Search
Find a vulnerability
Search criteria
17430 vulnerabilities
CVE-2026-98164 (GCVE-0-2026-98164)
Vulnerability from cvelistv5 – Published: 2026-09-29 12:02 – Updated: 2026-09-29 12:02
VLAI
EPSS
VEX
Title
KVM: x86/mmu: Check write tracking in all address spaces
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Check write tracking in all address spaces
kvm_gfn_is_write_tracked() checks only the supplied memslot, but page
tracking is per-address-space and shadow pages are shared across all
address spaces. With SMM, a GFN can therefore be write-tracked in one
address space and appear untracked through the other.
Check the supplied slot first, then the slot for the other address space.
This ensures all callers honor write tracking regardless of the active
address space. In particular, it prevents mmu_try_to_unsync_pages() from
marking an upper-level shadow page unsync and eventually triggering the
BUG in pte_list_remove().
[invert direction of the conditional. - Paolo]
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
699023e239658e62da6f42f47d31b54788521ec1 , < 09aa68552d2542cc6c23edd1568ac265dc5d886f
(git)
Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 429b6f43b4d8c98988fdca99e02dc156134e3d77 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < c0a9bd5fca0b5f2dea32b0fc31350e71e8648112 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < ec8fcaf354c1cbb36755d48e9f5a00c9591349e5 (git) Affected: 699023e239658e62da6f42f47d31b54788521ec1 , < 0f38453cdb2e17566ccb7c0f3dabd5bd21caca26 (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09aa68552d2542cc6c23edd1568ac265dc5d886f",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "429b6f43b4d8c98988fdca99e02dc156134e3d77",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "c0a9bd5fca0b5f2dea32b0fc31350e71e8648112",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "ec8fcaf354c1cbb36755d48e9f5a00c9591349e5",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
},
{
"lessThan": "0f38453cdb2e17566ccb7c0f3dabd5bd21caca26",
"status": "affected",
"version": "699023e239658e62da6f42f47d31b54788521ec1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/page_track.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Check write tracking in all address spaces\n\nkvm_gfn_is_write_tracked() checks only the supplied memslot, but page\ntracking is per-address-space and shadow pages are shared across all\naddress spaces. With SMM, a GFN can therefore be write-tracked in one\naddress space and appear untracked through the other.\n\nCheck the supplied slot first, then the slot for the other address space.\nThis ensures all callers honor write tracking regardless of the active\naddress space. In particular, it prevents mmu_try_to_unsync_pages() from\nmarking an upper-level shadow page unsync and eventually triggering the\nBUG in pte_list_remove().\n\n[invert direction of the conditional. - Paolo]"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T12:02:12.574Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09aa68552d2542cc6c23edd1568ac265dc5d886f"
},
{
"url": "https://git.kernel.org/stable/c/429b6f43b4d8c98988fdca99e02dc156134e3d77"
},
{
"url": "https://git.kernel.org/stable/c/d8636c8f9f95d0fd1e2f6f1cad0d5757aa6f212a"
},
{
"url": "https://git.kernel.org/stable/c/c0a9bd5fca0b5f2dea32b0fc31350e71e8648112"
},
{
"url": "https://git.kernel.org/stable/c/ec8fcaf354c1cbb36755d48e9f5a00c9591349e5"
},
{
"url": "https://git.kernel.org/stable/c/0f38453cdb2e17566ccb7c0f3dabd5bd21caca26"
}
],
"title": "KVM: x86/mmu: Check write tracking in all address spaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98164",
"datePublished": "2026-09-29T12:02:12.574Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-29T12:02:12.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98163 (GCVE-0-2026-98163)
Vulnerability from cvelistv5 – Published: 2026-09-26 08:31 – Updated: 2026-09-26 08:31
VLAI
EPSS
VEX
Title
cgroup: Avoid iteration of dying tasks with zero refcount
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avoid iteration of dying tasks with zero refcount
The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is
possible before cgroup_task_release()/put_task_struct_rcu_user()).
The tasks after cgroup_task_release() and before cgroup_task_free()
are subject to race when they may or may not have ->usage count > 0.
The race window is between css_task_iter_next() invocations
when css_set_lock is released and we may arrive at a new ->task_pos.
The iterator should not attempt to resurrect tasks whose ->usage count
dropped to zero. (When that happens, __put_task_struct_rcu_cb() is
already imminent and the returned task_struct would could be used
after free.)
As for the fix, we cannot simply check the signal->live count of a task
on the dying list because that won't distinguish regular zombies waiting
to be reaped from RCU remnant tasks that are going to be free'd.
Therefore add an extra check to rule out ->usage==0 tasks from any
iteration.
The repeat: loop in css_task_iter_advance() doesn't consider ->usage
count, so add a new loop to css_task_iter_next() to skip de-used tasks
on the dying_list.
Rough illustration of the possible race
R (reader of cgroup.procs) T (thread) L (group leader)
--------------------------------- -------------------------------- --------------------------------
L exits, signal->live > 0
cgroup_task_dead(L)
css_set_skip_task_iters() // skips only cset->tasks
list_add_tail(&L->cg_list, &cset->dying_tasks)
css_task_iter_next()
take css_set_lock
css_task_iter_advance()
leader && signal->live != 0
=> it->task_pos = &L->cg_list
release css_set_lock
T exits
--signal->live == 0
cgroup_task_dead(T) // css_set_lock
release_task(T)
cgroup_task_release(T)
release_task(L) // zap_leader
cgroup_task_release(L)
put_task_struct_rcu_user(L)
...RCU...
put_task_struct(L)
L->usage = 0
/* L still on dying_tasks */
...RCU...
__put_task_struct(L)
css_task_iter_next() // another iteration
take css_set_lock
it->task_pos = &L->cg_list
get_task_struct(L)
=> addition on 0
drop css_set_lock
cgroup_task_free(L)
css_set_skip_task_iters() // dying skip comes too late
free_task(L)
cgroup_procs_show()
task_pid_vnr(L)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 828938118d6c2bb711301748c3e39e4bed6a62f5
(git)
Affected: 260fbcb92bbeacfcd050410fdc2d24ab15044400 , < 057dac23d329d5c5ed62352f2659a39fd46c6d4a (git) |
|
| Linux | Linux |
Affected:
6.19
Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828938118d6c2bb711301748c3e39e4bed6a62f5",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
},
{
"lessThan": "057dac23d329d5c5ed62352f2659a39fd46c6d4a",
"status": "affected",
"version": "260fbcb92bbeacfcd050410fdc2d24ab15044400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Avoid iteration of dying tasks with zero refcount\n\nThe commit 260fbcb92bbea (\"cgroup: Move dying_tasks cleanup from\ncgroup_task_release() to cgroup_task_free()\") extended the lifetime of\ntasks on the dying_tasks list.\nThe iterators have provision to go through dying_tasks because of\ndying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,\nit was expected that such tasks can obtain a new reference (that is\npossible before cgroup_task_release()/put_task_struct_rcu_user()).\nThe tasks after cgroup_task_release() and before cgroup_task_free()\nare subject to race when they may or may not have -\u003eusage count \u003e 0.\n\nThe race window is between css_task_iter_next() invocations\nwhen css_set_lock is released and we may arrive at a new -\u003etask_pos.\nThe iterator should not attempt to resurrect tasks whose -\u003eusage count\ndropped to zero. (When that happens, __put_task_struct_rcu_cb() is\nalready imminent and the returned task_struct would could be used\nafter free.)\n\nAs for the fix, we cannot simply check the signal-\u003elive count of a task\non the dying list because that won\u0027t distinguish regular zombies waiting\nto be reaped from RCU remnant tasks that are going to be free\u0027d.\nTherefore add an extra check to rule out -\u003eusage==0 tasks from any\niteration.\n\nThe repeat: loop in css_task_iter_advance() doesn\u0027t consider -\u003eusage\ncount, so add a new loop to css_task_iter_next() to skip de-used tasks\non the dying_list.\n\nRough illustration of the possible race\n\n R (reader of cgroup.procs) T (thread) L (group leader)\n --------------------------------- -------------------------------- --------------------------------\n L exits, signal-\u003elive \u003e 0\n cgroup_task_dead(L)\n css_set_skip_task_iters() // skips only cset-\u003etasks\n list_add_tail(\u0026L-\u003ecg_list, \u0026cset-\u003edying_tasks)\n css_task_iter_next()\n take css_set_lock\n css_task_iter_advance()\n leader \u0026\u0026 signal-\u003elive != 0\n =\u003e it-\u003etask_pos = \u0026L-\u003ecg_list\n release css_set_lock\n T exits\n --signal-\u003elive == 0\n\t\t\t\t cgroup_task_dead(T) // css_set_lock\n release_task(T)\n cgroup_task_release(T)\n release_task(L) // zap_leader\n cgroup_task_release(L)\n put_task_struct_rcu_user(L)\n ...RCU...\n put_task_struct(L)\n L-\u003eusage = 0\n /* L still on dying_tasks */\n ...RCU...\n __put_task_struct(L)\n css_task_iter_next() // another iteration\n take css_set_lock\n it-\u003etask_pos = \u0026L-\u003ecg_list\n get_task_struct(L)\n =\u003e addition on 0\n drop css_set_lock\n cgroup_task_free(L)\n css_set_skip_task_iters() // dying skip comes too late\n free_task(L)\n cgroup_procs_show()\n task_pid_vnr(L)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T08:31:50.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828938118d6c2bb711301748c3e39e4bed6a62f5"
},
{
"url": "https://git.kernel.org/stable/c/057dac23d329d5c5ed62352f2659a39fd46c6d4a"
}
],
"title": "cgroup: Avoid iteration of dying tasks with zero refcount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98163",
"datePublished": "2026-09-26T08:31:50.899Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-26T08:31:50.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98162 (GCVE-0-2026-98162)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
smb/server: fix tree connection leak in smb2_tree_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/server: fix tree connection leak in smb2_tree_connect()
See the procedure below:
smb2_tree_connect
ksmbd_tree_conn_connect
xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
ksmbd_share_tree_conn_inc(sc)
ksmbd_iov_pin_rsp // fail
status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
// do not disconnect tree_conn
Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc
(git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 39f2032096715daae5f6fd0f587ca7a474b019df (git) Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 (git) Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 (git) Affected: 5.15.145 , < 5.16 (semver) Affected: 6.1.71 , < 6.2 (semver) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"lessThan": "39f2032096715daae5f6fd0f587ca7a474b019df",
"status": "affected",
"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
"versionType": "git"
},
{
"status": "affected",
"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
"versionType": "git"
},
{
"status": "affected",
"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.71",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.71",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix tree connection leak in smb2_tree_connect()\n\nSee the procedure below:\n\n smb2_tree_connect\n ksmbd_tree_conn_connect\n xa_store(\u0026sess-\u003etree_conns, tree_conn-\u003eid, tree_conn)\n ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)\n ksmbd_share_tree_conn_inc(sc)\n ksmbd_iov_pin_rsp // fail\n status.ret = KSMBD_TREE_CONN_STATUS_NOMEM\n // do not disconnect tree_conn\n\nDisconnect the new tree connection if ksmbd_iov_pin_rsp() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:51.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6c88e5e3a75f1e4a98ad4bc4037465ccd7925bc"
},
{
"url": "https://git.kernel.org/stable/c/39f2032096715daae5f6fd0f587ca7a474b019df"
}
],
"title": "smb/server: fix tree connection leak in smb2_tree_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98162",
"datePublished": "2026-09-25T13:06:51.778Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:51.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98161 (GCVE-0-2026-98161)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-28 05:31
VLAI
EPSS
VEX
Title
nvdimm: pmem: keep PREFLUSH before data writes
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pmem: keep PREFLUSH before data writes
pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the
bio data and can later overwrite the error with a successful REQ_FUA flush.
