Search
Find a vulnerability
Search criteria
41948 vulnerabilities by Linux
CVE-2026-98384 (GCVE-0-2026-98384)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
sk_protocol lives in struct sock, not in struct sock_common. A timewait
or request sock handed to bpf_sock_destroy() by the tcp iterator is
neither, so reading sk->sk_protocol runs past the object:
==================================================================
BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0
Read of size 2 at addr ffff8881047d11b4 by task test_progs/428
Tainted: [W]=WARN
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
print_report+0xd1/0x630
kasan_report+0xf3/0x130
__asan_report_load2_noabort+0x14/0x30
bpf_sock_destroy+0xc7/0xe0
bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7
bpf_iter_run_prog+0x538/0xde0
bpf_iter_tcp_seq_show+0x26b/0x4b0
bpf_seq_read+0x424/0x1210
vfs_read+0x197/0xe40
ksys_read+0x119/0x240
__x64_sys_read+0x72/0xc0
x64_sys_call+0x647/0x27e0
do_syscall_64+0xe5/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Only check sk_protocol on full socks. tcp_abort() already knows how to
deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it
never matched the code.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 5b4eb82475ae17d55974235c09e97044829426a8
(git)
Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < a9651704c6fd64590b5ad4fbe7c3768accf95993 (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 91a482a81eabddebf5430cbbdf12027e1a91b767 (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 2534a5e5d360c2b10203cfa80f4ab9d021e48f2f (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 01b245ba016d44861690594e10f67e026ce8552f (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b4eb82475ae17d55974235c09e97044829426a8",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "a9651704c6fd64590b5ad4fbe7c3768accf95993",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "91a482a81eabddebf5430cbbdf12027e1a91b767",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "2534a5e5d360c2b10203cfa80f4ab9d021e48f2f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "01b245ba016d44861690594e10f67e026ce8552f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk-\u003esk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:23.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8"
},
{
"url": "https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993"
},
{
"url": "https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767"
},
{
"url": "https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f"
},
{
"url": "https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f"
}
],
"title": "bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98384",
"datePublished": "2026-10-09T07:34:23.097Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:23.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98383 (GCVE-0-2026-98383)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 0f38472a2aa8704a6b514c0dfa9c32f3672b8f32
(git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < cae8674489f26edf7553fdd660599466cbb4c32f (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 9f9e57b5a3a033f95f49ef9d541340cdbcb80abb (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < df0072be6fc373cb22f9ea854d458b04e32a03cf (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < b9bb0e735460751b620156f800a4279a28573392 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 37b18688cd18fd86d2f35c212df1611862a26cd5 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < fca71ead7a20290af1e2046983eeafae43d21af1 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 (git) |
|
| Linux | Linux |
Affected:
4.18
Unaffected: 0 , < 4.18 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "b9bb0e735460751b620156f800a4279a28573392",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb-\u003ehead, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:22.408Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32"
},
{
"url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f"
},
{
"url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb"
},
{
"url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf"
},
{
"url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392"
},
{
"url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5"
},
{
"url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1"
},
{
"url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"
}
],
"title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98383",
"datePublished": "2026-10-09T07:34:22.408Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:22.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98382 (GCVE-0-2026-98382)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Reject dev-bound-only programs on other devices
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject dev-bound-only programs on other devices
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
unrelated netdevs compare equal. A bound-only program on an
offload-registered netdev can instead inherit a real offdev and match a
sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
specialized for the bound driver on the target driver's xdp_buff. Running a
veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
Call Trace:
...
tun_build_skb (drivers/net/tun.c:1739)
tun_get_user (drivers/net/tun.c:1856)
tun_chr_write_iter (drivers/net/tun.c:2091)
vfs_write (fs/read_write.c:595 fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the
shared-offdev fallback only for genuinely offloaded multi-port programs.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < e57f04194361574493e3e6cf0b9e9c69e4ae9791
(git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 0dceda331180617aeeb22381e8480b37f18ba08b (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 940b626854de200e6187777d42114727daca617c (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < bb375f3c5990e29851894f20ebc4b9dbc6676126 (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 6db1ce73e9853f533eb7f413f14ba00f8ec6f80d (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e57f04194361574493e3e6cf0b9e9c69e4ae9791",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "0dceda331180617aeeb22381e8480b37f18ba08b",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "940b626854de200e6187777d42114727daca617c",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "bb375f3c5990e29851894f20ebc4b9dbc6676126",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "6db1ce73e9853f533eb7f413f14ba00f8ec6f80d",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs on other devices\n\n__bpf_offload_dev_match() falls back to comparing offdev pointers after an\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so\nunrelated netdevs compare equal. A bound-only program on an\noffload-registered netdev can instead inherit a real offdev and match a\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs\nspecialized for the bound driver on the target driver\u0027s xdp_buff. Running a\nveth-bound program on tun reads beyond tun\u0027s bare stack xdp_buff as a\nveth_xdp_buff.\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)\n Call Trace:\n ...\n tun_build_skb (drivers/net/tun.c:1739)\n tun_get_user (drivers/net/tun.c:1856)\n tun_chr_write_iter (drivers/net/tun.c:2091)\n vfs_write (fs/read_write.c:595 fs/read_write.c:687)\n ksys_write (fs/read_write.c:739)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nRestrict non-offloaded programs to exact netdev matches and retain the\nshared-offdev fallback only for genuinely offloaded multi-port programs."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:21.718Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e57f04194361574493e3e6cf0b9e9c69e4ae9791"
},
{
"url": "https://git.kernel.org/stable/c/0dceda331180617aeeb22381e8480b37f18ba08b"
},
{
"url": "https://git.kernel.org/stable/c/940b626854de200e6187777d42114727daca617c"
},
{
"url": "https://git.kernel.org/stable/c/bb375f3c5990e29851894f20ebc4b9dbc6676126"
},
{
"url": "https://git.kernel.org/stable/c/6db1ce73e9853f533eb7f413f14ba00f8ec6f80d"
}
],
"title": "bpf: Reject dev-bound-only programs on other devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98382",
"datePublished": "2026-10-09T07:34:21.718Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:21.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98381 (GCVE-0-2026-98381)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
veth: manage XDP program pointers during channel resize
Summary
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog. If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
include/net/xdp.h:696 drivers/net/veth.c:820)
Call Trace:
veth_xdp_rcv (drivers/net/veth.c:941)
veth_poll (drivers/net/veth.c:986)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
Kernel panic - not syncing: Fatal exception in interrupt
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 7a8e143109ff2736dc79e41dcd55af7ceab7520a
(git)
Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 25bb7c36225220d30f404d7e29d2e052bc5f4b99 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 43f6b647f209591b1e3f726bb16b8dcba6b95908 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 7104a370714346b667712913dc16abf14bbc97ed (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "7104a370714346b667712913dc16abf14bbc97ed",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq-\u003exdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n BUG: unable to handle page fault for address: ffffc90000256048\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n include/net/xdp.h:696 drivers/net/veth.c:820)\n Call Trace:\n veth_xdp_rcv (drivers/net/veth.c:941)\n veth_poll (drivers/net/veth.c:986)\n __napi_poll (net/core/dev.c:7787)\n net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n handle_softirqs (kernel/softirq.c:645)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:21.029Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a"
},
{
"url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758"
},
{
"url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6"
},
{
"url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9"
},
{
"url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99"
},
{
"url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908"
},
{
"url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed"
}
],
"title": "veth: manage XDP program pointers during channel resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98381",
"datePublished": "2026-10-09T07:34:21.029Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:21.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98380 (GCVE-0-2026-98380)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
net/sched: reject IDR error pointers when deleting actions
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject IDR error pointers when deleting actions
tcf_action_delete() drops the reference held by its lookup before calling
tcf_idr_delete_index() with the saved action index. An unlocked
classifier can remove that action and reserve the same IDR slot with
ERR_PTR(-EBUSY) in between.
