state in macvlan/ipvlan/team uninit) oopses the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:13.845Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a"
},
{
"url": "https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc"
},
{
"url": "https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e"
},
{
"url": "https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2"
},
{
"url": "https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c"
},
{
"url": "https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5"
}
],
"title": "RDMA/core: Reject unregistering netdevs in ib_get_eth_speed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98359",
"datePublished": "2026-10-06T08:46:45.938Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:13.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98358 (GCVE-0-2026-98358)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
IB/iser: reject a remote invalidation of an unregistered direction
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/iser: reject a remote invalidation of an unregistered direction
A write command whose data is sent entirely as immediate data is not
registered. iser_reg_mem_fastreg() takes the DMA key path and leaves
rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has
already set dir[ISER_DIR_OUT].
iser_check_remote_inv() looks at dir[] alone and hands the descriptor to
iser_inv_desc(), which reads desc->sig_protected. A target that answers
such a command with IB_WR_SEND_WITH_INV faults the initiator.
Leaving those commands unregistered is deliberate.
The same function already terminates the connection when a target sends
a remote invalidation the initiator did not ask for. A target that
invalidates a direction that was never registered is in the same class,
so give it the same answer.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:iser_task_rsp+0x6d6/0xec0
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04
RSP: 0018:ffff88811b008db8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848
RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020
RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0
R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800
R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<IRQ>
__ib_process_cq+0xe1/0x390
ib_poll_handler+0x6e/0x200
irq_poll_softirq+0x1df/0x480
? clockevents_program_event+0x2ba/0x860
? __pfx_irq_poll_softirq+0x10/0x10
handle_softirqs+0x18e/0x590
? __pfx_handle_softirqs+0x10/0x10
? __hrtimer_rearm_deferred+0x156/0x450
do_softirq+0x3b/0x60
</IRQ>
<TASK>
__local_bh_enable_ip+0x61/0x70
__alloc_skb+0x732/0x890
? _raw_spin_lock_irqsave+0x85/0xe0
? __pfx___alloc_skb+0x10/0x10
? _raw_read_unlock_irqrestore+0x16/0x50
rxe_init_packet+0x16b/0x4f0
prepare_ack_packet+0xb8/0x830
rxe_receiver+0x499/0x9980
? __pfx_rxe_receiver+0x10/0x10
? rxe_completer+0x29e5/0x38c0
? hrtimer_start_range_ns_common+0x75f/0x1730
? hrtimer_start_range_ns+0xa6/0x2c0
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx_rxe_receiver+0x10/0x10
do_work+0x144/0x470
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
59caaed7a72a0e3750dfb84636dae6b781559310 , < 198e4db9add54a50cce60a5d80b8f0ee5456b65a
(git)
Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < b9e37452915feaa8422af87dea5d0c16a7d1ff13 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < 19ddd4af7fce9200e70882f622011e9dd130f427 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < 9d145a2d8d6f8f2cc460b80df41870819048f2a0 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < b4d278c91209931199db9c0836dc2e21a7593dad (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < 6ed3ebaff3345837f0528d85bd39ce573c7b9a41 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < ceecf3f9c322fc6937a66682942a26ad13a34a07 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < d85f0f0a7c85756fc992c70d869706f19dac9259 (git) |
|
| Linux | Linux |
Affected:
4.5
Unaffected: 0 , < 4.5 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/iser/iser_initiator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "198e4db9add54a50cce60a5d80b8f0ee5456b65a",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "b9e37452915feaa8422af87dea5d0c16a7d1ff13",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "19ddd4af7fce9200e70882f622011e9dd130f427",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "9d145a2d8d6f8f2cc460b80df41870819048f2a0",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "b4d278c91209931199db9c0836dc2e21a7593dad",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "6ed3ebaff3345837f0528d85bd39ce573c7b9a41",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "ceecf3f9c322fc6937a66682942a26ad13a34a07",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "d85f0f0a7c85756fc992c70d869706f19dac9259",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/iser/iser_initiator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/iser: reject a remote invalidation of an unregistered direction\n\nA write command whose data is sent entirely as immediate data is not\nregistered. iser_reg_mem_fastreg() takes the DMA key path and leaves\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has\nalready set dir[ISER_DIR_OUT].