That lets data writes run after a failed preflush and can complete the bio
successfully despite the failed ordering barrier.
Run the REQ_PREFLUSH flush synchronously before touching the bio data and
complete the bio with the flush error if it fails. Keep asynchronous flush
chaining for REQ_FUA. At that point, data copy has completed and the parent
bio can wait for the chained flush bio.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c5d4355d10d414a96ca870b731756b89d068d57a , < 770a90c2127220f0fc194ce909ad4f0842e141cb
(git)
Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < 72561ca1ab96f0f0f32737a6171641e05a318538 (git) Affected: c5d4355d10d414a96ca870b731756b89d068d57a , < c644a2f8fef5618fcf453c591177700fd07dd024 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "770a90c2127220f0fc194ce909ad4f0842e141cb",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "72561ca1ab96f0f0f32737a6171641e05a318538",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "c644a2f8fef5618fcf453c591177700fd07dd024",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T05:31:10.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb"
},
{
"url": "https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538"
},
{
"url": "https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"
}
],
"title": "nvdimm: pmem: keep PREFLUSH before data writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98161",
"datePublished": "2026-09-25T13:06:51.138Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-28T05:31:10.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98160 (GCVE-0-2026-98160)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ff6d1ba247b5c62bdb678f1069abc86ad88a1402
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < d6158333d630a1b21d8914feaf77a6f5deb185d9 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c017ab2b0e1b60b5be94636c94720347213d78b (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 4520d673d49dabfd42c008a33889251025f7d6d5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 423574feaed192063ef0cd0813fb85425f39e539 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 737c928ff5092d7e55128a232c231248fc993777 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 911190f0b9511c3c81f2f2484414c1ae26f636b3 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 264676418b726baca7be49171e306b6aa05cceb0 (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff6d1ba247b5c62bdb678f1069abc86ad88a1402",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d6158333d630a1b21d8914feaf77a6f5deb185d9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6c017ab2b0e1b60b5be94636c94720347213d78b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4520d673d49dabfd42c008a33889251025f7d6d5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "423574feaed192063ef0cd0813fb85425f39e539",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "737c928ff5092d7e55128a232c231248fc993777",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "911190f0b9511c3c81f2f2484414c1ae26f636b3",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "264676418b726baca7be49171e306b6aa05cceb0",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/sdio_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()\n\npadapter-\u003eHalData is allocated via vzalloc(), but incorrectly freed\nusing kfree() in the rtw_sdio_if1_init() error path. Using kfree() to\nrelease this vmalloc-backed buffer can lead to memory corruption.\n\nUse rtw_hal_data_deinit() to pair the free correctly and free\nHalData with vfree().\n\nThe bug was first flagged by an experimental static analysis tool we\nare developing for kernel memory-management bugs. Manual inspection\nconfirms that the issue is still present in current mainline.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\nsuitable RTL8723BS SDIO hardware to test with, no runtime testing was\nable to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:50.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff6d1ba247b5c62bdb678f1069abc86ad88a1402"
},
{
"url": "https://git.kernel.org/stable/c/d6158333d630a1b21d8914feaf77a6f5deb185d9"
},
{
"url": "https://git.kernel.org/stable/c/6c017ab2b0e1b60b5be94636c94720347213d78b"
},
{
"url": "https://git.kernel.org/stable/c/4520d673d49dabfd42c008a33889251025f7d6d5"
},
{
"url": "https://git.kernel.org/stable/c/423574feaed192063ef0cd0813fb85425f39e539"
},
{
"url": "https://git.kernel.org/stable/c/737c928ff5092d7e55128a232c231248fc993777"
},
{
"url": "https://git.kernel.org/stable/c/911190f0b9511c3c81f2f2484414c1ae26f636b3"
},
{
"url": "https://git.kernel.org/stable/c/264676418b726baca7be49171e306b6aa05cceb0"
}
],
"title": "staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98160",
"datePublished": "2026-09-25T13:06:50.521Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T13:06:50.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100079 (GCVE-0-2026-100079)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
usb: typec: ucsi: unregister debugfs entries on teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: unregister debugfs entries on teardown
ucsi_register() creates per-instance debugfs entries, but
ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI
instance across remoteproc restart then try to create an already
existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and
clear ucsi->debugfs after freeing it so repeated unregister
paths remain safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df0383ffad64dc09954a60873c1e202b47f08d90 , < fb7393519908befdc094be4ea913f582adbf2f7c
(git)
Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 7177c215e69658adbd2f2fc5b72e14be9208d2ba (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 1f44d001620fd3caa30619a9bc73e9d15555408b (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < 62efee351566321ad72a4abaf6eb7d972590585d (git) Affected: df0383ffad64dc09954a60873c1e202b47f08d90 , < eed73a65ab609b79d53de88cccc34b36dfe753c4 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb7393519908befdc094be4ea913f582adbf2f7c",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "7177c215e69658adbd2f2fc5b72e14be9208d2ba",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "1f44d001620fd3caa30619a9bc73e9d15555408b",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "62efee351566321ad72a4abaf6eb7d972590585d",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
},
{
"lessThan": "eed73a65ab609b79d53de88cccc34b36dfe753c4",
"status": "affected",
"version": "df0383ffad64dc09954a60873c1e202b47f08d90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/ucsi/debugfs.c",
"drivers/usb/typec/ucsi/ucsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: unregister debugfs entries on teardown\n\nucsi_register() creates per-instance debugfs entries, but\nucsi_unregister() keeps them around until ucsi_destroy().\n\nDrivers like ucsi_glink that unregister/register the same UCSI\ninstance across remoteproc restart then try to create an already\nexisting debugfs directory and log:\n\n debugfs: \u0027pmic_glink.ucsi.0\u0027 already exists in \u0027ucsi\u0027\n\nUnregister debugfs entries as part of ucsi_unregister(), and\nclear ucsi-\u003edebugfs after freeing it so repeated unregister\npaths remain safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb7393519908befdc094be4ea913f582adbf2f7c"
},
{
"url": "https://git.kernel.org/stable/c/7177c215e69658adbd2f2fc5b72e14be9208d2ba"
},
{
"url": "https://git.kernel.org/stable/c/1f44d001620fd3caa30619a9bc73e9d15555408b"
},
{
"url": "https://git.kernel.org/stable/c/62efee351566321ad72a4abaf6eb7d972590585d"
},
{
"url": "https://git.kernel.org/stable/c/eed73a65ab609b79d53de88cccc34b36dfe753c4"
}
],
"title": "usb: typec: ucsi: unregister debugfs entries on teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100079",
"datePublished": "2026-09-25T13:06:49.915Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100078 (GCVE-0-2026-100078)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
wifi: iwlwifi: mei: pass correct argument to function
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: pass correct argument to function
The first argument to iwl_mei_write_cyclic_buf() should be the cldev
but the q_head pointer is passed instead. Fix it.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
652291601459272d52b6ba12811f0b60b3e6444f , < 034445e19f12bb8771c58e2ecf1fbd6eac9b5fac
(git)
Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < f22ad9d1077c83718d9e6c84b71726287c1d1ad3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < ee91ae7f5815345612d8c0afd5d7efed361bcdb5 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 082b353c05b8eaf07e03fc1918c176cd3c216e25 (git) Affected: 652291601459272d52b6ba12811f0b60b3e6444f , < 905f57aefde4f4092a411c8a55856182fb1c7598 (git) |
|
| Linux | Linux |
Affected:
5.17
Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034445e19f12bb8771c58e2ecf1fbd6eac9b5fac",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "f22ad9d1077c83718d9e6c84b71726287c1d1ad3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "ee91ae7f5815345612d8c0afd5d7efed361bcdb5",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "082b353c05b8eaf07e03fc1918c176cd3c216e25",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
},
{
"lessThan": "905f57aefde4f4092a411c8a55856182fb1c7598",
"status": "affected",
"version": "652291601459272d52b6ba12811f0b60b3e6444f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mei/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mei: pass correct argument to function\n\nThe first argument to iwl_mei_write_cyclic_buf() should be the cldev\nbut the q_head pointer is passed instead. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:49.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac"
},
{
"url": "https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3"
},
{
"url": "https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5"
},
{
"url": "https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3"
},
{
"url": "https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25"
},
{
"url": "https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598"
}
],
"title": "wifi: iwlwifi: mei: pass correct argument to function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100078",
"datePublished": "2026-09-25T13:06:49.327Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100077 (GCVE-0-2026-100077)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
drm/msm: Recover HW before retire hung submit
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we
recover the GPU. Retiring the submit triggers BO free and that can
result in GPU pagefaults since the GPU may be actively accessing those
BOs.
To fix this, retire the submits after gpu recovery is complete in
recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < e36284257eeca13768687bf8e52f66f8ea0e8794
(git)
Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < dc64cf9d71428234389b635d142cb5fe07d57eab (git) Affected: 1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5 , < b303e1d52811de7d1bcf793560754d4df68d4a1c (git) |
|
| Linux | Linux |
Affected:
4.2
Unaffected: 0 , < 4.2 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
},
{
"lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
"status": "affected",
"version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794"
},
{
"url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab"
},
{
"url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c"
}
],
"title": "drm/msm: Recover HW before retire hung submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100077",
"datePublished": "2026-09-25T13:06:48.707Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100076 (GCVE-0-2026-100076)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).
Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6c9f6a3b9fdd31a0836b681053155b5997c0156e
(git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < c48e5aa01525577d6b6e782962a5bfb0e1535cb5 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 41b8209376dffbd7b0b85c8bc4697d9166ac62ef (git) |
|
| Linux | Linux |
Affected:
4.12
Unaffected: 0 , < 4.12 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c9f6a3b9fdd31a0836b681053155b5997c0156e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c48e5aa01525577d6b6e782962a5bfb0e1535cb5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41b8209376dffbd7b0b85c8bc4697d9166ac62ef",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths\n\nissue_beacon(), issue_probersp() and issue_asocrsp() obtain a management\nxmit_frame together with its xmit_buf from the driver\u0027s fixed-size\nmanagement-TX pools via alloc_mgtxmitframe(). On the normal path the frame\nis handed to dump_mgntframe(), which transfers ownership and eventually\nreturns both objects to their pools (the frame and, for beacons, the buf\nin rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion\npath).\n\nSeveral error/edge paths return early after a successful\nalloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never\ntransferred and neither object is freed:\n\n - issue_beacon(): beacon larger than 512 bytes\n - issue_probersp(): cur_network-\u003eie_length \u003e MAX_IE_SZ\n - issue_probersp(): kzalloc() of the SSID scratch buffer fails\n - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP\n\nBecause alloc_mgtxmitframe() removes the frame and buf from their free\nlists (list_del_init) without placing them on any pending list, an\norphaned pair is on no list and referenced by nobody, so it is only\nreclaimed at driver teardown. Repeated hits progressively exhaust the\nmanagement-TX pools until alloc_mgtxmitframe() returns NULL and the\ninterface can no longer send beacons or probe/assoc responses.\n\nFree the frame and buffer on these paths, matching the existing correct\nerror handling in issue_assocreq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:48.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e"
},
{
"url": "https://git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5"
},
{
"url": "https://git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef"
}
],
"title": "staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100076",
"datePublished": "2026-09-25T13:06:48.057Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:48.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100075 (GCVE-0-2026-100075)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41
VLAI
EPSS
VEX
Title
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
descriptor, the unwind path destroys RDMA contexts but leaves stale
n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap
allocation before returning an error.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa
(git)
Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git) |
|
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
},
{
"lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
"status": "affected",
"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:41:03.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
},
{
"url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
},
{
"url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
},
{
"url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
},
{
"url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
},
{
"url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
},
{
"url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
},
{
"url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
}
],
"title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100075",
"datePublished": "2026-09-25T13:06:47.399Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T14:41:03.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100074 (GCVE-0-2026-100074)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
bpf: Mark bpf_refcount field as unique
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark bpf_refcount field as unique
BPF_REFCOUNT is not marked as a unique field, while it should be. Fix
this oversight.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d54730b50bae1f3119bd686d551d66f0fcc387ca , < e42cede6f90177f4f92f80d3de18f628e61d2087
(git)
Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 641f814965d733936ca3618d4d5a12a8fa9be00e (git) Affected: d54730b50bae1f3119bd686d551d66f0fcc387ca , < 61e655391cb19c31f94ecd4354f624c81ce4cf75 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42cede6f90177f4f92f80d3de18f628e61d2087",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "641f814965d733936ca3618d4d5a12a8fa9be00e",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
},
{
"lessThan": "61e655391cb19c31f94ecd4354f624c81ce4cf75",
"status": "affected",
"version": "d54730b50bae1f3119bd686d551d66f0fcc387ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/btf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf_refcount field as unique\n\nBPF_REFCOUNT is not marked as a unique field, while it should be. Fix\nthis oversight."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.777Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42cede6f90177f4f92f80d3de18f628e61d2087"
},
{
"url": "https://git.kernel.org/stable/c/641f814965d733936ca3618d4d5a12a8fa9be00e"
},
{
"url": "https://git.kernel.org/stable/c/61e655391cb19c31f94ecd4354f624c81ce4cf75"
}
],
"title": "bpf: Mark bpf_refcount field as unique",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100074",
"datePublished": "2026-09-25T13:06:46.777Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100073 (GCVE-0-2026-100073)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
ext4: fix transaction overflow during writeback
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix transaction overflow during writeback
Commit 95ad8ee45cdb ("ext4: correct the reserved credits for extent
conversion") was correct to note that we need to reserve enough credits
for all extents possibly underlying a large folio. However it was too
eager to reduce the number of reserved credits. Extent conversion may
not only need to touch several leaf extent blocks, it may also need to
split extents - for example a single large unwritten extent may need to
be split into many small written ones in case of sparse folio dirtying.
This can thus result not only in extent leaf modifications but also in a
need to allocate new extent tree nodes. As a result the reserved
transaction credits were not sufficient in some corner cases. Use
ext4_meta_trans_blocks() for correct upper bound credit estimate.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
95ad8ee45cdbc321c135a2db895d48b374ef0f87 , < a22464c5df5827e884a5a7d3d8fb03870e5bb6c8
(git)
Affected: 95ad8ee45cdbc321c135a2db895d48b374ef0f87 , < 46e8e31771f4f1c5e1cdec37a889a6730e42e9f1 (git) Affected: 2b6d39229bc783198222cddd31e2fbded93c8db7 (git) Affected: 6.16.3 , < 6.17 (semver) |
|
| Linux | Linux |
Affected:
6.17
Unaffected: 0 , < 6.17 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a22464c5df5827e884a5a7d3d8fb03870e5bb6c8",
"status": "affected",
"version": "95ad8ee45cdbc321c135a2db895d48b374ef0f87",
"versionType": "git"
},
{
"lessThan": "46e8e31771f4f1c5e1cdec37a889a6730e42e9f1",
"status": "affected",
"version": "95ad8ee45cdbc321c135a2db895d48b374ef0f87",
"versionType": "git"
},
{
"status": "affected",
"version": "2b6d39229bc783198222cddd31e2fbded93c8db7",
"versionType": "git"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix transaction overflow during writeback\n\nCommit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent\nconversion\") was correct to note that we need to reserve enough credits\nfor all extents possibly underlying a large folio. However it was too\neager to reduce the number of reserved credits. Extent conversion may\nnot only need to touch several leaf extent blocks, it may also need to\nsplit extents - for example a single large unwritten extent may need to\nbe split into many small written ones in case of sparse folio dirtying.\nThis can thus result not only in extent leaf modifications but also in a\nneed to allocate new extent tree nodes. As a result the reserved\ntransaction credits were not sufficient in some corner cases. Use\next4_meta_trans_blocks() for correct upper bound credit estimate."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:46.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a22464c5df5827e884a5a7d3d8fb03870e5bb6c8"
},
{
"url": "https://git.kernel.org/stable/c/46e8e31771f4f1c5e1cdec37a889a6730e42e9f1"
}
],
"title": "ext4: fix transaction overflow during writeback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100073",
"datePublished": "2026-09-25T13:06:46.185Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:46.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100072 (GCVE-0-2026-100072)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
ACPI: platform: Use acpi_bus_get_primary_device()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: platform: Use acpi_bus_get_primary_device()
The acpi_get_first_physical_node() usage in acpi_platform_fill_resource()
and acpi_create_platform_device() is generally unsafe because in theory
the device returned by it may be freed at any time [1].
It is also inefficient because acpi_get_first_physical_node() is called
multiple times for the same argument which can be avoided.
Address these issues by using acpi_bus_get_primary_device() instead of
acpi_get_first_physical_node() and adjusting the code to call it just
once at the beginning of and acpi_create_platform_device() and drop
the device reference acquired by it upon the return from that function.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3b95bd160547f56a68aeb972c33ae9511e7a8380 , < c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71
(git)
Affected: 3b95bd160547f56a68aeb972c33ae9511e7a8380 , < a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd (git) |
|
| Linux | Linux |
Affected:
4.6
Unaffected: 0 , < 4.6 (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
},
{
"lessThan": "a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd",
"status": "affected",
"version": "3b95bd160547f56a68aeb972c33ae9511e7a8380",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_platform.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:45.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"
},
{
"url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"
}
],
"title": "ACPI: platform: Use acpi_bus_get_primary_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100072",
"datePublished": "2026-09-25T13:06:45.579Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:45.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100071 (GCVE-0-2026-100071)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
net: hsr: free learned nodes on device setup failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: free learned nodes on device setup failure
hsr_dev_finalize() can fail after a lower-device RX handler has
already been registered (slave A is added before the failable slave B
and interlink adds). RX handlers run in softirq regardless of the
master's state, so frames received in that window can learn dynamic
nodes into node_db, and the error unwind never releases them.
Free both owned dynamic databases in the unwind, mirroring
hsr_dellink(). proxy_node_db is provably empty on every current error
exit (only interlink RX feeds it, and the interlink add is the last
failable step) and is freed for symmetry. The order is safe:
hsr_del_port() unregisters each RX handler with synchronize_net()
before hsr_del_nodes() runs, which removes remaining entries with
list_del_rcu() and defers their release with call_rcu() for readers
already under RCU.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < e691eee886871b933d772ffc76d66c80b4c0a25e
(git)
Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 0a340ffd96943a49a78e367efac9517ca767d99b (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < f7289e3492f2694dccd3d79287e0e31879b58650 (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 65702339b3e9fd792f65d4b740928798194d86ce (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 49b01f2939abc676a6f9a118f07a10110ee5f683 (git) Affected: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 , < 7f16289b91eb316f170a6bd22d32e6c632f6a5b6 (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e691eee886871b933d772ffc76d66c80b4c0a25e",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "0a340ffd96943a49a78e367efac9517ca767d99b",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "f7289e3492f2694dccd3d79287e0e31879b58650",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "65702339b3e9fd792f65d4b740928798194d86ce",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "49b01f2939abc676a6f9a118f07a10110ee5f683",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
},
{
"lessThan": "7f16289b91eb316f170a6bd22d32e6c632f6a5b6",
"status": "affected",
"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster\u0027s state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:44.956Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"
},
{
"url": "https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"
},
{
"url": "https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"
},
{
"url": "https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"
},
{
"url": "https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"
},
{
"url": "https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"
}
],
"title": "net: hsr: free learned nodes on device setup failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100071",
"datePublished": "2026-09-25T13:06:44.956Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:44.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100070 (GCVE-0-2026-100070)
Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 13:06
VLAI
EPSS
VEX
Title
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
sashiko says:
If map_addr() changes the packet length, such as when the public NAT IP
string is shorter or longer than the internal IP, coff will still point to
the offset relative to the pre-mangled packet.
If the packet shrinks, coff could overshoot the correct position,
potentially causing the next ct_sip_parse_header_uri() call to silently
skip bytes and miss subsequent Contact headers. Could this lead to a
failure to NAT those subsequent headers and leak internal network details?