tcf_idr_delete_index() only checks the lookup result for NULL. It
therefore treats the reservation as a tc_action and dereferences
tcfa_bindcnt. A hardware execution breakpoint was used to schedule the
interleaving without changing the kernel source. KASAN reported this
decoded trace:
BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010
Read of size 4 at addr 0000000000000010 by task poc/150
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002
RIP: tca_action_gd+0x5c0/0x1010:
arch_atomic_read at arch/x86/include/asm/atomic.h:23
raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457
atomic_read at include/linux/atomic/atomic-instrumented.h:33
tcf_idr_delete_index at net/sched/act_api.c:766
tcf_action_delete at net/sched/act_api.c:1859
tcf_del_notify at net/sched/act_api.c:2014
tca_action_gd at net/sched/act_api.c:2064
R13: 0000000000000010 R15: fffffffffffffff0
Kernel panic - not syncing: Fatal exception
R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces
the address in R13. With the guard applied, the same reproducer returned
-ENOENT without a KASAN report or panic. Treat error pointers as absent
and return -ENOENT.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0190c1d452a91c38a3462abdd81752be1b9006a8 , < 39b751a210bf61a374afa82749afc7a77a08bf1d
(git)
Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < dd80a7519824b72c8fcfd3cc50cb93f7e2d90923 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 6bf076258aac4e0af69ef317656c31ce6444d647 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 6c9f07bf8800171de2cd3f02815cebe1f4d45f2d (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 259caa711b7688365676442e2fdb286b8aceaa80 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 968550a439f64bd1a6c0d88efb92e4f082f84a26 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < a9551f26287debe6d8aa6e8841974661065b975f (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < c82b797abe668d0b668601a93ba2c0b071a63574 (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "39b751a210bf61a374afa82749afc7a77a08bf1d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "dd80a7519824b72c8fcfd3cc50cb93f7e2d90923",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6bf076258aac4e0af69ef317656c31ce6444d647",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6c9f07bf8800171de2cd3f02815cebe1f4d45f2d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "259caa711b7688365676442e2fdb286b8aceaa80",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "968550a439f64bd1a6c0d88efb92e4f082f84a26",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "a9551f26287debe6d8aa6e8841974661065b975f",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "c82b797abe668d0b668601a93ba2c0b071a63574",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject IDR error pointers when deleting actions\n\ntcf_action_delete() drops the reference held by its lookup before calling\ntcf_idr_delete_index() with the saved action index. An unlocked\nclassifier can remove that action and reserve the same IDR slot with\nERR_PTR(-EBUSY) in between.\n\ntcf_idr_delete_index() only checks the lookup result for NULL. It\ntherefore treats the reservation as a tc_action and dereferences\ntcfa_bindcnt. A hardware execution breakpoint was used to schedule the\ninterleaving without changing the kernel source. KASAN reported this\ndecoded trace:\n\n BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010\n Read of size 4 at addr 0000000000000010 by task poc/150\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002\n RIP: tca_action_gd+0x5c0/0x1010:\n arch_atomic_read at arch/x86/include/asm/atomic.h:23\n raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457\n atomic_read at include/linux/atomic/atomic-instrumented.h:33\n tcf_idr_delete_index at net/sched/act_api.c:766\n tcf_action_delete at net/sched/act_api.c:1859\n tcf_del_notify at net/sched/act_api.c:2014\n tca_action_gd at net/sched/act_api.c:2064\n R13: 0000000000000010 R15: fffffffffffffff0\n Kernel panic - not syncing: Fatal exception\n\nR15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces\nthe address in R13. With the guard applied, the same reproducer returned\n-ENOENT without a KASAN report or panic. Treat error pointers as absent\nand return -ENOENT."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:20.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/39b751a210bf61a374afa82749afc7a77a08bf1d"
},
{
"url": "https://git.kernel.org/stable/c/dd80a7519824b72c8fcfd3cc50cb93f7e2d90923"
},
{
"url": "https://git.kernel.org/stable/c/6bf076258aac4e0af69ef317656c31ce6444d647"
},
{
"url": "https://git.kernel.org/stable/c/6c9f07bf8800171de2cd3f02815cebe1f4d45f2d"
},
{
"url": "https://git.kernel.org/stable/c/259caa711b7688365676442e2fdb286b8aceaa80"
},
{
"url": "https://git.kernel.org/stable/c/968550a439f64bd1a6c0d88efb92e4f082f84a26"
},
{
"url": "https://git.kernel.org/stable/c/a9551f26287debe6d8aa6e8841974661065b975f"
},
{
"url": "https://git.kernel.org/stable/c/c82b797abe668d0b668601a93ba2c0b071a63574"
}
],
"title": "net/sched: reject IDR error pointers when deleting actions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98380",
"datePublished": "2026-10-09T07:34:20.218Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:20.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98379 (GCVE-0-2026-98379)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rpfilter: reject routes without inet6_dev
ip6_route_lookup() can return an error-free route whose rt6i_idev is
NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears
down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects
in the FIB. An unprivileged user can construct this state with rtnetlink
in a private user and network namespace, then trigger a NULL dereference
through an IPv6 rpfilter lookup:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)
Call Trace:
ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
nf_hook_slow (net/netfilter/core.c:619)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6216)
process_backlog (net/core/dev.c:6680)
__napi_poll (net/core/dev.c:7739)
net_rx_action (net/core/dev.c:7959)
handle_softirqs (kernel/softirq.c:622)
do_softirq.part.0 (kernel/softirq.c:523)
__local_bh_enable_ip (kernel/softirq.c:450)
__dev_queue_xmit (net/core/dev.c:4913)
packet_sendmsg (net/packet/af_packet.c:3139)
__sys_sendto (net/socket.c:2252)
__x64_sys_sendto (net/socket.c:2259)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Reject routes without an inet6_dev immediately after lookup. Such routes
are not eligible for reverse-path filtering, and the check protects all
later rt6i_idev dereferences.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < f4de78756b0fddbd125b2b1b77c74f2eccc8e977
(git)
Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 1681ab6dd1271f2f36047490793b78b1848bbcc9 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 65487e9e99431ffcf05024a817f51ee4e3bd9b47 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < f49da48bd679cfee646d6a40dd02b1933de577d1 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < eafe081ea77d25b5c8e601680671b4ecb4520e7d (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 3a7384bc2e66217c9a01a392281334f4423740a0 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 1b9b5323725e458906c7620a3bc10398b51ad954 (git) |
|
| Linux | Linux |
Affected:
3.3
Unaffected: 0 , < 3.3 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4de78756b0fddbd125b2b1b77c74f2eccc8e977",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1681ab6dd1271f2f36047490793b78b1848bbcc9",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "65487e9e99431ffcf05024a817f51ee4e3bd9b47",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "f49da48bd679cfee646d6a40dd02b1933de577d1",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "eafe081ea77d25b5c8e601680671b4ecb4520e7d",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "3a7384bc2e66217c9a01a392281334f4423740a0",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1b9b5323725e458906c7620a3bc10398b51ad954",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject routes without inet6_dev\n\nip6_route_lookup() can return an error-free route whose rt6i_idev is\nNULL. Lowering an external nexthop device\u0027s MTU below IPV6_MIN_MTU tears\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects\nin the FIB. An unprivileged user can construct this state with rtnetlink\nin a private user and network namespace, then trigger a NULL dereference\nthrough an IPv6 rpfilter lookup:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)\n Call Trace:\n ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)\n nf_hook_slow (net/netfilter/core.c:619)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6216)\n process_backlog (net/core/dev.c:6680)\n __napi_poll (net/core/dev.c:7739)\n net_rx_action (net/core/dev.c:7959)\n handle_softirqs (kernel/softirq.c:622)\n do_softirq.part.0 (kernel/softirq.c:523)\n __local_bh_enable_ip (kernel/softirq.c:450)\n __dev_queue_xmit (net/core/dev.c:4913)\n packet_sendmsg (net/packet/af_packet.c:3139)\n __sys_sendto (net/socket.c:2252)\n __x64_sys_sendto (net/socket.c:2259)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nReject routes without an inet6_dev immediately after lookup. Such routes\nare not eligible for reverse-path filtering, and the check protects all\nlater rt6i_idev dereferences."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:19.425Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4de78756b0fddbd125b2b1b77c74f2eccc8e977"
},
{
"url": "https://git.kernel.org/stable/c/1681ab6dd1271f2f36047490793b78b1848bbcc9"
},
{
"url": "https://git.kernel.org/stable/c/65487e9e99431ffcf05024a817f51ee4e3bd9b47"
},
{
"url": "https://git.kernel.org/stable/c/f49da48bd679cfee646d6a40dd02b1933de577d1"
},
{
"url": "https://git.kernel.org/stable/c/290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40"
},
{
"url": "https://git.kernel.org/stable/c/eafe081ea77d25b5c8e601680671b4ecb4520e7d"
},
{
"url": "https://git.kernel.org/stable/c/3a7384bc2e66217c9a01a392281334f4423740a0"
},
{
"url": "https://git.kernel.org/stable/c/1b9b5323725e458906c7620a3bc10398b51ad954"
}
],
"title": "netfilter: ip6t_rpfilter: reject routes without inet6_dev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98379",
"datePublished": "2026-10-09T07:34:19.425Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:19.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98378 (GCVE-0-2026-98378)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Skip unsettled links in link iterator
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip unsettled links in link iterator
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
succeeds and before bpf_link_settle() publishes the ID in link->id.
bpf_link_by_id() treats such an ID-zero link as unsettled, but the link
iterator takes a reference without this check.
If anon_inode_getfile() then fails, the creator removes the ID and frees
its still-private link directly. The iterator is left with a dangling
reference and its next bpf_link_put() accesses freed memory.
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as
bpf_link_by_id() does.
BUG: KASAN: slab-use-after-free in bpf_link_put
Write of size 8 by task exp/384
Call Trace:
bpf_link_put kernel/bpf/syscall.c:3372
bpf_link_seq_next kernel/bpf/link_iter.c:33
bpf_seq_read kernel/bpf/bpf_iter.c:158
vfs_read fs/read_write.c:572
ksys_read fs/read_write.c:716
do_syscall_64 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 68930f8d40ab4c10ca3b019f076136758fd100a8
(git)
Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < c251ed48bd9063cf7de6049421e78b6de989060f (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 798a61edbc436cacdb659927d067368eeb1e30e2 (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 6e271f093d15d323f42de26f66556af53fa8e19f (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 87ce4b53b7436b50fc984f0a6afaf77f68ac5573 (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 50e80e2bb5e2be8515205b9c496b9640ddefa434 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68930f8d40ab4c10ca3b019f076136758fd100a8",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "c251ed48bd9063cf7de6049421e78b6de989060f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "798a61edbc436cacdb659927d067368eeb1e30e2",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "6e271f093d15d323f42de26f66556af53fa8e19f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "87ce4b53b7436b50fc984f0a6afaf77f68ac5573",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "50e80e2bb5e2be8515205b9c496b9640ddefa434",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link-\u003eid.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:18.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8"
},
{
"url": "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f"
},
{
"url": "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2"
},
{
"url": "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f"
},
{
"url": "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573"
},
{
"url": "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434"
}
],
"title": "bpf: Skip unsettled links in link iterator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98378",
"datePublished": "2026-10-09T07:34:18.626Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:18.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98377 (GCVE-0-2026-98377)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),
never that mac_len bytes of MAC header are present. Its ETH_HLEN
wrappers - __vlan_insert_tag() under skb_vlan_push(), and
vlan_insert_tag() under validate_xmit_vlan() on the generic transmit
path - therefore rewrite the first 16 bytes at skb->data: a 12-byte
memmove plus two 2-byte stores at +12 and +14. No caller supplies the
bound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().