\n\niser_check_remote_inv() looks at dir[] alone and hands the descriptor to\niser_inv_desc(), which reads desc-\u003esig_protected. A target that answers\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.\nLeaving those commands unregistered is deliberate.\n\nThe same function already terminates the connection when a target sends\na remote invalidation the initiator did not ask for. A target that\ninvalidates a direction that was never registered is in the same class,\nso give it the same answer.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\n CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: rxe_wq do_work\n RIP: 0010:iser_task_rsp+0x6d6/0xec0\n Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04\n RSP: 0018:ffff88811b008db8 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848\n RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020\n RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0\n R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800\n R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0\n PKRU: 55555554\n Call Trace:\n \u003cIRQ\u003e\n __ib_process_cq+0xe1/0x390\n ib_poll_handler+0x6e/0x200\n irq_poll_softirq+0x1df/0x480\n ? clockevents_program_event+0x2ba/0x860\n ? __pfx_irq_poll_softirq+0x10/0x10\n handle_softirqs+0x18e/0x590\n ? __pfx_handle_softirqs+0x10/0x10\n ? __hrtimer_rearm_deferred+0x156/0x450\n do_softirq+0x3b/0x60\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x61/0x70\n __alloc_skb+0x732/0x890\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx___alloc_skb+0x10/0x10\n ? _raw_read_unlock_irqrestore+0x16/0x50\n rxe_init_packet+0x16b/0x4f0\n prepare_ack_packet+0xb8/0x830\n rxe_receiver+0x499/0x9980\n ? __pfx_rxe_receiver+0x10/0x10\n ? rxe_completer+0x29e5/0x38c0\n ? hrtimer_start_range_ns_common+0x75f/0x1730\n ? hrtimer_start_range_ns+0xa6/0x2c0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx_rxe_receiver+0x10/0x10\n do_work+0x144/0x470\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n Modules linked in:\n ---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:45.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a"
},
{
"url": "https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13"
},
{
"url": "https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427"
},
{
"url": "https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0"
},
{
"url": "https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad"
},
{
"url": "https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41"
},
{
"url": "https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07"
},
{
"url": "https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259"
}
],
"title": "IB/iser: reject a remote invalidation of an unregistered direction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98358",
"datePublished": "2026-10-06T08:46:45.128Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:45.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98357 (GCVE-0-2026-98357)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
IB/isert: wait for deferred control PDU completions before releasing the connection
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: wait for deferred control PDU completions before releasing the connection
isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and
ISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work
item then runs isert_completion_put() -> isert_put_cmd(), which reads
isert_conn->conn and takes conn->cmd_lock.
Nothing orders that work item against teardown. isert_wait_conn() queues
isert_release_work, which frees isert_conn, and iscsit_close_connection()
frees the iscsit_conn right after it returns, so the queued work can run
against freed memory.
Count the deferred control PDU completions per connection and let
isert_wait_conn() wait for them before the release work is queued.
ISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs
iscsit_logout_post_handler(), which ends up waiting for
conn->conn_wait_comp, and that completion is only sent by
iscsit_close_connection() after it has called iscsit_wait_conn().
Waiting for it here would deadlock. Its wait stays the existing
isert_wait4logout().