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c978cd3a937141deaf7995b849824af6dacdeae7 , < 6828aca3d82717c2fda92af81c0dda642bc2b465
(git)
Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 2703f5ea8d85bc729f433ac09ee902084c947122 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 0f4d30e2e49f343fc28ba1e259fd22969b940c46 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 810da5a63549531da78348b0a4545042d84e01e2 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 668cc1c30caedc63070b10d17d5514748988a140 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < e70d48fcf8382581162608a4a322919bfd22aef3 (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < c408d416618ebb8a95e3097a13f3b793ea9272ee (git) Affected: c978cd3a937141deaf7995b849824af6dacdeae7 , < 16aecbe3036f6097c26b51b12e4c1cf207769690 (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6828aca3d82717c2fda92af81c0dda642bc2b465",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "2703f5ea8d85bc729f433ac09ee902084c947122",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "0f4d30e2e49f343fc28ba1e259fd22969b940c46",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "810da5a63549531da78348b0a4545042d84e01e2",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "668cc1c30caedc63070b10d17d5514748988a140",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "e70d48fcf8382581162608a4a322919bfd22aef3",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "c408d416618ebb8a95e3097a13f3b793ea9272ee",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
},
{
"lessThan": "16aecbe3036f6097c26b51b12e4c1cf207769690",
"status": "affected",
"version": "c978cd3a937141deaf7995b849824af6dacdeae7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: rewind offset when NAT shrinks the packet\n\nsashiko says:\n If map_addr() changes the packet length, such as when the public NAT IP\n string is shorter or longer than the internal IP, coff will still point to\n the offset relative to the pre-mangled packet.\n If the packet shrinks, coff could overshoot the correct position,\n potentially causing the next ct_sip_parse_header_uri() call to silently\n skip bytes and miss subsequent Contact headers. Could this lead to a\n failure to NAT those subsequent headers and leak internal network details?"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:06:44.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6828aca3d82717c2fda92af81c0dda642bc2b465"
},
{
"url": "https://git.kernel.org/stable/c/2703f5ea8d85bc729f433ac09ee902084c947122"
},
{
"url": "https://git.kernel.org/stable/c/0f4d30e2e49f343fc28ba1e259fd22969b940c46"
},
{
"url": "https://git.kernel.org/stable/c/810da5a63549531da78348b0a4545042d84e01e2"
},
{
"url": "https://git.kernel.org/stable/c/668cc1c30caedc63070b10d17d5514748988a140"
},
{
"url": "https://git.kernel.org/stable/c/e70d48fcf8382581162608a4a322919bfd22aef3"
},
{
"url": "https://git.kernel.org/stable/c/c408d416618ebb8a95e3097a13f3b793ea9272ee"
},
{
"url": "https://git.kernel.org/stable/c/16aecbe3036f6097c26b51b12e4c1cf207769690"
}
],
"title": "netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-100070",
"datePublished": "2026-09-25T13:06:44.311Z",
"dateReserved": "2026-09-25T10:25:14.456Z",
"dateUpdated": "2026-09-25T13:06:44.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98159 (GCVE-0-2026-98159)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
wifi: mt76: mt7921: validate CLC firmware records
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921: validate CLC firmware records
The CLC region is supplied by firmware, but the loader trusts the
region count and each record length. A malformed image can make the
region table pointer precede the firmware buffer, make the record loop
fail to advance, or index phy->clc past its end. Validate the table and
record bounds before dereferencing or copying.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125 , < 602a950134ee2940136f60797e4457c3983b06ce
(git)
Affected: 23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125 , < 3896be051e928c891922d91de94c99519d215dff (git) Affected: 23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125 , < 3c505e2af16a9320f4355218394a955fbbc65322 (git) Affected: 23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125 , < 9417c5818a0146980c2608fda94c908e604eb033 (git) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "602a950134ee2940136f60797e4457c3983b06ce",
"status": "affected",
"version": "23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125",
"versionType": "git"
},
{
"lessThan": "3896be051e928c891922d91de94c99519d215dff",
"status": "affected",
"version": "23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125",
"versionType": "git"
},
{
"lessThan": "3c505e2af16a9320f4355218394a955fbbc65322",
"status": "affected",
"version": "23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125",
"versionType": "git"
},
{
"lessThan": "9417c5818a0146980c2608fda94c908e604eb033",
"status": "affected",
"version": "23bdc5d8cadfc941e7782d0cb8afb2d9ae73b125",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: validate CLC firmware records\n\nThe CLC region is supplied by firmware, but the loader trusts the\nregion count and each record length. A malformed image can make the\nregion table pointer precede the firmware buffer, make the record loop\nfail to advance, or index phy-\u003eclc past its end. Validate the table and\nrecord bounds before dereferencing or copying."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:28.206Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/602a950134ee2940136f60797e4457c3983b06ce"
},
{
"url": "https://git.kernel.org/stable/c/3896be051e928c891922d91de94c99519d215dff"
},
{
"url": "https://git.kernel.org/stable/c/3c505e2af16a9320f4355218394a955fbbc65322"
},
{
"url": "https://git.kernel.org/stable/c/9417c5818a0146980c2608fda94c908e604eb033"
}
],
"title": "wifi: mt76: mt7921: validate CLC firmware records",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98159",
"datePublished": "2026-09-25T10:36:28.206Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T10:36:28.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98158 (GCVE-0-2026-98158)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
ppp_async: drop the errored frame instead of resetting its headroom
Summary
In the Linux kernel, the following vulnerability has been resolved:
ppp_async: drop the errored frame instead of resetting its headroom
ppp_receive_nonmp_frame() prepends a two-byte direction tag before running
the pass/active BPF filters:
*(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);
Nothing on the receive path guarantees those two bytes of headroom. The
frame-error path in ppp_async's process_input_packet() resets a reused skb's
headroom to zero while claiming to restore it to a freshly allocated state -
but a fresh skb from dev_alloc_skb() carries NET_SKB_PAD:
err:
if (skb) {
/* make skb appear as freshly allocated */
skb_trim(skb, 0);
skb_reserve(skb, - skb_headroom(skb));
}
ap->rpkt still points at that skb, so the next frame is reassembled into it
with no headroom at all. A peer that sends a bad-FCS frame followed by one
beginning ff 03 then leaves a single byte of headroom by the time the filter
tag is pushed, which lands one byte below skb->head:
skbuff: skb_under_panic: len:49 put:2 head:ffff888003c10000
data:ffff888003c0ffff tail:0x30 end:0x640 dev:<NULL>
kernel BUG at net/core/skbuff.c:214!
RIP: 0010:skb_panic+0x13e/0x230
Call Trace:
skb_push+0xbd/0x100
ppp_receive_nonmp_frame+0x48a/0x1d10
ppp_input+0x4e9/0x2f80
ppp_async_process+0x2a/0xe0
tasklet_action_common+0x20f/0x8a0
handle_softirqs+0x18e/0x590
Kernel panic - not syncing: Fatal exception in interrupt
Zeroing the headroom violates the NET_SKB_PAD guarantee that dev_alloc_skb()
gives the rest of the receive path. Besides the filter panic above, when CCP
compression is enabled ppp_decompress_frame() hands skb->data - 2 to
->decompress()/->incomp(), which then reads out of bounds before skb->head
for the same reason.
Rather than restore the headroom, drop the errored frame - as ppp_synctty
already does on its error path - and clear ap->rpkt so the next frame is
reassembled into a fresh skb with proper headroom. This is simpler and fixes
both the filter under-panic and the CCP out-of-bounds read.
The original V1 of this patch made room in ppp_receive_nonmp_frame() with
skb_cow_head(); Eric pointed out that fixing the root cause in the transport
is the right approach.
Found by fuzzing the PPP receive path with a mutating peer on a pty; it is an
interesting (remote) DoS: root configures PPP, the peer supplies two crashing
frames. The reproducer (repro-ppp-skb.c, unchanged from v1) panics in about a
second, and returns cleanly with this applied.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6722e78c90054101e6797d5944cdc81af9897a0a , < d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da
(git)
Affected: 6722e78c90054101e6797d5944cdc81af9897a0a , < 0c53eb14975f029abd6b26896a460f0d2aaefe6b (git) Affected: 6722e78c90054101e6797d5944cdc81af9897a0a , < 717137221c7d90e7c98bda9a370c9da6cbf015e5 (git) Affected: 6722e78c90054101e6797d5944cdc81af9897a0a , < 8dc5d98a16fa23c00999aecf10018c9f69fa5bf4 (git) |
|
| Linux | Linux |
Affected:
2.6.15
Unaffected: 0 , < 2.6.15 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_async.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da",
"status": "affected",
"version": "6722e78c90054101e6797d5944cdc81af9897a0a",
"versionType": "git"
},
{
"lessThan": "0c53eb14975f029abd6b26896a460f0d2aaefe6b",
"status": "affected",
"version": "6722e78c90054101e6797d5944cdc81af9897a0a",
"versionType": "git"
},
{
"lessThan": "717137221c7d90e7c98bda9a370c9da6cbf015e5",
"status": "affected",
"version": "6722e78c90054101e6797d5944cdc81af9897a0a",
"versionType": "git"
},
{
"lessThan": "8dc5d98a16fa23c00999aecf10018c9f69fa5bf4",
"status": "affected",
"version": "6722e78c90054101e6797d5944cdc81af9897a0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_async.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc3",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp_async: drop the errored frame instead of resetting its headroom\n\nppp_receive_nonmp_frame() prepends a two-byte direction tag before running\nthe pass/active BPF filters:\n\n\t*(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);\n\nNothing on the receive path guarantees those two bytes of headroom. The\nframe-error path in ppp_async\u0027s process_input_packet() resets a reused skb\u0027s\nheadroom to zero while claiming to restore it to a freshly allocated state -\nbut a fresh skb from dev_alloc_skb() carries NET_SKB_PAD:\n\n\terr:\n\t\tif (skb) {\n\t\t\t/* make skb appear as freshly allocated */\n\t\t\tskb_trim(skb, 0);\n\t\t\tskb_reserve(skb, - skb_headroom(skb));\n\t\t}\n\nap-\u003erpkt still points at that skb, so the next frame is reassembled into it\nwith no headroom at all. A peer that sends a bad-FCS frame followed by one\nbeginning ff 03 then leaves a single byte of headroom by the time the filter\ntag is pushed, which lands one byte below skb-\u003ehead:\n\n skbuff: skb_under_panic: len:49 put:2 head:ffff888003c10000\n data:ffff888003c0ffff tail:0x30 end:0x640 dev:\u003cNULL\u003e\n kernel BUG at net/core/skbuff.c:214!\n RIP: 0010:skb_panic+0x13e/0x230\n Call Trace:\n skb_push+0xbd/0x100\n ppp_receive_nonmp_frame+0x48a/0x1d10\n ppp_input+0x4e9/0x2f80\n ppp_async_process+0x2a/0xe0\n tasklet_action_common+0x20f/0x8a0\n handle_softirqs+0x18e/0x590\n Kernel panic - not syncing: Fatal exception in interrupt\n\nZeroing the headroom violates the NET_SKB_PAD guarantee that dev_alloc_skb()\ngives the rest of the receive path. Besides the filter panic above, when CCP\ncompression is enabled ppp_decompress_frame() hands skb-\u003edata - 2 to\n-\u003edecompress()/-\u003eincomp(), which then reads out of bounds before skb-\u003ehead\nfor the same reason.\n\nRather than restore the headroom, drop the errored frame - as ppp_synctty\nalready does on its error path - and clear ap-\u003erpkt so the next frame is\nreassembled into a fresh skb with proper headroom. This is simpler and fixes\nboth the filter under-panic and the CCP out-of-bounds read.\n\nThe original V1 of this patch made room in ppp_receive_nonmp_frame() with\nskb_cow_head(); Eric pointed out that fixing the root cause in the transport\nis the right approach.\n\nFound by fuzzing the PPP receive path with a mutating peer on a pty; it is an\ninteresting (remote) DoS: root configures PPP, the peer supplies two crashing\nframes. The reproducer (repro-ppp-skb.c, unchanged from v1) panics in about a\nsecond, and returns cleanly with this applied."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:27.608Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da"
},
{
"url": "https://git.kernel.org/stable/c/0c53eb14975f029abd6b26896a460f0d2aaefe6b"
},
{
"url": "https://git.kernel.org/stable/c/717137221c7d90e7c98bda9a370c9da6cbf015e5"
},
{
"url": "https://git.kernel.org/stable/c/8dc5d98a16fa23c00999aecf10018c9f69fa5bf4"
}
],
"title": "ppp_async: drop the errored frame instead of resetting its headroom",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98158",
"datePublished": "2026-09-25T10:36:27.608Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-09-25T10:36:27.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98157 (GCVE-0-2026-98157)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
Summary
In the Linux kernel, the following vulnerability has been resolved:
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned
long, but the target field (poll_msec) is unsigned int. On 64-bit systems,
a value > UINT_MAX is silently truncated when stored.