An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a
one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a
hwaccel tag; the next - clsact "action vlan push" or
bpf_skb_vlan_push() - enters the helper with skb->len still 1. The
head comes from skbuff_small_head without __GFP_ZERO, so each push
drags bytes from beyond skb->tail into the frame. After three the
one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised
slab:
0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81
`------------------------------'
only 0x5a was sent; the rest is slab, here the top 56 bits of a
linear-map address
Require the MAC header the helper rewrites to be present, so such a
frame is dropped rather than transmitted.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 40a5cc4b7251c74f3341332a226d02200e96bccf
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f42562dd027dc4ed103fae17b2206e73ea1963c4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40a5cc4b7251c74f3341332a226d02200e96bccf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f42562dd027dc4ed103fae17b2206e73ea1963c4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: require the MAC header to be present in __vlan_insert_inner_tag()\n\n__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),\nnever that mac_len bytes of MAC header are present. Its ETH_HLEN\nwrappers - __vlan_insert_tag() under skb_vlan_push(), and\nvlan_insert_tag() under validate_xmit_vlan() on the generic transmit\npath - therefore rewrite the first 16 bytes at skb-\u003edata: a 12-byte\nmemmove plus two 2-byte stores at +12 and +14. No caller supplies the\nbound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().\n\nAn IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a\none-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a\nhwaccel tag; the next - clsact \"action vlan push\" or\nbpf_skb_vlan_push() - enters the helper with skb-\u003elen still 1. The\nhead comes from skbuff_small_head without __GFP_ZERO, so each push\ndrags bytes from beyond skb-\u003etail into the frame. After three the\none-byte send leaves as 13 bytes carrying 11 bytes of uninitialised\nslab:\n\n 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81\n `------------------------------\u0027\n only 0x5a was sent; the rest is slab, here the top 56 bits of a\n linear-map address\n\nRequire the MAC header the helper rewrites to be present, so such a\nframe is dropped rather than transmitted."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:17.832Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40a5cc4b7251c74f3341332a226d02200e96bccf"
},
{
"url": "https://git.kernel.org/stable/c/f42562dd027dc4ed103fae17b2206e73ea1963c4"
},
{
"url": "https://git.kernel.org/stable/c/59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc"
},
{
"url": "https://git.kernel.org/stable/c/ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a"
}
],
"title": "vlan: require the MAC header to be present in __vlan_insert_inner_tag()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98377",
"datePublished": "2026-10-09T07:34:17.832Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:17.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98376 (GCVE-0-2026-98376)
Vulnerability from nvd – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Use array_map_meta_equal for percpu array inner map replacement
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use array_map_meta_equal for percpu array inner map replacement
percpu_array_map_ops.map_meta_equal points to the generic
bpf_map_meta_equal(), which does not compare max_entries. When a
percpu array serves as an inner map, replacing it with one that has
fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()
inlines the original template's index_mask as a JIT immediate, a lookup
on the replacement map can access pptrs[] out of bounds.
Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),
which already enforces the max_entries equality check.
Add a selftest to verify that replacing a percpu array inner map with
a differently-sized one is rejected.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "593980175389a05793f6060aa20e626330960395",
"status": "affected",
"version": "db69718b8efac802c7cc20d5a6c7dfc913f99c43",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use array_map_meta_equal for percpu array inner map replacement\n\npercpu_array_map_ops.map_meta_equal points to the generic\nbpf_map_meta_equal(), which does not compare max_entries. When a\npercpu array serves as an inner map, replacing it with one that has\nfewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()\ninlines the original template\u0027s index_mask as a JIT immediate, a lookup\non the replacement map can access pptrs[] out of bounds.\n\nPoint percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),\nwhich already enforces the max_entries equality check.\n\nAdd a selftest to verify that replacing a percpu array inner map with\na differently-sized one is rejected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:17.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"
}
],
"title": "bpf: Use array_map_meta_equal for percpu array inner map replacement",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98376",
"datePublished": "2026-10-09T07:34:17.043Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:17.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98375 (GCVE-0-2026-98375)
Vulnerability from nvd – Published: 2026-10-09 07:10 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
xen/netfront: drop RX packets with a short Ethernet header
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: drop RX packets with a short Ethernet header
handle_incoming_queue() pulls pull_to bytes into the head before
calling eth_type_trans(). pull_to is the length of the first RX slot,
capped at RX_COPY_THRESHOLD, and that length comes from the backend.
Nothing checks it against ETH_HLEN.
If the first slot is shorter than ETH_HLEN and more slots follow, the
head ends up shorter than an Ethernet header while skb->len is longer,
and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is
shorter than ETH_HLEN, eth_type_trans() reads the header past the end
of the data instead.
Pull at least ETH_HLEN, and drop the packet if that fails, which also
drops packets too short to hold an Ethernet header. This also checks
the return value of the pull, which was ignored.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "089e58805c452e52179482b1025a8e309a57f801",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc7",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc7",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb-\u003elen is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:16.178Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801"
}
],
"title": "xen/netfront: drop RX packets with a short Ethernet header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98375",
"datePublished": "2026-10-09T07:10:45.930Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:16.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98374 (GCVE-0-2026-98374)
Vulnerability from nvd – Published: 2026-10-07 13:01 – Updated: 2026-10-07 13:01
VLAI
EPSS
VEX
Title
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.
The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue(). An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:
BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
Read of size 4 at addr ffff88800604d928 by task swapper/1/0
Call Trace:
tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
Sync the hint to the copy.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c31b70c9968fe9c4194d1b5d06d07596a3b680de , < fad6d429651e748365e93ca54645accc212f0018
(git)
Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < c5b4da1f403a658c1c19766be2b426003ada419f (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 71d45049b0d631dfdbf3c65305f7fca676de023b (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < e3ea71cb1408a013ed4e8a757b815f1a919324bd (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 631aa4cb45099f09e9385dd786bd291c6270bfc4 (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 0f87720c7e4bcab07c24888b3cf12bfe857bb90e (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < fe99bbeee5c5dbd3abc30721a8079ced59649d97 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fad6d429651e748365e93ca54645accc212f0018",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "c5b4da1f403a658c1c19766be2b426003ada419f",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "71d45049b0d631dfdbf3c65305f7fca676de023b",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "e3ea71cb1408a013ed4e8a757b815f1a919324bd",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "631aa4cb45099f09e9385dd786bd291c6270bfc4",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "0f87720c7e4bcab07c24888b3cf12bfe857bb90e",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "fe99bbeee5c5dbd3abc30721a8079ced59649d97",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:01:48.600Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"
},
{
"url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"
},
{
"url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"
},
{
"url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"
},
{
"url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"
},
{
"url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"
},
{
"url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"
}
],
"title": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98374",
"datePublished": "2026-10-07T13:01:48.600Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-07T13:01:48.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98373 (GCVE-0-2026-98373)
Vulnerability from nvd – Published: 2026-10-07 13:01 – Updated: 2026-10-07 13:01
VLAI
EPSS
VEX
Title
mm/hugetlb: preserve mremap address delta when skipping page tables
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: preserve mremap address delta when skipping page tables
move_hugetlb_page_tables() optimizes mremap() by advancing to the last
entry in the page table when the source page table does not exist, either
initially or after unsharing a PMD table. The common loop increment then
steps to the first entry in the next page table.
However, the code advances both the source and destination addresses to
the last entries in their respective page tables, which is wrong. The
destination address must be advanced only by the same amount as the source
address.
If the source and destination offsets within their page tables differ, the
destination address can be advanced too far, causing follow-up issues.
Fix this by advancing the destination address by the source advance
distance.
With a reproducer, we were able to trigger a kernel panic on x86-64. With
this fix in place, we can no longer reproduce the issue.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff
(git)
Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 850cc4a84b36a0062dcd0391acd2450e20ab0767 (git) Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 480a39b0a12c977ed6e755f3d12a23424c57d11f (git) Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 9bdad082d44bdcf93716973dcba6be77e8a06e7b (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "850cc4a84b36a0062dcd0391acd2450e20ab0767",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "480a39b0a12c977ed6e755f3d12a23424c57d11f",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "9bdad082d44bdcf93716973dcba6be77e8a06e7b",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: preserve mremap address delta when skipping page tables\n\nmove_hugetlb_page_tables() optimizes mremap() by advancing to the last\nentry in the page table when the source page table does not exist, either\ninitially or after unsharing a PMD table. The common loop increment then\nsteps to the first entry in the next page table.\n\nHowever, the code advances both the source and destination addresses to\nthe last entries in their respective page tables, which is wrong. The\ndestination address must be advanced only by the same amount as the source\naddress.\n\nIf the source and destination offsets within their page tables differ, the\ndestination address can be advanced too far, causing follow-up issues. \nFix this by advancing the destination address by the source advance\ndistance.\n\nWith a reproducer, we were able to trigger a kernel panic on x86-64. With\nthis fix in place, we can no longer reproduce the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:01:47.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff"
},
{
"url": "https://git.kernel.org/stable/c/850cc4a84b36a0062dcd0391acd2450e20ab0767"
},
{
"url": "https://git.kernel.org/stable/c/480a39b0a12c977ed6e755f3d12a23424c57d11f"
},
{
"url": "https://git.kernel.org/stable/c/9bdad082d44bdcf93716973dcba6be77e8a06e7b"
}
],
"title": "mm/hugetlb: preserve mremap address delta when skipping page tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98373",
"datePublished": "2026-10-07T13:01:47.433Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-07T13:01:47.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98372 (GCVE-0-2026-98372)
Vulnerability from nvd – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
iptfs_skb_reset_frag_walk() advances to the fragment containing @offset
with an unbounded loop:
while (offset >= walk->past + walk->frags[walk->fragi].len)
walk->past += walk->frags[walk->fragi++].len;
walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced
without ever checking fragi against walk->nr_frags. When the requested
offset is at or beyond the total length spanned by the walk's fragments,
fragi runs past nr_frags and off the end of the fixed-size on-stack
frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.