The splat below is from a kernel with tracing printk()s and an msleep(200)
injected into isert_do_control_comp() to widen the window:
BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620
Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182
CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: isert_comp_wq isert_do_control_comp
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xd0/0x630
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? _raw_spin_unlock_irqrestore+0x3e/0x70
? isert_put_cmd+0x53d/0x620
kasan_report+0xce/0x100
? isert_put_cmd+0x53d/0x620
isert_put_cmd+0x53d/0x620
? isert_completion_put+0x305/0x330
? isert_do_control_comp+0x2ef/0x310
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 48:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x158/0x370
isert_cma_handler+0x1e3/0x2ae0
cma_cm_event_handler+0x3e/0x240
cma_ib_req_handler+0x17d9/0x4490
cm_process_work+0x41/0x330
cm_work_handler+0x5727/0xc160
process_one_work+0x633/0x1030
worker_thread+0x45b/0xd10
kthread+0x2c6/0x3b0
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
Freed by task 184:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x121/0x380
iscsit_close_connection+0x7cf/0x1e60
iscsit_take_action_for_connection_exit+0x1b6/0x360
iscsi_target_tx_thread+0x472/0x690
kthread+0x2c6/0x3b0
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
Severity
8.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b8d26b3be8b33682cf163274ed07479a70554633 , < f5613acbe2e346d5c466ef0bd264fca936b69f82
(git)
Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < ccdb1523f12bc8a9646de65055d1aafed9e9bcc6 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 0e230917670c6e6fe3243abfa11299fcbe05b1f4 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 505b242d9351690d1385bbe508ab4666f60363ce (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 7edb8a88d6c76237c8b4435765bee1009e26a50a (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < b96b8b3e41c308f606ffd10cfef1a7b9f97414cd (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 7908fbc597a694bbd99bfb59ece73bc3daded68e (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c",
"drivers/infiniband/ulp/isert/ib_isert.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f5613acbe2e346d5c466ef0bd264fca936b69f82",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "ccdb1523f12bc8a9646de65055d1aafed9e9bcc6",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "0e230917670c6e6fe3243abfa11299fcbe05b1f4",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "505b242d9351690d1385bbe508ab4666f60363ce",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "7edb8a88d6c76237c8b4435765bee1009e26a50a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "b96b8b3e41c308f606ffd10cfef1a7b9f97414cd",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "7908fbc597a694bbd99bfb59ece73bc3daded68e",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c",
"drivers/infiniband/ulp/isert/ib_isert.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work\nitem then runs isert_completion_put() -\u003e isert_put_cmd(), which reads\nisert_conn-\u003econn and takes conn-\u003ecmd_lock.\n\nNothing orders that work item against teardown. isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn-\u003econn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock. Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: isert_comp_wq isert_do_control_comp\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x3e/0x70\n ? isert_put_cmd+0x53d/0x620\n kasan_report+0xce/0x100\n ? isert_put_cmd+0x53d/0x620\n isert_put_cmd+0x53d/0x620\n ? isert_completion_put+0x305/0x330\n ? isert_do_control_comp+0x2ef/0x310\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n Allocated by task 48:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x158/0x370\n isert_cma_handler+0x1e3/0x2ae0\n cma_cm_event_handler+0x3e/0x240\n cma_ib_req_handler+0x17d9/0x4490\n cm_process_work+0x41/0x330\n cm_work_handler+0x5727/0xc160\n process_one_work+0x633/0x1030\n worker_thread+0x45b/0xd10\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 184:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x121/0x380\n iscsit_close_connection+0x7cf/0x1e60\n iscsit_take_action_for_connection_exit+0x1b6/0x360\n iscsi_target_tx_thread+0x472/0x690\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The iSER initiator triggers it remotely over RDMA (iWARP/RoCEv2 are IP-routable). Its iSCSI Text Request (or a TMF or a malformed PDU that draws a Reject) makes isert_send_done() queue isert_do_control_comp(); an RDMA CM disconnect from the same initiator then starts teardown via iscsit_close_connection().\nAC:H - The attacker sends both the request and the disconnect, but the free only wins if the already-queued isert_comp_wq work stays delayed through ib_drain_qp, isert_wait4cmds and the release work. The attacker can\u0027t control that scheduling; the reporter needed an injected msleep(200) to reproduce it.\nPR:N - The attacker only needs a full-feature iSCSI session, and LIO allows login with AuthMethod=None, where the initiator IQN is merely asserted. No credentials are checked before the Text/TMF/Reject paths that queue the deferred completion.\nUI:N - The initiator triggers the response PDU and the connection teardown entirely through its own iSCSI PDUs and RDMA CM disconnect; no action by a target administrator is needed.\nS:U - The use-after-free is in the target host\u0027s own kernel memory (isert_conn and iscsit_conn), so the impact stays within the same kernel security authority.\nC:H - isert_put_cmd() dereferences the freed isert_conn-\u003econn and reads the freed iscsit_conn and cmd structures. Reclaiming those slab objects lets attacker-shaped data steer kernel pointer reads.\nI:H - On the freed iscsit_conn, isert_put_cmd() takes spin_lock_bh(\u0026conn-\u003ecmd_lock), runs list_del_init(\u0026cmd-\u003ei_conn_node) and calls iscsit_release_cmd()/transport_generic_free_cmd(). These are writes and frees through freed memory, which can corrupt the heap.\nA:H - The isert_comp_wq worker hits a slab use-after-free in isert_put_cmd() (KASAN splat in the fix commit), which on production kernels can crash or oops the iSCSI target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:12.677Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82"