Fix the mismatch by using kstrtouint() instead. This rejects values larger
than UINT_MAX at parse time, making truncation impossible. Also add a check
for value < 1 to reject the 0-delay case, which would cause the poll work to
spin without delay and consume 100% CPU.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e27e3dac651771fe3250f6305dee277bce29fc5d , < ea01c061d839b520f385f112908de1c6e3391327
(git)
Affected: e27e3dac651771fe3250f6305dee277bce29fc5d , < 528052af901d6e6bbfa0e52362a70a58a5dd1e43 (git) Affected: e27e3dac651771fe3250f6305dee277bce29fc5d , < 0e022ee4f8e0dc843ba4c80bb75408a7704279af (git) Affected: e27e3dac651771fe3250f6305dee277bce29fc5d , < 66cc9dec919dd63d8e4b3d386f7aed3ae684e645 (git) |
|
| Linux | Linux |
Affected:
2.6.23
Unaffected: 0 , < 2.6.23 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/edac/edac_device_sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea01c061d839b520f385f112908de1c6e3391327",
"status": "affected",
"version": "e27e3dac651771fe3250f6305dee277bce29fc5d",
"versionType": "git"
},
{
"lessThan": "528052af901d6e6bbfa0e52362a70a58a5dd1e43",
"status": "affected",
"version": "e27e3dac651771fe3250f6305dee277bce29fc5d",
"versionType": "git"
},
{
"lessThan": "0e022ee4f8e0dc843ba4c80bb75408a7704279af",
"status": "affected",
"version": "e27e3dac651771fe3250f6305dee277bce29fc5d",
"versionType": "git"
},
{
"lessThan": "66cc9dec919dd63d8e4b3d386f7aed3ae684e645",
"status": "affected",
"version": "e27e3dac651771fe3250f6305dee277bce29fc5d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/edac/edac_device_sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n\nThe poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned\nlong, but the target field (poll_msec) is unsigned int. On 64-bit systems,\na value \u003e UINT_MAX is silently truncated when stored.\n\nFix the mismatch by using kstrtouint() instead. This rejects values larger\nthan UINT_MAX at parse time, making truncation impossible. Also add a check\nfor value \u003c 1 to reject the 0-delay case, which would cause the poll work to\nspin without delay and consume 100% CPU."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:27.009Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea01c061d839b520f385f112908de1c6e3391327"
},
{
"url": "https://git.kernel.org/stable/c/528052af901d6e6bbfa0e52362a70a58a5dd1e43"
},
{
"url": "https://git.kernel.org/stable/c/0e022ee4f8e0dc843ba4c80bb75408a7704279af"
},
{
"url": "https://git.kernel.org/stable/c/66cc9dec919dd63d8e4b3d386f7aed3ae684e645"
}
],
"title": "EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98157",
"datePublished": "2026-09-25T10:36:27.009Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:27.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98156 (GCVE-0-2026-98156)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 14:42
VLAI
EPSS
VEX
Title
drm/virtio: use the DMA API for resource backing on Xen
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: use the DMA API for resource backing on Xen
On a Xen PV domain page addresses bear no relation to the real machine
addresses the host would have to use to reach it.
virtio_ring.c handles this correctly, vring_use_map_api() returns true
for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.
virtio-gpu makes the same decision independently, but its copy
looks only at the feature bit:
bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
QEMU does not set iommu_platform on virtio-vga by default, so
VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and
virtio_gpu_object_shmem_init() describes the framebuffer's backing pages
to the host with sg_phys(). Those are guest-physical addresses. In a PV
domain they resolve, on the host side, to pages belonging to some other
domain, so the host scans out unrelated memory.
Move the decision into virtio_gpu_use_dma_api() and give it the
xen_domain() check, like vring_use_map_api() has. This
additionally enables the dma_sync_sgtable_for_device() calls in
virtgpu_vq.c, which are required for correctness whenever swiotlb
is in play.
Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with
virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0
works fine and doesn't need this fix because it is identity-mapped,
only PV dom0s are affected.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a3b815f09bb846255c458c181b8a5b1cc66891b4 , < 93c557e947ef0040004b1ac6a1c1265d79a957e1
(git)
Affected: a3b815f09bb846255c458c181b8a5b1cc66891b4 , < 455184dbe9652d01470d3c5cf5edd09a7a673a99 (git) Affected: a3b815f09bb846255c458c181b8a5b1cc66891b4 , < 6a736d2f9d0c6e6217fe7532bc4c50ceca71db78 (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.h",
"drivers/gpu/drm/virtio/virtgpu_object.c",
"drivers/gpu/drm/virtio/virtgpu_vq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93c557e947ef0040004b1ac6a1c1265d79a957e1",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
},
{
"lessThan": "455184dbe9652d01470d3c5cf5edd09a7a673a99",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
},
{
"lessThan": "6a736d2f9d0c6e6217fe7532bc4c50ceca71db78",
"status": "affected",
"version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.h",
"drivers/gpu/drm/virtio/virtgpu_object.c",
"drivers/gpu/drm/virtio/virtgpu_vq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev-\u003evdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer\u0027s backing pages\nto the host with sg_phys(). Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn\u0027t need this fix because it is identity-mapped,\nonly PV dom0s are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker is a local process in the Xen PV dom0. It opens the virtio-gpu render node and calls VIRTGPU_RESOURCE_CREATE, which runs virtio_gpu_object_shmem_init(), and then VIRTGPU_TRANSFER_TO_HOST or TRANSFER_FROM_HOST. No remote peer supplies the bad sg_phys() addresses; the guest driver builds them itself.\nAC:H - The bug only exists on a Xen PV dom0 nested inside QEMU with virtio-vga and without iommu_platform, so VIRTIO_F_ACCESS_PLATFORM is not negotiated. This is a rare deployment the attacker cannot create. The attacker also cannot choose which foreign machine frames the pseudo-physical pfns resolve to.\nPR:L - VIRTGPU_RESOURCE_CREATE, TRANSFER_TO_HOST and TRANSFER_FROM_HOST are all marked DRM_RENDER_ALLOW. Any user with access to /dev/dri/renderD* (render group or a logind seat ACL) can reach them without root.\nUI:N - The attacker creates the resource and issues the transfer ioctls entirely on their own. No other user has to act.\nS:C - virtio_gpu_object_shmem_init() hands the host guest-pseudo-physical addresses, which the host resolves to machine frames owned by other Xen domains or by Xen itself. So a flaw in the dom0 driver affects memory outside that domain\u0027s security authority.\nC:H - virtio_gpu_cmd_transfer_to_host_2d/3d make the host copy unrelated machine pages (other domains\u0027 memory) into a host resource, which is then scanned out. With virgl, the attacker could plausibly copy that resource into memory they can read back.\nI:H - With virgl, VIRTGPU_TRANSFER_FROM_HOST makes the host write resource data to the wrong backing addresses. Those addresses are machine frames belonging to other domains or the hypervisor, so this is an uncontrolled cross-domain memory write.\nA:H - Host writes into foreign machine frames through the bad backing entries can corrupt Xen or other domains\u0027 memory, crashing them. The unsynced swiotlb path (missing dma_sync_sgtable_for_device) also corrupts display data."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:42:14.960Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1"
},
{
"url": "https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99"
},
{
"url": "https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"
}
],
"title": "drm/virtio: use the DMA API for resource backing on Xen",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98156",
"datePublished": "2026-09-25T10:36:26.409Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T14:42:14.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98155 (GCVE-0-2026-98155)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
accel/qaic: Address potential out-of-bounds read in resp_worker()
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Address potential out-of-bounds read in resp_worker()
Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the
owner went away")' fixes the scenario it was intended for by walking the
message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it
skipped over the bounds checking code that is included in decode_message().
This could lead to issues such as reading past the slab allocation's end,
infinite loops or kernel panics. For those issues to happen, a malformed
wire message is needed to be sent from the device.
Instead of duplicating the bounds checking code already present in
decode_message(), use the function inside resp_worker().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
08021f2d4a557d6491e3bcc288e96425f50aa3cf , < f4b64488f3deca63f7fbc7d7c3835b2e668003f9
(git)
Affected: f403094d9075d7c565a3d81002b781c325cb3c07 , < 12deeade460d47031267256ba07add51cc7eabd0 (git) Affected: 2feec5ae5df785658924ab6bd91280dc3926507c , < c72e81ee46bdd4c221114d6e9515e9b4647616d7 (git) Affected: 2feec5ae5df785658924ab6bd91280dc3926507c , < ab243f74ab4084ca5c8dec608cb5b0deb27db067 (git) Affected: 2dd67966f39a2abf8ccb4865031c722e40e01b7f (git) Affected: ee0180e77e6c8482644569632065411de844c515 (git) Affected: 6.12.81 , < 6.12.111 (semver) Affected: 6.18.22 , < 6.18.53 (semver) Affected: 6.6.134 , < 6.7 (semver) Affected: 6.19.12 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/qaic/qaic_control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4b64488f3deca63f7fbc7d7c3835b2e668003f9",
"status": "affected",
"version": "08021f2d4a557d6491e3bcc288e96425f50aa3cf",
"versionType": "git"
},
{
"lessThan": "12deeade460d47031267256ba07add51cc7eabd0",
"status": "affected",
"version": "f403094d9075d7c565a3d81002b781c325cb3c07",
"versionType": "git"
},
{
"lessThan": "c72e81ee46bdd4c221114d6e9515e9b4647616d7",
"status": "affected",
"version": "2feec5ae5df785658924ab6bd91280dc3926507c",
"versionType": "git"
},
{
"lessThan": "ab243f74ab4084ca5c8dec608cb5b0deb27db067",
"status": "affected",
"version": "2feec5ae5df785658924ab6bd91280dc3926507c",
"versionType": "git"
},
{
"status": "affected",
"version": "2dd67966f39a2abf8ccb4865031c722e40e01b7f",
"versionType": "git"
},
{
"status": "affected",
"version": "ee0180e77e6c8482644569632065411de844c515",
"versionType": "git"
},
{
"lessThan": "6.12.111",
"status": "affected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThan": "6.18.53",
"status": "affected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/qaic/qaic_control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.12.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.18.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.134",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Address potential out-of-bounds read in resp_worker()\n\nAlthough \u0027commit 2feec5ae5df7 (\"accel/qaic: Handle DBC deactivation if the\nowner went away\")\u0027 fixes the scenario it was intended for by walking the\nmessage and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it\nskipped over the bounds checking code that is included in decode_message().\nThis could lead to issues such as reading past the slab allocation\u0027s end,\ninfinite loops or kernel panics. For those issues to happen, a malformed\nwire message is needed to be sent from the device.\n\nInstead of duplicating the bounds checking code already present in\ndecode_message(), use the function inside resp_worker()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:25.812Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4b64488f3deca63f7fbc7d7c3835b2e668003f9"
},
{
"url": "https://git.kernel.org/stable/c/12deeade460d47031267256ba07add51cc7eabd0"
},
{
"url": "https://git.kernel.org/stable/c/c72e81ee46bdd4c221114d6e9515e9b4647616d7"
},
{
"url": "https://git.kernel.org/stable/c/ab243f74ab4084ca5c8dec608cb5b0deb27db067"
}
],
"title": "accel/qaic: Address potential out-of-bounds read in resp_worker()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98155",
"datePublished": "2026-09-25T10:36:25.812Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:25.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98154 (GCVE-0-2026-98154)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 14:42
VLAI
EPSS
VEX
Title
nvme-rdma: fix -EIO cleanup order in queue_rq
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: fix -EIO cleanup order in queue_rq
On -EIO, the RDMA queue_rq path reports a host path error and then
still cleans up the command and unmaps the SQE DMA. The path error
helper completes the request, so that is double cleanup and DMA unmap
after the request is already complete.