The two callers behave differently: iptfs_skb_add_frags() already guards
against this with
if (!walk->nr_frags ||
offset >= walk->total + walk->initial_offset)
return len;
but iptfs_skb_can_add_frags() has no such guard and calls
iptfs_skb_reset_frag_walk() unconditionally, so it performs the
out-of-range walk. Its own "fragi < walk->nr_frags" bound check runs only
afterwards, too late to prevent the read.
This is reachable from the receive path: a crafted IP-TFS (AGGFRAG)
payload delivered to an IPTFS SA drives iptfs_reassem_cont() ->
iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:
BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250
Read of size 4 at addr ffff888008ad7210 by task repro/345
iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392
iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420
iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902
iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280
iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741
xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700
xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104
ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612
Give iptfs_skb_can_add_frags() the same up-front guard that
iptfs_skb_add_frags() already has, so the walk is never entered with an
out-of-range offset. When it triggers, the caller falls back to the
existing linearize-and-copy path, which is safe.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 , < 7e1c6884a0b494b7e3f204877f94c1e07a117bf7
(git)
Affected: 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 , < da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3 (git) Affected: 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 , < d042487dc118e494db2e2c1382310255c90ff544 (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e1c6884a0b494b7e3f204877f94c1e07a117bf7",
"status": "affected",
"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7",
"versionType": "git"
},
{
"lessThan": "da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3",
"status": "affected",
"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7",
"versionType": "git"
},
{
"lessThan": "d042487dc118e494db2e2c1382310255c90ff544",
"status": "affected",
"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\niptfs_skb_reset_frag_walk() advances to the fragment containing @offset\nwith an unbounded loop:\n\n\twhile (offset \u003e= walk-\u003epast + walk-\u003efrags[walk-\u003efragi].len)\n\t\twalk-\u003epast += walk-\u003efrags[walk-\u003efragi++].len;\n\nwalk-\u003efragi is advanced and walk-\u003efrags[walk-\u003efragi] is dereferenced\nwithout ever checking fragi against walk-\u003enr_frags. When the requested\noffset is at or beyond the total length spanned by the walk\u0027s fragments,\nfragi runs past nr_frags and off the end of the fixed-size on-stack\nfrags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.\n\nThe two callers behave differently: iptfs_skb_add_frags() already guards\nagainst this with\n\n\tif (!walk-\u003enr_frags ||\n\t offset \u003e= walk-\u003etotal + walk-\u003einitial_offset)\n\t\treturn len;\n\nbut iptfs_skb_can_add_frags() has no such guard and calls\niptfs_skb_reset_frag_walk() unconditionally, so it performs the\nout-of-range walk. Its own \"fragi \u003c walk-\u003enr_frags\" bound check runs only\nafterwards, too late to prevent the read.\n\nThis is reachable from the receive path: a crafted IP-TFS (AGGFRAG)\npayload delivered to an IPTFS SA drives iptfs_reassem_cont() -\u003e\niptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:\n\n BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250\n Read of size 4 at addr ffff888008ad7210 by task repro/345\n iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392\n iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420\n iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902\n iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280\n iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741\n xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700\n xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104\n ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612\n\nGive iptfs_skb_can_add_frags() the same up-front guard that\niptfs_skb_add_frags() already has, so the walk is never entered with an\nout-of-range offset. When it triggers, the caller falls back to the\nexisting linearize-and-copy path, which is safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:56.529Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e1c6884a0b494b7e3f204877f94c1e07a117bf7"
},
{
"url": "https://git.kernel.org/stable/c/da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3"
},
{
"url": "https://git.kernel.org/stable/c/d042487dc118e494db2e2c1382310255c90ff544"
}
],
"title": "xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98372",
"datePublished": "2026-10-06T08:46:56.529Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-06T08:46:56.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98371 (GCVE-0-2026-98371)
Vulnerability from nvd – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
xfrm: iptfs: fix runt reassembly panic from short inner tot_len
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix runt reassembly panic from short inner tot_len
When the start of an inner packet is split across two outer packets
such that fewer than 4 bytes land at the end of the first one,
__input_process_payload() saves those bytes as a runt and skips the
iplen/iphlen validation performed for in-place packets. When the
continuation packet arrives, iptfs_reassem_cont() only requires the
declared inner length to be >= sizeof(ra_runt) (6) before allocating
the reassembly skb with that attacker-controlled length.
However, __iptfs_iphlen() always returns the fixed minimum IP header
size (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in
[6, 19] the header-completion copy writes past the declared packet
length, and the subsequent "ipremain -= copylen" underflows to ~4GB,
leaving the payload copy length bounded only by blkoff (up to 64KB).
At runtime the skb_put() tailroom check turns this into
skb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable
locally via userns+netns IPTFS SAs and remotely against IPTFS VPN
gateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,
tun/tap delivery).
Align the runt path with the normal path by requiring the declared
inner length to cover at least the IP header size. This also subsumes
the previous >= sizeof(ra_runt) check, since the minimum IP header
is always larger than the runt buffer.
This issue was found by the autokbug dynamic kernel fuzzer at
Tencent Yunding Lab.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
07569476544681816335099929ff3494dfbf6b05 , < a7018ee0ea8622ed59edc064be4e0f2c26464f53
(git)
Affected: 07569476544681816335099929ff3494dfbf6b05 , < 5b8afb56ccb7c014b0f1ac40341708b200443c2d (git) Affected: 07569476544681816335099929ff3494dfbf6b05 , < dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c (git) |
|
| Linux | Linux |
Affected:
6.14
Unaffected: 0 , < 6.14 (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7018ee0ea8622ed59edc064be4e0f2c26464f53",
"status": "affected",
"version": "07569476544681816335099929ff3494dfbf6b05",
"versionType": "git"
},
{
"lessThan": "5b8afb56ccb7c014b0f1ac40341708b200443c2d",
"status": "affected",
"version": "07569476544681816335099929ff3494dfbf6b05",
"versionType": "git"
},
{
"lessThan": "dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c",
"status": "affected",
"version": "07569476544681816335099929ff3494dfbf6b05",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_iptfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix runt reassembly panic from short inner tot_len\n\nWhen the start of an inner packet is split across two outer packets\nsuch that fewer than 4 bytes land at the end of the first one,\n__input_process_payload() saves those bytes as a runt and skips the\niplen/iphlen validation performed for in-place packets. When the\ncontinuation packet arrives, iptfs_reassem_cont() only requires the\ndeclared inner length to be \u003e= sizeof(ra_runt) (6) before allocating\nthe reassembly skb with that attacker-controlled length.\n\nHowever, __iptfs_iphlen() always returns the fixed minimum IP header\nsize (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in\n[6, 19] the header-completion copy writes past the declared packet\nlength, and the subsequent \"ipremain -= copylen\" underflows to ~4GB,\nleaving the payload copy length bounded only by blkoff (up to 64KB).\nAt runtime the skb_put() tailroom check turns this into\nskb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable\nlocally via userns+netns IPTFS SAs and remotely against IPTFS VPN\ngateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,\ntun/tap delivery).\n\nAlign the runt path with the normal path by requiring the declared\ninner length to cover at least the IP header size. This also subsumes\nthe previous \u003e= sizeof(ra_runt) check, since the minimum IP header\nis always larger than the runt buffer.\n\nThis issue was found by the autokbug dynamic kernel fuzzer at\nTencent Yunding Lab."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:55.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7018ee0ea8622ed59edc064be4e0f2c26464f53"
},
{
"url": "https://git.kernel.org/stable/c/5b8afb56ccb7c014b0f1ac40341708b200443c2d"
},
{
"url": "https://git.kernel.org/stable/c/dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c"
}
],
"title": "xfrm: iptfs: fix runt reassembly panic from short inner tot_len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98371",
"datePublished": "2026-10-06T08:46:55.753Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:55.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98370 (GCVE-0-2026-98370)
Vulnerability from nvd – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
xfrm: fix compat ALLOCSPI request use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix compat ALLOCSPI request use-after-free
xfrm_state_netlink() builds the ALLOCSPI response with
dump_one_state(), which already calls alloc_compat() with the response
skb and header.
xfrm_alloc_userspi() then calls alloc_compat() again, but passes the
original request skb and its header. For a compat request, the
translator therefore interprets the 228-byte compat xfrm_userspi_info
as the 232-byte native layout and reads four bytes past the declared
payload. It also publishes the translated child through the request's
frag_list.
A multicast clone of the request shares skb_shared_info and can observe
that child. xfrm_user_rcv_msg() frees it after the request handler
returns, racing a compat receiver which may still be copying from it and
resulting in a use-after-free.