},
{
"url": "https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6"
},
{
"url": "https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4"
},
{
"url": "https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce"
},
{
"url": "https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a"
},
{
"url": "https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd"
},
{
"url": "https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e"
},
{
"url": "https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f"
}
],
"title": "IB/isert: wait for deferred control PDU completions before releasing the connection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98357",
"datePublished": "2026-10-06T08:46:44.216Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:12.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98356 (GCVE-0-2026-98356)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
bnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB
handler later calls queue_work() on the NULL pointer.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
51dc5312dcd929efea7647c0c0e75afa461531b5 , < a0fb2007d00b440fd1adddd9b042f01744ed0efc
(git)
Affected: 51dc5312dcd929efea7647c0c0e75afa461531b5 , < 727bbda37d9758960c346546004eea4ad49242e1 (git) Affected: 51dc5312dcd929efea7647c0c0e75afa461531b5 , < 6c368f7baaea63c1c7c28c6df271511f2a1562c9 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0fb2007d00b440fd1adddd9b042f01744ed0efc",
"status": "affected",
"version": "51dc5312dcd929efea7647c0c0e75afa461531b5",
"versionType": "git"
},
{
"lessThan": "727bbda37d9758960c346546004eea4ad49242e1",
"status": "affected",
"version": "51dc5312dcd929efea7647c0c0e75afa461531b5",
"versionType": "git"
},
{
"lessThan": "6c368f7baaea63c1c7c28c6df271511f2a1562c9",
"status": "affected",
"version": "51dc5312dcd929efea7647c0c0e75afa461531b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup\n\nbnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB\nhandler later calls queue_work() on the NULL pointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:43.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0fb2007d00b440fd1adddd9b042f01744ed0efc"
},
{
"url": "https://git.kernel.org/stable/c/727bbda37d9758960c346546004eea4ad49242e1"
},
{
"url": "https://git.kernel.org/stable/c/6c368f7baaea63c1c7c28c6df271511f2a1562c9"
}
],
"title": "RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98356",
"datePublished": "2026-10-06T08:46:43.380Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:43.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98355 (GCVE-0-2026-98355)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
RDMA/rtrs: guard against null kobj name
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs: guard against null kobj name
In the client, if `init_path()` errors, the callee tries to clean up
with `rtrs_clt_close_conns()`. However, this can lead to calling the
event tracing code with `clt_path->kobj->name` being `NULL` and thus
causing a null pointer dereference when trying to copy from it.
This just adds a guard to check that the name is not `NULL` before
copying from it. The server appears to have a similar pattern.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5a93929d9f9a1d82946ddd49e260b6dd1756ad6d , < f79cf42ff23f9120246cd6740eaa26f59c632a4a
(git)
Affected: 5a93929d9f9a1d82946ddd49e260b6dd1756ad6d , < 99c24a8968ebef0573825b5cb89d5985d51635b9 (git) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h",
"drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f79cf42ff23f9120246cd6740eaa26f59c632a4a",
"status": "affected",
"version": "5a93929d9f9a1d82946ddd49e260b6dd1756ad6d",
"versionType": "git"
},
{
"lessThan": "99c24a8968ebef0573825b5cb89d5985d51635b9",
"status": "affected",
"version": "5a93929d9f9a1d82946ddd49e260b6dd1756ad6d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h",
"drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs: guard against null kobj name\n\nIn the client, if `init_path()` errors, the callee tries to clean up\nwith `rtrs_clt_close_conns()`. However, this can lead to calling the\nevent tracing code with `clt_path-\u003ekobj-\u003ename` being `NULL` and thus\ncausing a null pointer dereference when trying to copy from it.\n\nThis just adds a guard to check that the name is not `NULL` before\ncopying from it. The server appears to have a similar pattern."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:42.583Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f79cf42ff23f9120246cd6740eaa26f59c632a4a"
},
{
"url": "https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"
}
],
"title": "RDMA/rtrs: guard against null kobj name",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98355",
"datePublished": "2026-10-06T08:46:42.583Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:42.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}