Unmap the SQE first, then report the host path error. Skip the outer
command cleanup on that path.
Severity
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
62eca39722fd997e3621fc903229917b9f0fb271 , < a41e7fc8d244d9cfc6273051aed85b67adedbb89
(git)
Affected: 62eca39722fd997e3621fc903229917b9f0fb271 , < cf3e706963ffbd3ee2568fa0d08ab016f0575ea8 (git) Affected: 62eca39722fd997e3621fc903229917b9f0fb271 , < 171b993a4aed9889159df4815b6a6ba141e61975 (git) Affected: 62eca39722fd997e3621fc903229917b9f0fb271 , < d61828199c6cb4b76d48403c77023cd4bb9d09fc (git) |
|
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a41e7fc8d244d9cfc6273051aed85b67adedbb89",
"status": "affected",
"version": "62eca39722fd997e3621fc903229917b9f0fb271",
"versionType": "git"
},
{
"lessThan": "cf3e706963ffbd3ee2568fa0d08ab016f0575ea8",
"status": "affected",
"version": "62eca39722fd997e3621fc903229917b9f0fb271",
"versionType": "git"
},
{
"lessThan": "171b993a4aed9889159df4815b6a6ba141e61975",
"status": "affected",
"version": "62eca39722fd997e3621fc903229917b9f0fb271",
"versionType": "git"
},
{
"lessThan": "d61828199c6cb4b76d48403c77023cd4bb9d09fc",
"status": "affected",
"version": "62eca39722fd997e3621fc903229917b9f0fb271",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix -EIO cleanup order in queue_rq\n\nOn -EIO, the RDMA queue_rq path reports a host path error and then\nstill cleans up the command and unmaps the SQE DMA. The path error\nhelper completes the request, so that is double cleanup and DMA unmap\nafter the request is already complete.\n\nUnmap the SQE first, then report the host path error. Skip the outer\ncommand cleanup on that path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the -EIO error path of nvme_rdma_queue_rq(), reached when a local user submits block I/O to an nvme-rdma namespace. The -EIO comes from ib_dma_map_sg() failing in nvme_rdma_dma_map_req() or from the HCA\u0027s internal-error state in ib_post_send(). The NVMe-oF target sends no data that causes it, so the vector is local.\nAC:H - The path needs a DMA mapping failure or an mlx4/mlx5 HCA in MLX*_DEVICE_STATE_INTERNAL_ERROR, which the attacker can\u0027t cause on demand. Turning the second nvme_cleanup_cmd()/sqe unmap into corruption also needs the freed tag to be reused (for example by a discard with RQF_SPECIAL_PAYLOAD) between completion and the stale cleanup.\nPR:L - The attacker only needs to issue ordinary I/O, including discards, to a filesystem or block device backed by an nvme-rdma namespace. An unprivileged user with write access can do that. Setting up the NVMe-oF connection is an admin step the attacker does not need to perform.\nUI:N - No victim action is needed; the attacker\u0027s own I/O submissions drive nvme_rdma_queue_rq() into the failing path.\nS:U - The corruption hits host kernel memory and the host\u0027s own DMA mappings, inside the kernel\u0027s security authority. No guest, IOMMU or sandbox boundary is crossed.\nC:H - nvme_host_path_error() completes the request and may free its tag. The later nvme_cleanup_cmd() can then kfree() the special_vec range buffer of a request that reused the tag (a use-after-free), and ib_dma_unmap_single() can tear down another request\u0027s sqe mapping. Both are memory-corruption primitives that could leak data.\nI:H - Freeing a live discard range buffer and unmapping a reused request\u0027s command DMA mapping lets freed memory be reallocated while the HCA or driver still uses it. That can corrupt kernel heap objects or change the NVMe command sent to the target.\nA:H - The double cleanup of a completed or requeued request can cause a double kfree, a DMA-unmap fault or a KASAN/oops, which crashes the host kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:42:13.909Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a41e7fc8d244d9cfc6273051aed85b67adedbb89"
},
{
"url": "https://git.kernel.org/stable/c/cf3e706963ffbd3ee2568fa0d08ab016f0575ea8"
},
{
"url": "https://git.kernel.org/stable/c/171b993a4aed9889159df4815b6a6ba141e61975"
},
{
"url": "https://git.kernel.org/stable/c/d61828199c6cb4b76d48403c77023cd4bb9d09fc"
}
],
"title": "nvme-rdma: fix -EIO cleanup order in queue_rq",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98154",
"datePublished": "2026-09-25T10:36:25.215Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T14:42:13.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98153 (GCVE-0-2026-98153)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
nvme: fix racy access to FDP placement id array
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix racy access to FDP placement id array
nvme_query_fdp_info() is called per-path and therefore prone to races.
It populates head->nr_plids/head->plids for fdp registration.
But nothing protects that pair from concurrent access - two paths scanning
the same namespace can race to populate it.
Avoid the race by moving this initialization work to nvme_alloc_ns_head()
which is called once per shared namespace.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
30b5f20bb2ddab013035399e5c7e6577da49320a , < e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba
(git)
Affected: 30b5f20bb2ddab013035399e5c7e6577da49320a , < 56e1c6bbe4bb084d7ecf61698afdf70be23dd35f (git) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c",
"drivers/nvme/host/nvme.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba",
"status": "affected",
"version": "30b5f20bb2ddab013035399e5c7e6577da49320a",
"versionType": "git"
},
{
"lessThan": "56e1c6bbe4bb084d7ecf61698afdf70be23dd35f",
"status": "affected",
"version": "30b5f20bb2ddab013035399e5c7e6577da49320a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c",
"drivers/nvme/host/nvme.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix racy access to FDP placement id array\n\nnvme_query_fdp_info() is called per-path and therefore prone to races.\n\nIt populates head-\u003enr_plids/head-\u003eplids for fdp registration.\nBut nothing protects that pair from concurrent access - two paths scanning\nthe same namespace can race to populate it.\n\nAvoid the race by moving this initialization work to nvme_alloc_ns_head()\nwhich is called once per shared namespace."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:24.622Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba"
},
{
"url": "https://git.kernel.org/stable/c/56e1c6bbe4bb084d7ecf61698afdf70be23dd35f"
}
],
"title": "nvme: fix racy access to FDP placement id array",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98153",
"datePublished": "2026-09-25T10:36:24.622Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:24.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98152 (GCVE-0-2026-98152)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
nvmet-rdma: fix queue leak when connect backlog is exceeded
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma: fix queue leak when connect backlog is exceeded
When pending disconnecting queues exceed the backlog limit, the
connect path only drops the device reference and leaks the newly
allocated queue and its IB resources.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
204b9645536bb4a77a2cb35e6519dbf9f4ea1665 , < 186414a6a1a34e081b07e8873622f90402346235
(git)
Affected: 00eaa58988d35fd47ca8811f7f72871591f61ffb , < e48f9d1076f8c62c3969588d638602b94aaeff12 (git) Affected: 712f3268a62d0df98a7ee991cba963ced2e58007 , < 32e598324edc3ebb1ac9362d5b9fc30ce0de4873 (git) Affected: d65fe42820b890a6a4644de0a95a812471f79ad3 , < 287420cde9d6669abcd2878c344db67423eb7df6 (git) Affected: a8803c4f0ac3fa7df5551bbb5a8800c434a94357 , < 4f7cf573cdf0ee857448b9b1967d686b07c71e7d (git) Affected: badc53620fe813b3a9f727ef9526f98567c2c898 , < 60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa (git) Affected: badc53620fe813b3a9f727ef9526f98567c2c898 , < fb1ed67788e21832b614c23767a088c08cfdd2f2 (git) Affected: 5828517d17eda27f21d29ea14800c9e0a57bad11 (git) Affected: 6.12.96 , < 6.12.111 (semver) Affected: 6.18.39 , < 6.18.53 (semver) Affected: 7.1.4 , < 7.2 (semver) |
|
| Linux | Linux |
Affected:
7.2
Unaffected: 0 , < 7.2 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "186414a6a1a34e081b07e8873622f90402346235",
"status": "affected",
"version": "204b9645536bb4a77a2cb35e6519dbf9f4ea1665",
"versionType": "git"
},
{
"lessThan": "e48f9d1076f8c62c3969588d638602b94aaeff12",
"status": "affected",
"version": "00eaa58988d35fd47ca8811f7f72871591f61ffb",
"versionType": "git"
},
{
"lessThan": "32e598324edc3ebb1ac9362d5b9fc30ce0de4873",
"status": "affected",
"version": "712f3268a62d0df98a7ee991cba963ced2e58007",
"versionType": "git"
},
{
"lessThan": "287420cde9d6669abcd2878c344db67423eb7df6",
"status": "affected",
"version": "d65fe42820b890a6a4644de0a95a812471f79ad3",
"versionType": "git"
},
{
"lessThan": "4f7cf573cdf0ee857448b9b1967d686b07c71e7d",
"status": "affected",
"version": "a8803c4f0ac3fa7df5551bbb5a8800c434a94357",
"versionType": "git"
},
{
"lessThan": "60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa",
"status": "affected",
"version": "badc53620fe813b3a9f727ef9526f98567c2c898",
"versionType": "git"
},
{
"lessThan": "fb1ed67788e21832b614c23767a088c08cfdd2f2",
"status": "affected",
"version": "badc53620fe813b3a9f727ef9526f98567c2c898",
"versionType": "git"
},
{
"status": "affected",
"version": "5828517d17eda27f21d29ea14800c9e0a57bad11",
"versionType": "git"
},
{
"lessThan": "6.12.111",
"status": "affected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThan": "6.18.53",
"status": "affected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.12.96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: fix queue leak when connect backlog is exceeded\n\nWhen pending disconnecting queues exceed the backlog limit, the\nconnect path only drops the device reference and leaks the newly\nallocated queue and its IB resources."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:24.020Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/186414a6a1a34e081b07e8873622f90402346235"
},
{
"url": "https://git.kernel.org/stable/c/e48f9d1076f8c62c3969588d638602b94aaeff12"
},
{
"url": "https://git.kernel.org/stable/c/32e598324edc3ebb1ac9362d5b9fc30ce0de4873"
},
{
"url": "https://git.kernel.org/stable/c/287420cde9d6669abcd2878c344db67423eb7df6"
},
{
"url": "https://git.kernel.org/stable/c/4f7cf573cdf0ee857448b9b1967d686b07c71e7d"
},
{
"url": "https://git.kernel.org/stable/c/60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa"
},
{
"url": "https://git.kernel.org/stable/c/fb1ed67788e21832b614c23767a088c08cfdd2f2"
}
],
"title": "nvmet-rdma: fix queue leak when connect backlog is exceeded",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98152",
"datePublished": "2026-09-25T10:36:24.020Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:24.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98151 (GCVE-0-2026-98151)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
Take the following unprivileged program as an example:
r0 = bpf_map_lookup_elem(...) /* PTR_TO_MAP_VALUE, offset 0 */
...
14: r0 += r1 /* r1 is a bounded scalar */
15: r9 = r0
Loading it triggers a verifier warning from reg_bounds_sanity_check():
verifier bug: REG INVARIANTS VIOLATION (alu): const subreg tnum out
of sync with range bounds r64={.base=0x0, .size=0x0}
r32={.base=0x0, .size=0xffffffff} var_off=(0x0, 0x0)
What happens:
1. Processing insn 14 (r0 += r1) in adjust_ptr_min_max_vals(), the new
offset is computed into dst_reg's var_off and 32/64-bit ranges.