Remove the redundant conversion. The response keeps its correct compat
translation from dump_one_state(), and no child is attached to the
inbound request.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 494f2bee9d8d0ebcfa249ac41bed7fed26d119b4
(git)
Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 17893987e52918c23945c42e47e894a936305a25 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < bb63ab52a18273ec68340ac49aebbaa7b514ccd5 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < 248433942155b42a0ef04a5806c8aca024ea7c33 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < e70f639aee2ff0def155c256cace9e0f81d998e2 (git) Affected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 , < d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "494f2bee9d8d0ebcfa249ac41bed7fed26d119b4",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "17893987e52918c23945c42e47e894a936305a25",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "bb63ab52a18273ec68340ac49aebbaa7b514ccd5",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "248433942155b42a0ef04a5806c8aca024ea7c33",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "e70f639aee2ff0def155c256cace9e0f81d998e2",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request\u0027s\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:54.981Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4"
},
{
"url": "https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25"
},
{
"url": "https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810"
},
{
"url": "https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718"
},
{
"url": "https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5"
},
{
"url": "https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33"
},
{
"url": "https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2"
},
{
"url": "https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320"
}
],
"title": "xfrm: fix compat ALLOCSPI request use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98370",
"datePublished": "2026-10-06T08:46:54.981Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:54.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98369 (GCVE-0-2026-98369)
Vulnerability from nvd – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():
WARNING: suspicious RCU usage in ip6_pkt_drop
include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!
Call Trace:
__in6_dev_get_safely include/net/addrconf.h:389 [inline]
ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620
ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651
xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through
workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue,
the reinjection loop ceased running in softirq context. Workqueue workers
run in process context where local_bh_disable() does not enter an RCU
read-side critical section under CONFIG_PREEMPT_RCU.
Because finish callbacks (such as ip6_rcv_finish) expect to run under an
RCU read lock (performing route lookups, l3mdev lookups, and accessing
RCU-protected data structures), invoking them in workqueue context without
rcu_read_lock() triggers RCU lockdep warnings.
Furthermore, packets queued to the workqueue via xfrm_trans_queue_net()
may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).
Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev
with blackhole_netdev, so dst entries do not keep skb->dev alive while
queued in the workqueue.
Fix these issues by:
1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the
caller's RCU section to ensure dst is reference-counted before queuing.
2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue
deferral so skb->dev remains valid during finish() callback processing.
3. Acquiring rcu_read_lock() around the finish callback invocation loop in
xfrm_trans_reinject().
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7d98b26684cb2390729525b341ea099f0badbe18 , < 41e47f1664be86c91326f0afe0504a1162d00907
(git)
Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 6601d91a85761f33351c71e04ec0bbd294ca07ce (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 0cda8273265d30cac6423834fd7d4acb75f04fdb (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 68a317b4aec8ca1868a39d69e40f9e29baa4f40a (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 6eb3b071be8e260543c604550c54dac66e6b174b (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < 664fc0941df7c1918b2cd4de6ee00469ba77d8e4 (git) Affected: 4f4920669d21e1060b7243e5118dc3b71ced1276 , < d2f5082f9e84653fa1a9e8aebaaff23e688f5e19 (git) Affected: f520075da484306bbb8425afd2c42404ba74816f (git) Affected: 130d9e5017ade1b81d16783563edb38c12a2eab7 (git) Affected: 5.15.75 , < 5.15.222 (semver) Affected: 5.19.17 , < 5.20 (semver) Affected: 6.0.3 , < 6.1 (semver) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41e47f1664be86c91326f0afe0504a1162d00907",
"status": "affected",
"version": "7d98b26684cb2390729525b341ea099f0badbe18",
"versionType": "git"
},
{
"lessThan": "6601d91a85761f33351c71e04ec0bbd294ca07ce",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "0cda8273265d30cac6423834fd7d4acb75f04fdb",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "68a317b4aec8ca1868a39d69e40f9e29baa4f40a",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "6eb3b071be8e260543c604550c54dac66e6b174b",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "664fc0941df7c1918b2cd4de6ee00469ba77d8e4",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "d2f5082f9e84653fa1a9e8aebaaff23e688f5e19",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"status": "affected",
"version": "f520075da484306bbb8425afd2c42404ba74816f",
"versionType": "git"
},
{
"status": "affected",
"version": "130d9e5017ade1b81d16783563edb38c12a2eab7",
"versionType": "git"
},
{
"lessThan": "5.15.222",
"status": "affected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n\nsyzbot reported a suspicious RCU usage warning in ip6_pkt_drop():\n\n WARNING: suspicious RCU usage in ip6_pkt_drop\n include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!\n\n Call Trace:\n __in6_dev_get_safely include/net/addrconf.h:389 [inline]\n ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620\n ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651\n xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n\nWhen commit 4f4920669d21 (\"xfrm: Reinject transport-mode packets through\nworkqueue\") converted xfrm_trans_reinject from a tasklet to a workqueue,\nthe reinjection loop ceased running in softirq context. Workqueue workers\nrun in process context where local_bh_disable() does not enter an RCU\nread-side critical section under CONFIG_PREEMPT_RCU.\n\nBecause finish callbacks (such as ip6_rcv_finish) expect to run under an\nRCU read lock (performing route lookups, l3mdev lookups, and accessing\nRCU-protected data structures), invoking them in workqueue context without\nrcu_read_lock() triggers RCU lockdep warnings.\n\nFurthermore, packets queued to the workqueue via xfrm_trans_queue_net()\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst-\u003edev\nwith blackhole_netdev, so dst entries do not keep skb-\u003edev alive while\nqueued in the workqueue.\n\nFix these issues by:\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the\n caller\u0027s RCU section to ensure dst is reference-counted before queuing.\n2. Holding a reference on skb-\u003edev via dev_hold()/dev_put() across workqueue\n deferral so skb-\u003edev remains valid during finish() callback processing.\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in\n xfrm_trans_reinject()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The use-after-free happens only when a queued packet\u0027s net_device or noref dst is freed before xfrm_trans_reinject() runs. A remote ESP peer sends the packet but cannot unregister the device or change routes, so the attacker who controls the whole race is local: they create the netns, veth and XFRM SA through xfrm_user netlink.\nAC:L - The attacker does both sides of the race. They send ESP transport-mode packets that xfrm4_transport_finish/xfrm6_transport_finish queue through xfrm_trans_queue(), then delete the veth or route while the workqueue is still behind. Flooding the queue up to max_backlog widens the window.\nPR:L - xfrm_user_rcv_msg checks netlink_net_capable(CAP_NET_ADMIN), which an unprivileged user gets in a new user and network namespace (unshare -Urn). That lets them create the SA, the veth devices and the routes the trigger needs.\nUI:N - No victim action is needed. The attacker sets up the namespace, sends the packets and tears down the device or route themselves.\nS:U - The freed net_device, dst_entry and RCU-protected route data are kernel memory, and the impact stays within the kernel\u0027s own security authority.\nC:H - ip6_rcv_finish and dst_input in xfrm_trans_reinject() read a freed skb-\u003edev or noref dst_entry with no reference and no RCU lock. If an attacker reclaims that memory, these use-after-free reads can leak kernel memory.\nI:H - The freed dst_entry holds an input function pointer that dst_input() calls, and net_device is full of ops pointers. Reclaiming either object with attacker-controlled data gives a path to hijacking control flow.\nA:H - A use-after-free of the net_device or dst in the xfrm_trans_reinject worker crashes the kernel, and syzbot hit the missing-RCU path in ip6_pkt_drop. The attacker can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:23.071Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907"
},
{
"url": "https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce"
},
{
"url": "https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb"
},
{
"url": "https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a"
},
{
"url": "https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b"
},
{
"url": "https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4"
},
{
"url": "https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19"
}
],
"title": "xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98369",
"datePublished": "2026-10-06T08:46:54.188Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:23.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98368 (GCVE-0-2026-98368)
Vulnerability from nvd – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
esp: downgrade zerocopy managed frags before mutating skb frags
Summary
In the Linux kernel, the following vulnerability has been resolved:
esp: downgrade zerocopy managed frags before mutating skb frags
On the out-of-place output path (esp->inplace == false) ESP rewrites the
skb frag array: esp_output_head() appends a trailer frag and
esp_output_tail() replaces the frags with a destination page, both
referenced with get_page().
When the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the
payload frags are owned by the ubuf and must not be referenced or
unreferenced individually, but ESP mutates the frag array without ever
downgrading the skb. This breaks the managed-frag invariant two ways:
- esp_ssg_unref() walks the source scatterlist and drops a page
reference for every frag, including the ubuf-owned payload frags,
pushing their refcount below the GUP pin bias while the pages are
still pinned, i.e. a use-after-free of the zerocopy pages;
- esp_output_tail() installs its destination page as frag 0 with
get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so
skb_release_data() takes the skip_unref branch and never drops that
reference, leaking the x->xfrag page at packet rate.