2. Because pointer registers do not track 32-bit subregister bounds,
__mark_reg32_unbounded() first sets r32 to the full range; r32 is
re-derived from the offset at the end of the function by
reg_bounds_sync().
3. On the unprivileged path, sanitize_ptr_alu() is called and, via
sanitize_speculative_path() -> push_stack(), snapshots the current
register state and schedules the next instruction (insn 15) to be
verified directly as a speculative path.
4. That snapshot is taken between step 2 and the final reg_bounds_sync():
at this point dst_reg's var_off still holds the (const) original
offset while r32 has just been blanked to the full range, i.e. the two
are out of sync. When the speculative path later verifies insn 15
(r9 = r0), the inconsistent state reaches reg_bounds_sanity_check() and
trips the warning.
var_off and the 32-bit range must always be consistent. There are two
ways to keep the snapshot consistent:
1. sync var_off and r32 before the snapshot so they match, or
2. leave r32 at its original (already consistent) value and blank it
only after the snapshot.
The whole point of sanitize_ptr_alu() is to insert a harmless masking
sequence that keeps the access in bounds under speculation, so the state
it snapshots should faithfully represent that. Take approach 2: move
__mark_reg32_unbounded() to after sanitize_ptr_alu(), so the speculative
snapshot keeps the pointer's original, consistent r32. The non-speculative
path is unchanged: r32 is still blanked before the offset is applied and
re-derived by reg_bounds_sync().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5f99f312bd3bedb3b266b0d26376a8c500cdc97f , < 21a681526c715aebb4f918b8c131583442d1b3d8
(git)
Affected: 5f99f312bd3bedb3b266b0d26376a8c500cdc97f , < d623a4a58bb238443505d5c2949d1182dcfc26b6 (git) Affected: 5f99f312bd3bedb3b266b0d26376a8c500cdc97f , < 9f9477ae73de9c5a28e8ab7000d8097b078faee4 (git) Affected: 5f99f312bd3bedb3b266b0d26376a8c500cdc97f , < 150aeba624e8b7cac51c39440d7e8e1fd11de9a0 (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21a681526c715aebb4f918b8c131583442d1b3d8",
"status": "affected",
"version": "5f99f312bd3bedb3b266b0d26376a8c500cdc97f",
"versionType": "git"
},
{
"lessThan": "d623a4a58bb238443505d5c2949d1182dcfc26b6",
"status": "affected",
"version": "5f99f312bd3bedb3b266b0d26376a8c500cdc97f",
"versionType": "git"
},
{
"lessThan": "9f9477ae73de9c5a28e8ab7000d8097b078faee4",
"status": "affected",
"version": "5f99f312bd3bedb3b266b0d26376a8c500cdc97f",
"versionType": "git"
},
{
"lessThan": "150aeba624e8b7cac51c39440d7e8e1fd11de9a0",
"status": "affected",
"version": "5f99f312bd3bedb3b266b0d26376a8c500cdc97f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic\n\nTake the following unprivileged program as an example:\n\n\tr0 = bpf_map_lookup_elem(...)\t/* PTR_TO_MAP_VALUE, offset 0 */\n\t...\n\t14: r0 += r1\t\t\t/* r1 is a bounded scalar */\n\t15: r9 = r0\n\nLoading it triggers a verifier warning from reg_bounds_sanity_check():\n\n\tverifier bug: REG INVARIANTS VIOLATION (alu): const subreg tnum out\n\tof sync with range bounds r64={.base=0x0, .size=0x0}\n\tr32={.base=0x0, .size=0xffffffff} var_off=(0x0, 0x0)\n\nWhat happens:\n\n1. Processing insn 14 (r0 += r1) in adjust_ptr_min_max_vals(), the new\n offset is computed into dst_reg\u0027s var_off and 32/64-bit ranges.\n\n2. Because pointer registers do not track 32-bit subregister bounds,\n __mark_reg32_unbounded() first sets r32 to the full range; r32 is\n re-derived from the offset at the end of the function by\n reg_bounds_sync().\n\n3. On the unprivileged path, sanitize_ptr_alu() is called and, via\n sanitize_speculative_path() -\u003e push_stack(), snapshots the current\n register state and schedules the next instruction (insn 15) to be\n verified directly as a speculative path.\n\n4. That snapshot is taken between step 2 and the final reg_bounds_sync():\n at this point dst_reg\u0027s var_off still holds the (const) original\n offset while r32 has just been blanked to the full range, i.e. the two\n are out of sync. When the speculative path later verifies insn 15\n (r9 = r0), the inconsistent state reaches reg_bounds_sanity_check() and\n trips the warning.\n\nvar_off and the 32-bit range must always be consistent. There are two\nways to keep the snapshot consistent:\n\n 1. sync var_off and r32 before the snapshot so they match, or\n 2. leave r32 at its original (already consistent) value and blank it\n only after the snapshot.\n\nThe whole point of sanitize_ptr_alu() is to insert a harmless masking\nsequence that keeps the access in bounds under speculation, so the state\nit snapshots should faithfully represent that. Take approach 2: move\n__mark_reg32_unbounded() to after sanitize_ptr_alu(), so the speculative\nsnapshot keeps the pointer\u0027s original, consistent r32. The non-speculative\npath is unchanged: r32 is still blanked before the offset is applied and\nre-derived by reg_bounds_sync()."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:23.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21a681526c715aebb4f918b8c131583442d1b3d8"
},
{
"url": "https://git.kernel.org/stable/c/d623a4a58bb238443505d5c2949d1182dcfc26b6"
},
{
"url": "https://git.kernel.org/stable/c/9f9477ae73de9c5a28e8ab7000d8097b078faee4"
},
{
"url": "https://git.kernel.org/stable/c/150aeba624e8b7cac51c39440d7e8e1fd11de9a0"
}
],
"title": "bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98151",
"datePublished": "2026-09-25T10:36:23.412Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:23.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98150 (GCVE-0-2026-98150)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 14:42
VLAI
EPSS
VEX
Title
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map
operation flags. bpf_map_check_op_flags() currently compares that ID
with num_possible_cpus(), which is the number of possible CPUs rather
than a bound on CPU IDs.
On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU
mask was 0,2-3. A userspace program using raw bpf() syscalls creates
a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations
for each CPU by setting BPF_F_CPU and the CPU ID in the flags.
With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is
rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map
access path and triggers:
Unable to handle kernel paging request at virtual address ...
pc : __pi_memcpy_generic+0x5c/0x22c
lr : bpf_percpu_array_update+0x2dc/0x2e8
Call trace:
__pi_memcpy_generic
bpf_map_update_value
map_update_elem
__sys_bpf
Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This
rejects CPU IDs outside the valid range and CPUs absent from the
possible mask, while allowing valid sparse CPU IDs.
Severity
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2b421662c7887a0649fe409155a1f101562d0fa9 , < bdc5941f6eeef90b76a07fd8ca38ac1933ba2195
(git)
Affected: 2b421662c7887a0649fe409155a1f101562d0fa9 , < ed54bf564ac52699cf4def3d0c2125d493e756f9 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdc5941f6eeef90b76a07fd8ca38ac1933ba2195",
"status": "affected",
"version": "2b421662c7887a0649fe409155a1f101562d0fa9",
"versionType": "git"
},
{
"lessThan": "ed54bf564ac52699cf4def3d0c2125d493e756f9",
"status": "affected",
"version": "2b421662c7887a0649fe409155a1f101562d0fa9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/bpf.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix BPF_F_CPU validation for sparse CPU IDs\n\nBPF_F_CPU stores the target CPU ID in the upper 32 bits of the map\noperation flags. bpf_map_check_op_flags() currently compares that ID\nwith num_possible_cpus(), which is the number of possible CPUs rather\nthan a bound on CPU IDs.\n\nOn an arm64 QEMU guest with a CPU device-tree hole, the possible CPU\nmask was 0,2-3. A userspace program using raw bpf() syscalls creates\na BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations\nfor each CPU by setting BPF_F_CPU and the CPU ID in the flags.\n\nWith the old check, CPU 1 is incorrectly accepted while valid CPU 3 is\nrejected with -ERANGE. The CPU 1 update then reaches the per-CPU map\naccess path and triggers:\n\n Unable to handle kernel paging request at virtual address ...\n pc : __pi_memcpy_generic+0x5c/0x22c\n lr : bpf_percpu_array_update+0x2dc/0x2e8\n Call trace:\n __pi_memcpy_generic\n bpf_map_update_value\n map_update_elem\n __sys_bpf\n\nCheck the CPU ID against nr_cpu_ids and cpu_possible() instead. This\nrejects CPU IDs outside the valid range and CPUs absent from the\npossible mask, while allowing valid sparse CPU IDs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The out-of-range CPU ID arrives in attr-\u003eflags of the local bpf(2) BPF_MAP_UPDATE_ELEM/LOOKUP_ELEM syscall (map_update_elem/map_lookup_elem -\u003e bpf_map_check_op_flags); no network or adjacent protocol carries it.\nAC:H - The check only lets through a CPU ID in a hole of the possible-CPU mask (e.g. 0,2-3 on arm64 device-tree systems). That topology comes from firmware/hardware and the attacker can\u0027t create it. It also needs a permissive BPF setup, and where the stray per_cpu_ptr() lands (unmapped init memory vs mapped .data) depends on percpu allocator placement.\nPR:L - BPF_MAP_TYPE_PERCPU_ARRAY/PERCPU_HASH are in map_create()\u0027s unprivileged list when unprivileged_bpf_disabled=0 or with a delegated BPF token, and map_update_elem/map_lookup_elem check only FMODE_CAN_WRITE/READ on the map fd, not a capability.\nUI:N - The attacker creates or opens the per-CPU map and issues the update/lookup with BPF_F_CPU and a hole CPU ID entirely on their own; no other user acts.\nS:U - The bad access corrupts or reads kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - bpf_percpu_array_copy() copies value_size bytes from per_cpu_ptr(pptr, cpu) for a missing CPU whose __per_cpu_offset is 0, i.e. from a stray kernel address, back to userspace via BPF_MAP_LOOKUP_ELEM, and the attacker can repeat it.\nI:H - bpf_percpu_array_update() does copy_map_value() of attacker-supplied value bytes to per_cpu_ptr(pptr, cpu) for the missing CPU. That is an out-of-bounds write of controlled data to an address outside any valid per-CPU unit, which can land in kernel .data past __init_end.\nA:H - As the fix commit shows, the update faults in __pi_memcpy_generic from bpf_percpu_array_update on unmapped memory (the freed/vunmapped __init region on arm64), causing a kernel oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T14:42:12.855Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdc5941f6eeef90b76a07fd8ca38ac1933ba2195"
},
{
"url": "https://git.kernel.org/stable/c/ed54bf564ac52699cf4def3d0c2125d493e756f9"
}
],
"title": "bpf: Fix BPF_F_CPU validation for sparse CPU IDs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98150",
"datePublished": "2026-09-25T10:36:22.774Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T14:42:12.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98149 (GCVE-0-2026-98149)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
bpf: Fix percpu map update indexing with sparse CPU IDs
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix percpu map update indexing with sparse CPU IDs
Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU
or BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in
possible-CPU order. The buffer is sized as:
round_up(value_size, 8) * num_possible_cpus()
The update paths iterate over possible CPUs, but use the logical CPU ID
to calculate the source offset:
value + size * cpu
This only works when possible CPU IDs are contiguous starting at zero.