Fix this the way every other frag-mutating site does (__ip_append_data(),
__ip6_append_data(), tcp_sendmsg_locked()) and call
skb_zcopy_downgrade_managed() before ESP touches the frag array: it takes
a real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,
so the per-frag unref in esp_ssg_unref() and the frag release in
skb_release_data() are both balanced and no mixed-ownership frag array is
left behind.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 2359264f377cdbdef2d95868cc8fb572949e48d3
(git)
Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 69a768c12398cada8528080332c822623fa7064d (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 6508304ac2c8cdafca2f4ab915df8c707893e134 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 6cab554f2c0f28773f712ed3a5479103f42ce844 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 0d0845ee61c5df47cc68bc446501f48f71e8dcc6 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < f89416eb3db151170a6f3c6dfc5239d26cdce4d2 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2359264f377cdbdef2d95868cc8fb572949e48d3",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "69a768c12398cada8528080332c822623fa7064d",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "6508304ac2c8cdafca2f4ab915df8c707893e134",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "6cab554f2c0f28773f712ed3a5479103f42ce844",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "0d0845ee61c5df47cc68bc446501f48f71e8dcc6",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "f89416eb3db151170a6f3c6dfc5239d26cdce4d2",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nesp: downgrade zerocopy managed frags before mutating skb frags\n\nOn the out-of-place output path (esp-\u003einplace == false) ESP rewrites the\nskb frag array: esp_output_head() appends a trailer frag and\nesp_output_tail() replaces the frags with a destination page, both\nreferenced with get_page().\n\nWhen the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the\npayload frags are owned by the ubuf and must not be referenced or\nunreferenced individually, but ESP mutates the frag array without ever\ndowngrading the skb. This breaks the managed-frag invariant two ways:\n\n - esp_ssg_unref() walks the source scatterlist and drops a page\n reference for every frag, including the ubuf-owned payload frags,\n pushing their refcount below the GUP pin bias while the pages are\n still pinned, i.e. a use-after-free of the zerocopy pages;\n\n - esp_output_tail() installs its destination page as frag 0 with\n get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so\n skb_release_data() takes the skip_unref branch and never drops that\n reference, leaking the x-\u003exfrag page at packet rate.\n\nFix this the way every other frag-mutating site does (__ip_append_data(),\n__ip6_append_data(), tcp_sendmsg_locked()) and call\nskb_zcopy_downgrade_managed() before ESP touches the frag array: it takes\na real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,\nso the per-frag unref in esp_ssg_unref() and the frag release in\nskb_release_data() are both balanced and no mixed-ownership frag array is\nleft behind."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Managed frags are set only by io_uring\u0027s io_sg_from_iter() for IORING_OP_SEND_ZC/SENDMSG_ZC with IORING_RECVSEND_FIXED_BUF, so a local process must submit the zerocopy send that esp_output_head()/esp6_output_head() then mutates; a remote peer cannot produce a SKBFL_MANAGED_FRAG_REFS skb.\nAC:L - The attacker picks every input: an uncloned UDP skb whose data_len+tailen fits in a page and lacks tailroom reliably takes the esp-\u003einplace=false branch, then esp_ssg_unref() drops refs on the ubuf-owned frags. No race or outside state is needed.\nPR:L - io_uring zerocopy send needs no privilege. The ESP SA/policy can be added inside an unprivileged user+net namespace because xfrm_user_rcv_msg only checks netlink_net_capable(CAP_NET_ADMIN); on a host with IPsec already set up, any local user\u0027s traffic hits it.\nUI:N - The attacker does everything with their own io_uring ring, registered buffer, socket and (namespaced) xfrm state; no other user has to act.\nS:U - The page refcount underflow and the freed page stay inside the kernel\u0027s own authority, so this is a normal local privilege escalation with no VM or sandbox boundary crossed.\nC:H - esp_ssg_unref() pushes the pinned registered-buffer pages\u0027 refcount below the GUP pin bias, so the page is freed while io_uring still has it mapped; once reallocated (e.g. as page tables or slab) the attacker can read kernel memory through the stale buffer.\nI:H - Writing through the still-registered fixed buffer into the freed and reallocated page is a page-level use-after-free write primitive (Dirty-Pagetable style), enough for arbitrary kernel memory corruption and privilege escalation.\nA:H - The page UAF leads to bad-page/refcount oopses, and the missing put_page on the x-\u003exfrag page installed by esp_output_tail() leaks memory at packet rate; both can take the system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:21.920Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3"
},
{
"url": "https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d"
},
{
"url": "https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134"
},
{
"url": "https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844"
},
{
"url": "https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6"
},
{
"url": "https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2"
}
],
"title": "esp: downgrade zerocopy managed frags before mutating skb frags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98368",
"datePublished": "2026-10-06T08:46:53.292Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:21.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98367 (GCVE-0-2026-98367)
Vulnerability from nvd – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
We need to clear cep before release state_lock as siw_qp_llp_close and
siw_qp_modify->siw_qp_llp_close did.
Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock
is released before the error path cleanup. A concurrent ibv_modify_qp()
transitioning the QP to ERROR can race in this window:
siw_accept() ibv_modify_qp(ERROR)
---------------------- ----------------------
siw_qp_modify() fails
up_write(&qp->state_lock)
down_write(&qp->state_lock)
nextstate_from_idle():
if (qp->cep)
siw_cep_put(qp->cep) <- frees cep
qp->cep = NULL
goto error
cep->qp = NULL <- UAF
Clear qp->cep and drop the association reference taken by siw_cep_get(),
all under the write lock held from the initial down_write(&qp->state_lock).
Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free
the cep before siw_accept() is done with it.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078
(git)
Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < e3f039082856adab7e195dea1af45d93dd6a3f1c (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < ad50d19f3d1ce052b3a146143581e930a1efb33e (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 030306bbb9273af80f14d7af20129661964cd9a7 (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < df2584750314336edcbcc21fb388e04b260f35b7 (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 9dcc0f4e488b70cff81e0e5717a498c929cf5de3 (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < bfdc744bf20ae4c3ef2e470298de5237c5c9a13c (git) Affected: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 , < 32cd87f54dd1070020e664ccb0312a9f0fea79b4 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "e3f039082856adab7e195dea1af45d93dd6a3f1c",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "ad50d19f3d1ce052b3a146143581e930a1efb33e",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "030306bbb9273af80f14d7af20129661964cd9a7",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "df2584750314336edcbcc21fb388e04b260f35b7",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "9dcc0f4e488b70cff81e0e5717a498c929cf5de3",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "bfdc744bf20ae4c3ef2e470298de5237c5c9a13c",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "32cd87f54dd1070020e664ccb0312a9f0fea79b4",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept\n\nWe need to clear cep before release state_lock as siw_qp_llp_close and\nsiw_qp_modify-\u003esiw_qp_llp_close did.\n\nOtherwise if siw_qp_modify() fails in siw_accept(), the QP\u0027s state_lock\nis released before the error path cleanup. A concurrent ibv_modify_qp()\ntransitioning the QP to ERROR can race in this window:\n\n siw_accept() ibv_modify_qp(ERROR)\n ---------------------- ----------------------\n siw_qp_modify() fails\n up_write(\u0026qp-\u003estate_lock)\n down_write(\u0026qp-\u003estate_lock)\n nextstate_from_idle():\n\t\t\t\t if (qp-\u003ecep)\n siw_cep_put(qp-\u003ecep) \u003c- frees cep\n qp-\u003ecep = NULL\n goto error\n cep-\u003eqp = NULL \u003c- UAF\n\nClear qp-\u003ecep and drop the association reference taken by siw_cep_get(),\nall under the write lock held from the initial down_write(\u0026qp-\u003estate_lock).\nThread B therefore sees qp-\u003ecep == NULL, skips its own put, and cannot free\nthe cep before siw_accept() is done with it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - siw_accept() is called through the ops.iw_accept hook from iw_cm_accept(), which a local process reaches with the RDMA_USER_CM_CMD_ACCEPT command on /dev/infiniband/rdma_cm. The racing side is the uverbs MODIFY_QP command (ibv_modify_qp to ERROR), also local. No wire message carries data that causes the siw_qp_modify() failure, so the attack is local.\nAC:L - The attacker does control both racing threads, since it owns the QP and issues the accept and modify_qp calls itself. Even so, AC is High: in siw_accept the only way siw_qp_modify() can fail is siw_qp_readq_init() hitting a vcalloc() ENOMEM, and IRD/ORD are capped at 128, so the allocations are small. That failure depends on system-wide memory exhaustion, which the attacker cannot produce on demand.\nPR:L - Running rdma_accept and ibv_modify_qp on a QP the user created on an existing siw device needs only ordinary access to the rdma_cm and uverbs device nodes. Creating the siw link through RDMA_NLDEV_CMD_NEWLINK is admin-only, but no privilege is needed to use a device that already exists.\nUI:N - The attacker drives both siw_accept() and the concurrent ibv_modify_qp(ERROR) through their own rdma_cm and verbs calls, and the connecting peer can be the attacker over loopback. No other user has to do anything.\nS:U - The freed siw_cep and the writes into it both stay inside the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - siw_qp_nextstate_from_idle() frees the siw_cep by calling siw_cep_put(qp-\u003ecep). The error path in siw_accept() then keeps using that freed object: it writes cep-\u003eqp = NULL, runs siw_free_cm_id, and calls siw_cep_set_free_and_put. A reclaimed object in that slot gives the attacker a use-after-free primitive that can be built into a kernel memory leak.\nI:H - After the free, the error path writes cep-\u003eqp = NULL and does kref and lock operations on the dead siw_cep. That corrupts whatever object has taken over the slot, and this kind of UAF write can be used to corrupt kernel data or hijack control flow.\nA:H - A kref_put or lock operation on the freed siw_cep in siw_cep_set_free_and_put can corrupt the slab or oops the kernel, and that crashes the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:20.775Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078"
},
{
"url": "https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c"
},
{
"url": "https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e"
},
{
"url": "https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7"
},
{
"url": "https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7"
},
{
"url": "https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3"
},
{
"url": "https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c"
},
{
"url": "https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4"
}
],
"title": "RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98367",
"datePublished": "2026-10-06T08:46:52.452Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:20.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98384 (GCVE-0-2026-98384)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
sk_protocol lives in struct sock, not in struct sock_common. A timewait
or request sock handed to bpf_sock_destroy() by the tcp iterator is
neither, so reading sk->sk_protocol runs past the object:
==================================================================
BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0
Read of size 2 at addr ffff8881047d11b4 by task test_progs/428
Tainted: [W]=WARN
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
print_report+0xd1/0x630
kasan_report+0xf3/0x130
__asan_report_load2_noabort+0x14/0x30
bpf_sock_destroy+0xc7/0xe0
bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7
bpf_iter_run_prog+0x538/0xde0
bpf_iter_tcp_seq_show+0x26b/0x4b0
bpf_seq_read+0x424/0x1210
vfs_read+0x197/0xe40
ksys_read+0x119/0x240
__x64_sys_read+0x72/0xc0
x64_sys_call+0x647/0x27e0
do_syscall_64+0xe5/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Only check sk_protocol on full socks. tcp_abort() already knows how to
deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it
never matched the code.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 5b4eb82475ae17d55974235c09e97044829426a8
(git)
Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < a9651704c6fd64590b5ad4fbe7c3768accf95993 (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 91a482a81eabddebf5430cbbdf12027e1a91b767 (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 2534a5e5d360c2b10203cfa80f4ab9d021e48f2f (git) Affected: 4ddbcb886268af8d12a23e6640b39d1d9c652b1b , < 01b245ba016d44861690594e10f67e026ce8552f (git) |
|
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b4eb82475ae17d55974235c09e97044829426a8",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "a9651704c6fd64590b5ad4fbe7c3768accf95993",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "91a482a81eabddebf5430cbbdf12027e1a91b767",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "2534a5e5d360c2b10203cfa80f4ab9d021e48f2f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "01b245ba016d44861690594e10f67e026ce8552f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk-\u003esk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:23.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8"
},
{
"url": "https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993"
},
{
"url": "https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767"
},
{
"url": "https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f"
},
{
"url": "https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f"
}
],
"title": "bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98384",
"datePublished": "2026-10-09T07:34:23.097Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:23.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98383 (GCVE-0-2026-98383)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 0f38472a2aa8704a6b514c0dfa9c32f3672b8f32
(git)
Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < cae8674489f26edf7553fdd660599466cbb4c32f (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 9f9e57b5a3a033f95f49ef9d541340cdbcb80abb (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < df0072be6fc373cb22f9ea854d458b04e32a03cf (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < b9bb0e735460751b620156f800a4279a28573392 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < 37b18688cd18fd86d2f35c212df1611862a26cd5 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < fca71ead7a20290af1e2046983eeafae43d21af1 (git) Affected: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 , < e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 (git) |
|
| Linux | Linux |
Affected:
4.18
Unaffected: 0 , < 4.18 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "b9bb0e735460751b620156f800a4279a28573392",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb-\u003ehead, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:22.408Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32"
},
{
"url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f"
},
{
"url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb"
},
{
"url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf"
},
{
"url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392"
},
{
"url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5"
},
{
"url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1"
},
{
"url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"
}
],
"title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98383",
"datePublished": "2026-10-09T07:34:22.408Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:22.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98382 (GCVE-0-2026-98382)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Reject dev-bound-only programs on other devices
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject dev-bound-only programs on other devices
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
unrelated netdevs compare equal. A bound-only program on an
offload-registered netdev can instead inherit a real offdev and match a
sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
specialized for the bound driver on the target driver's xdp_buff. Running a
veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
Call Trace:
...
tun_build_skb (drivers/net/tun.c:1739)
tun_get_user (drivers/net/tun.c:1856)
tun_chr_write_iter (drivers/net/tun.c:2091)
vfs_write (fs/read_write.c:595 fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the
shared-offdev fallback only for genuinely offloaded multi-port programs.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < e57f04194361574493e3e6cf0b9e9c69e4ae9791
(git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 0dceda331180617aeeb22381e8480b37f18ba08b (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 940b626854de200e6187777d42114727daca617c (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < bb375f3c5990e29851894f20ebc4b9dbc6676126 (git) Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 6db1ce73e9853f533eb7f413f14ba00f8ec6f80d (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e57f04194361574493e3e6cf0b9e9c69e4ae9791",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "0dceda331180617aeeb22381e8480b37f18ba08b",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "940b626854de200e6187777d42114727daca617c",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "bb375f3c5990e29851894f20ebc4b9dbc6676126",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "6db1ce73e9853f533eb7f413f14ba00f8ec6f80d",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs on other devices\n\n__bpf_offload_dev_match() falls back to comparing offdev pointers after an\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so\nunrelated netdevs compare equal. A bound-only program on an\noffload-registered netdev can instead inherit a real offdev and match a\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs\nspecialized for the bound driver on the target driver\u0027s xdp_buff. Running a\nveth-bound program on tun reads beyond tun\u0027s bare stack xdp_buff as a\nveth_xdp_buff.\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)\n Call Trace:\n ...\n tun_build_skb (drivers/net/tun.c:1739)\n tun_get_user (drivers/net/tun.c:1856)\n tun_chr_write_iter (drivers/net/tun.c:2091)\n vfs_write (fs/read_write.c:595 fs/read_write.c:687)\n ksys_write (fs/read_write.c:739)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nRestrict non-offloaded programs to exact netdev matches and retain the\nshared-offdev fallback only for genuinely offloaded multi-port programs."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:21.718Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e57f04194361574493e3e6cf0b9e9c69e4ae9791"
},
{
"url": "https://git.kernel.org/stable/c/0dceda331180617aeeb22381e8480b37f18ba08b"
},
{
"url": "https://git.kernel.org/stable/c/940b626854de200e6187777d42114727daca617c"
},
{
"url": "https://git.kernel.org/stable/c/bb375f3c5990e29851894f20ebc4b9dbc6676126"
},
{
"url": "https://git.kernel.org/stable/c/6db1ce73e9853f533eb7f413f14ba00f8ec6f80d"
}
],
"title": "bpf: Reject dev-bound-only programs on other devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98382",
"datePublished": "2026-10-09T07:34:21.718Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:21.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98381 (GCVE-0-2026-98381)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
veth: manage XDP program pointers during channel resize
Summary
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog. If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
include/net/xdp.h:696 drivers/net/veth.c:820)
Call Trace:
veth_xdp_rcv (drivers/net/veth.c:941)
veth_poll (drivers/net/veth.c:986)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
Kernel panic - not syncing: Fatal exception in interrupt
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 7a8e143109ff2736dc79e41dcd55af7ceab7520a
(git)
Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 25bb7c36225220d30f404d7e29d2e052bc5f4b99 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 43f6b647f209591b1e3f726bb16b8dcba6b95908 (git) Affected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 , < 7104a370714346b667712913dc16abf14bbc97ed (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "7104a370714346b667712913dc16abf14bbc97ed",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq-\u003exdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n BUG: unable to handle page fault for address: ffffc90000256048\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n include/net/xdp.h:696 drivers/net/veth.c:820)\n Call Trace:\n veth_xdp_rcv (drivers/net/veth.c:941)\n veth_poll (drivers/net/veth.c:986)\n __napi_poll (net/core/dev.c:7787)\n net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n handle_softirqs (kernel/softirq.c:645)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:21.029Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a"
},
{
"url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758"
},
{
"url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6"
},
{
"url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9"
},
{
"url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99"
},
{
"url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908"
},
{
"url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed"
}
],
"title": "veth: manage XDP program pointers during channel resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98381",
"datePublished": "2026-10-09T07:34:21.029Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:21.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98380 (GCVE-0-2026-98380)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
net/sched: reject IDR error pointers when deleting actions
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject IDR error pointers when deleting actions
tcf_action_delete() drops the reference held by its lookup before calling
tcf_idr_delete_index() with the saved action index. An unlocked
classifier can remove that action and reserve the same IDR slot with
ERR_PTR(-EBUSY) in between.