For example, with a possible CPU mask of 0,2-3, the buffer contains
three slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore
expected to use slot 1 and CPU3 slot 2. Instead, the current code uses
slots 2 and 3 respectively, causing incorrect per-CPU values and an
out-of-bounds read from the update buffer for CPU3.
The corresponding lookup paths already use a dense offset while
iterating over possible CPUs. Do the same for the array, hash, and
cgroup storage update paths, advancing the source offset once for each
possible CPU. BPF_F_ALL_CPUS continues to use the same value for every
CPU.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360 , < c16c62c91e5d6737a9fbb0a541b8b34610470a2b
(git)
Affected: 8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360 , < 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 (git) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"kernel/bpf/hashtab.c",
"kernel/bpf/local_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c16c62c91e5d6737a9fbb0a541b8b34610470a2b",
"status": "affected",
"version": "8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360",
"versionType": "git"
},
{
"lessThan": "75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7",
"status": "affected",
"version": "8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"kernel/bpf/hashtab.c",
"kernel/bpf/local_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix percpu map update indexing with sparse CPU IDs\n\nPer-CPU array, hash, and cgroup storage map updates without BPF_F_CPU\nor BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in\npossible-CPU order. The buffer is sized as:\n\n round_up(value_size, 8) * num_possible_cpus()\n\nThe update paths iterate over possible CPUs, but use the logical CPU ID\nto calculate the source offset:\n\n value + size * cpu\n\nThis only works when possible CPU IDs are contiguous starting at zero.\n\nFor example, with a possible CPU mask of 0,2-3, the buffer contains\nthree slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore\nexpected to use slot 1 and CPU3 slot 2. Instead, the current code uses\nslots 2 and 3 respectively, causing incorrect per-CPU values and an\nout-of-bounds read from the update buffer for CPU3.\n\nThe corresponding lookup paths already use a dense offset while\niterating over possible CPUs. Do the same for the array, hash, and\ncgroup storage update paths, advancing the source offset once for each\npossible CPU. BPF_F_ALL_CPUS continues to use the same value for every\nCPU."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:22.182Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c16c62c91e5d6737a9fbb0a541b8b34610470a2b"
},
{
"url": "https://git.kernel.org/stable/c/75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7"
}
],
"title": "bpf: Fix percpu map update indexing with sparse CPU IDs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98149",
"datePublished": "2026-09-25T10:36:22.182Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:22.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98148 (GCVE-0-2026-98148)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
drm/gud: validate GUD_ROTATION_0 is present in supported rotations
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: validate GUD_ROTATION_0 is present in supported rotations
The rotation argument to drm_plane_create_rotation_property() is set to
DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as
the supported_rotations argument. The driver never validates that
GUD_ROTATION_0 is present, so a device that omits it from its
GUD_PROPERTY_ROTATION triggers the
WARN_ON(rotation & ~supported_rotations) in
drm_plane_create_rotation_property()
Fix this by skipping the creation of rotation property if the device
doesn't have the GUD_ROTATION_0 bit
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
40e1a70b4aedf2859a1829991b48ef0ebe650bf2 , < b2cd682324b889011874cf844b7c7efa97c97296
(git)
Affected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 , < 876b33d8a9a00e9d4bbcbb7f55ad2c05974850de (git) Affected: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 , < cb732d027aa18e1fcf9d2797f47d20b179ebc59c (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gud/gud_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b2cd682324b889011874cf844b7c7efa97c97296",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "876b33d8a9a00e9d4bbcbb7f55ad2c05974850de",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "cb732d027aa18e1fcf9d2797f47d20b179ebc59c",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gud/gud_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: validate GUD_ROTATION_0 is present in supported rotations\n\nThe rotation argument to drm_plane_create_rotation_property() is set to\nDRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as\nthe supported_rotations argument. The driver never validates that\nGUD_ROTATION_0 is present, so a device that omits it from its\nGUD_PROPERTY_ROTATION triggers the\nWARN_ON(rotation \u0026 ~supported_rotations) in\ndrm_plane_create_rotation_property()\n\nFix this by skipping the creation of rotation property if the device\ndoesn\u0027t have the GUD_ROTATION_0 bit"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:21.562Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b2cd682324b889011874cf844b7c7efa97c97296"
},
{
"url": "https://git.kernel.org/stable/c/876b33d8a9a00e9d4bbcbb7f55ad2c05974850de"
},
{
"url": "https://git.kernel.org/stable/c/cb732d027aa18e1fcf9d2797f47d20b179ebc59c"
}
],
"title": "drm/gud: validate GUD_ROTATION_0 is present in supported rotations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98148",
"datePublished": "2026-09-25T10:36:21.562Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:21.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98147 (GCVE-0-2026-98147)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
printk: Don't WARN on kthread_run failure.
Summary
In the Linux kernel, the following vulnerability has been resolved:
printk: Don't WARN on kthread_run failure.
Since __kthread_create_on_node() returns -EINTR upon SIGKILL,
we should not use WARN_ON() in order to catch kthread_run() failure.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
76f258bf3f2aae570209319944703a92ac64e29e , < 4e676279798148382497d0e38c0bd51115e64be1
(git)
Affected: 76f258bf3f2aae570209319944703a92ac64e29e , < 72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/printk/nbcon.c",
"kernel/printk/printk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e676279798148382497d0e38c0bd51115e64be1",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
},
{
"lessThan": "72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d",
"status": "affected",
"version": "76f258bf3f2aae570209319944703a92ac64e29e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/printk/nbcon.c",
"kernel/printk/printk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Don\u0027t WARN on kthread_run failure.\n\nSince __kthread_create_on_node() returns -EINTR upon SIGKILL,\nwe should not use WARN_ON() in order to catch kthread_run() failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:20.926Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e676279798148382497d0e38c0bd51115e64be1"
},
{
"url": "https://git.kernel.org/stable/c/72dd0ec09e7cc98ed58ddeac26575e5d1ab8a93d"
}
],
"title": "printk: Don\u0027t WARN on kthread_run failure.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98147",
"datePublished": "2026-09-25T10:36:20.926Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:20.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98146 (GCVE-0-2026-98146)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
struct amdxdna_cmd_chain contains a flexible array annotated with
__counted_by(command_count). Since the structure is stored in shared
AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
If command_count is changed to zero, the bounds check generated from
__counted_by may fail and trigger a kernel panic.
Remove __counted_by to avoid relying on the userspace-controlled
command_count for the flexible array bounds check.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
aac243092b707bb3018e951d470cc1a9bcbaba6c , < 93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a
(git)
Affected: aac243092b707bb3018e951d470cc1a9bcbaba6c , < 52f3e086760a9a3e02a46a10b57caffd73b1c204 (git) Affected: aac243092b707bb3018e951d470cc1a9bcbaba6c , < b3709d354545e70388177500761f92d906c4dfd6 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_ctx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a",
"status": "affected",
"version": "aac243092b707bb3018e951d470cc1a9bcbaba6c",
"versionType": "git"
},
{
"lessThan": "52f3e086760a9a3e02a46a10b57caffd73b1c204",
"status": "affected",
"version": "aac243092b707bb3018e951d470cc1a9bcbaba6c",
"versionType": "git"
},
{
"lessThan": "b3709d354545e70388177500761f92d906c4dfd6",
"status": "affected",
"version": "aac243092b707bb3018e951d470cc1a9bcbaba6c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/amdxdna_ctx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain\n\nstruct amdxdna_cmd_chain contains a flexible array annotated with\n__counted_by(command_count). Since the structure is stored in shared\nAMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.\nIf command_count is changed to zero, the bounds check generated from\n__counted_by may fail and trigger a kernel panic.\n\nRemove __counted_by to avoid relying on the userspace-controlled\ncommand_count for the flexible array bounds check."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:20.303Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93fa3e925b15b0ded0a549fe7f12bfbb1c4e171a"
},
{
"url": "https://git.kernel.org/stable/c/52f3e086760a9a3e02a46a10b57caffd73b1c204"
},
{
"url": "https://git.kernel.org/stable/c/b3709d354545e70388177500761f92d906c4dfd6"
}
],
"title": "accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98146",
"datePublished": "2026-09-25T10:36:20.303Z",
"dateReserved": "2026-09-25T10:25:14.320Z",
"dateUpdated": "2026-09-25T10:36:20.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98145 (GCVE-0-2026-98145)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 10:36
VLAI
EPSS
VEX
Title
accel/amdxdna: reject a command chain that carries no commands
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/amdxdna: reject a command chain that carries no commands
A chain whose command_count is zero passes the payload length check,
because struct_size(payload, data, 0) is just the header. The fill loop
then does not run, so offset stays zero and the request is submitted with
a zero-length buffer.
On firmware without AIE2_NPU_COMMAND that ends at the opcode check, since
op is still ERT_INVALID_CMD and aie2_get_chain_msg_op() answers
MSG_OP_MAX_OPCODE. aie2_get_npu_chain_msg_op() answers
MSG_OP_CHAIN_EXEC_NPU whatever it is given, so there the submission
continues to drm_clflush_virt_range(cmd_buf, 0), which reads the byte
before the buffer and faults on the vmap guard page. EXEC_CMD is
reachable by any process that can open the render node.
Reject the request instead.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf , < ed74e8d603df457bfcf16ed4f8f1660a1525759e
(git)
Affected: 8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf , < ef6d27af71e1dc43181ec797a6aaa77c27c36786 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed74e8d603df457bfcf16ed4f8f1660a1525759e",
"status": "affected",
"version": "8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf",
"versionType": "git"
},
{
"lessThan": "ef6d27af71e1dc43181ec797a6aaa77c27c36786",
"status": "affected",
"version": "8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/amdxdna/aie2_message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc2",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: reject a command chain that carries no commands\n\nA chain whose command_count is zero passes the payload length check,\nbecause struct_size(payload, data, 0) is just the header. The fill loop\nthen does not run, so offset stays zero and the request is submitted with\na zero-length buffer.\n\nOn firmware without AIE2_NPU_COMMAND that ends at the opcode check, since\nop is still ERT_INVALID_CMD and aie2_get_chain_msg_op() answers\nMSG_OP_MAX_OPCODE. aie2_get_npu_chain_msg_op() answers\nMSG_OP_CHAIN_EXEC_NPU whatever it is given, so there the submission\ncontinues to drm_clflush_virt_range(cmd_buf, 0), which reads the byte\nbefore the buffer and faults on the vmap guard page. EXEC_CMD is\nreachable by any process that can open the render node.\n\nReject the request instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:36:19.692Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed74e8d603df457bfcf16ed4f8f1660a1525759e"
},
{
"url": "https://git.kernel.org/stable/c/ef6d27af71e1dc43181ec797a6aaa77c27c36786"
}
],
"title": "accel/amdxdna: reject a command chain that carries no commands",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98145",
"datePublished": "2026-09-25T10:36:19.692Z",
"dateReserved": "2026-09-25T10:25:14.319Z",
"dateUpdated": "2026-09-25T10:36:19.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}