tcf_idr_delete_index() only checks the lookup result for NULL. It
therefore treats the reservation as a tc_action and dereferences
tcfa_bindcnt. A hardware execution breakpoint was used to schedule the
interleaving without changing the kernel source. KASAN reported this
decoded trace:
BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010
Read of size 4 at addr 0000000000000010 by task poc/150
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002
RIP: tca_action_gd+0x5c0/0x1010:
arch_atomic_read at arch/x86/include/asm/atomic.h:23
raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457
atomic_read at include/linux/atomic/atomic-instrumented.h:33
tcf_idr_delete_index at net/sched/act_api.c:766
tcf_action_delete at net/sched/act_api.c:1859
tcf_del_notify at net/sched/act_api.c:2014
tca_action_gd at net/sched/act_api.c:2064
R13: 0000000000000010 R15: fffffffffffffff0
Kernel panic - not syncing: Fatal exception
R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces
the address in R13. With the guard applied, the same reproducer returned
-ENOENT without a KASAN report or panic. Treat error pointers as absent
and return -ENOENT.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0190c1d452a91c38a3462abdd81752be1b9006a8 , < 39b751a210bf61a374afa82749afc7a77a08bf1d
(git)
Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < dd80a7519824b72c8fcfd3cc50cb93f7e2d90923 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 6bf076258aac4e0af69ef317656c31ce6444d647 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 6c9f07bf8800171de2cd3f02815cebe1f4d45f2d (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 259caa711b7688365676442e2fdb286b8aceaa80 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < 968550a439f64bd1a6c0d88efb92e4f082f84a26 (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < a9551f26287debe6d8aa6e8841974661065b975f (git) Affected: 0190c1d452a91c38a3462abdd81752be1b9006a8 , < c82b797abe668d0b668601a93ba2c0b071a63574 (git) |
|
| Linux | Linux |
Affected:
4.19
Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "39b751a210bf61a374afa82749afc7a77a08bf1d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "dd80a7519824b72c8fcfd3cc50cb93f7e2d90923",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6bf076258aac4e0af69ef317656c31ce6444d647",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6c9f07bf8800171de2cd3f02815cebe1f4d45f2d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "259caa711b7688365676442e2fdb286b8aceaa80",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "968550a439f64bd1a6c0d88efb92e4f082f84a26",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "a9551f26287debe6d8aa6e8841974661065b975f",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "c82b797abe668d0b668601a93ba2c0b071a63574",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject IDR error pointers when deleting actions\n\ntcf_action_delete() drops the reference held by its lookup before calling\ntcf_idr_delete_index() with the saved action index. An unlocked\nclassifier can remove that action and reserve the same IDR slot with\nERR_PTR(-EBUSY) in between.\n\ntcf_idr_delete_index() only checks the lookup result for NULL. It\ntherefore treats the reservation as a tc_action and dereferences\ntcfa_bindcnt. A hardware execution breakpoint was used to schedule the\ninterleaving without changing the kernel source. KASAN reported this\ndecoded trace:\n\n BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010\n Read of size 4 at addr 0000000000000010 by task poc/150\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002\n RIP: tca_action_gd+0x5c0/0x1010:\n arch_atomic_read at arch/x86/include/asm/atomic.h:23\n raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457\n atomic_read at include/linux/atomic/atomic-instrumented.h:33\n tcf_idr_delete_index at net/sched/act_api.c:766\n tcf_action_delete at net/sched/act_api.c:1859\n tcf_del_notify at net/sched/act_api.c:2014\n tca_action_gd at net/sched/act_api.c:2064\n R13: 0000000000000010 R15: fffffffffffffff0\n Kernel panic - not syncing: Fatal exception\n\nR15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces\nthe address in R13. With the guard applied, the same reproducer returned\n-ENOENT without a KASAN report or panic. Treat error pointers as absent\nand return -ENOENT."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:20.218Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/39b751a210bf61a374afa82749afc7a77a08bf1d"
},
{
"url": "https://git.kernel.org/stable/c/dd80a7519824b72c8fcfd3cc50cb93f7e2d90923"
},
{
"url": "https://git.kernel.org/stable/c/6bf076258aac4e0af69ef317656c31ce6444d647"
},
{
"url": "https://git.kernel.org/stable/c/6c9f07bf8800171de2cd3f02815cebe1f4d45f2d"
},
{
"url": "https://git.kernel.org/stable/c/259caa711b7688365676442e2fdb286b8aceaa80"
},
{
"url": "https://git.kernel.org/stable/c/968550a439f64bd1a6c0d88efb92e4f082f84a26"
},
{
"url": "https://git.kernel.org/stable/c/a9551f26287debe6d8aa6e8841974661065b975f"
},
{
"url": "https://git.kernel.org/stable/c/c82b797abe668d0b668601a93ba2c0b071a63574"
}
],
"title": "net/sched: reject IDR error pointers when deleting actions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98380",
"datePublished": "2026-10-09T07:34:20.218Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:20.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98379 (GCVE-0-2026-98379)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rpfilter: reject routes without inet6_dev
ip6_route_lookup() can return an error-free route whose rt6i_idev is
NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears
down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects
in the FIB. An unprivileged user can construct this state with rtnetlink
in a private user and network namespace, then trigger a NULL dereference
through an IPv6 rpfilter lookup:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)
Call Trace:
ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
nf_hook_slow (net/netfilter/core.c:619)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6216)
process_backlog (net/core/dev.c:6680)
__napi_poll (net/core/dev.c:7739)
net_rx_action (net/core/dev.c:7959)
handle_softirqs (kernel/softirq.c:622)
do_softirq.part.0 (kernel/softirq.c:523)
__local_bh_enable_ip (kernel/softirq.c:450)
__dev_queue_xmit (net/core/dev.c:4913)
packet_sendmsg (net/packet/af_packet.c:3139)
__sys_sendto (net/socket.c:2252)
__x64_sys_sendto (net/socket.c:2259)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Reject routes without an inet6_dev immediately after lookup. Such routes
are not eligible for reverse-path filtering, and the check protects all
later rt6i_idev dereferences.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < f4de78756b0fddbd125b2b1b77c74f2eccc8e977
(git)
Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 1681ab6dd1271f2f36047490793b78b1848bbcc9 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 65487e9e99431ffcf05024a817f51ee4e3bd9b47 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < f49da48bd679cfee646d6a40dd02b1933de577d1 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < eafe081ea77d25b5c8e601680671b4ecb4520e7d (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 3a7384bc2e66217c9a01a392281334f4423740a0 (git) Affected: e26f9a480fb6c1b614660e824d69a74e2ce990f3 , < 1b9b5323725e458906c7620a3bc10398b51ad954 (git) |
|
| Linux | Linux |
Affected:
3.3
Unaffected: 0 , < 3.3 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4de78756b0fddbd125b2b1b77c74f2eccc8e977",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1681ab6dd1271f2f36047490793b78b1848bbcc9",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "65487e9e99431ffcf05024a817f51ee4e3bd9b47",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "f49da48bd679cfee646d6a40dd02b1933de577d1",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "eafe081ea77d25b5c8e601680671b4ecb4520e7d",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "3a7384bc2e66217c9a01a392281334f4423740a0",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1b9b5323725e458906c7620a3bc10398b51ad954",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject routes without inet6_dev\n\nip6_route_lookup() can return an error-free route whose rt6i_idev is\nNULL. Lowering an external nexthop device\u0027s MTU below IPV6_MIN_MTU tears\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects\nin the FIB. An unprivileged user can construct this state with rtnetlink\nin a private user and network namespace, then trigger a NULL dereference\nthrough an IPv6 rpfilter lookup:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)\n Call Trace:\n ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)\n nf_hook_slow (net/netfilter/core.c:619)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6216)\n process_backlog (net/core/dev.c:6680)\n __napi_poll (net/core/dev.c:7739)\n net_rx_action (net/core/dev.c:7959)\n handle_softirqs (kernel/softirq.c:622)\n do_softirq.part.0 (kernel/softirq.c:523)\n __local_bh_enable_ip (kernel/softirq.c:450)\n __dev_queue_xmit (net/core/dev.c:4913)\n packet_sendmsg (net/packet/af_packet.c:3139)\n __sys_sendto (net/socket.c:2252)\n __x64_sys_sendto (net/socket.c:2259)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nReject routes without an inet6_dev immediately after lookup. Such routes\nare not eligible for reverse-path filtering, and the check protects all\nlater rt6i_idev dereferences."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:19.425Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4de78756b0fddbd125b2b1b77c74f2eccc8e977"
},
{
"url": "https://git.kernel.org/stable/c/1681ab6dd1271f2f36047490793b78b1848bbcc9"
},
{
"url": "https://git.kernel.org/stable/c/65487e9e99431ffcf05024a817f51ee4e3bd9b47"
},
{
"url": "https://git.kernel.org/stable/c/f49da48bd679cfee646d6a40dd02b1933de577d1"
},
{
"url": "https://git.kernel.org/stable/c/290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40"
},
{
"url": "https://git.kernel.org/stable/c/eafe081ea77d25b5c8e601680671b4ecb4520e7d"
},
{
"url": "https://git.kernel.org/stable/c/3a7384bc2e66217c9a01a392281334f4423740a0"
},
{
"url": "https://git.kernel.org/stable/c/1b9b5323725e458906c7620a3bc10398b51ad954"
}
],
"title": "netfilter: ip6t_rpfilter: reject routes without inet6_dev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98379",
"datePublished": "2026-10-09T07:34:19.425Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:19.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98378 (GCVE-0-2026-98378)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Skip unsettled links in link iterator
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip unsettled links in link iterator
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
succeeds and before bpf_link_settle() publishes the ID in link->id.
bpf_link_by_id() treats such an ID-zero link as unsettled, but the link
iterator takes a reference without this check.
If anon_inode_getfile() then fails, the creator removes the ID and frees
its still-private link directly. The iterator is left with a dangling
reference and its next bpf_link_put() accesses freed memory.
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as
bpf_link_by_id() does.
BUG: KASAN: slab-use-after-free in bpf_link_put
Write of size 8 by task exp/384
Call Trace:
bpf_link_put kernel/bpf/syscall.c:3372
bpf_link_seq_next kernel/bpf/link_iter.c:33
bpf_seq_read kernel/bpf/bpf_iter.c:158
vfs_read fs/read_write.c:572
ksys_read fs/read_write.c:716
do_syscall_64 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 68930f8d40ab4c10ca3b019f076136758fd100a8
(git)
Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < c251ed48bd9063cf7de6049421e78b6de989060f (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 798a61edbc436cacdb659927d067368eeb1e30e2 (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 6e271f093d15d323f42de26f66556af53fa8e19f (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 87ce4b53b7436b50fc984f0a6afaf77f68ac5573 (git) Affected: 9f88361273082825d9f0d13a543d49f9fa0d44a8 , < 50e80e2bb5e2be8515205b9c496b9640ddefa434 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68930f8d40ab4c10ca3b019f076136758fd100a8",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "c251ed48bd9063cf7de6049421e78b6de989060f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "798a61edbc436cacdb659927d067368eeb1e30e2",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "6e271f093d15d323f42de26f66556af53fa8e19f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "87ce4b53b7436b50fc984f0a6afaf77f68ac5573",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "50e80e2bb5e2be8515205b9c496b9640ddefa434",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link-\u003eid.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:18.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8"
},
{
"url": "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f"
},
{
"url": "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2"
},
{
"url": "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f"
},
{
"url": "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573"
},
{
"url": "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434"
}
],
"title": "bpf: Skip unsettled links in link iterator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98378",
"datePublished": "2026-10-09T07:34:18.626Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:18.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98377 (GCVE-0-2026-98377)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),
never that mac_len bytes of MAC header are present. Its ETH_HLEN
wrappers - __vlan_insert_tag() under skb_vlan_push(), and
vlan_insert_tag() under validate_xmit_vlan() on the generic transmit
path - therefore rewrite the first 16 bytes at skb->data: a 12-byte
memmove plus two 2-byte stores at +12 and +14. No caller supplies the
bound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().
An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a
one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a
hwaccel tag; the next - clsact "action vlan push" or
bpf_skb_vlan_push() - enters the helper with skb->len still 1. The
head comes from skbuff_small_head without __GFP_ZERO, so each push
drags bytes from beyond skb->tail into the frame. After three the
one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised
slab:
0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81
`------------------------------'
only 0x5a was sent; the rest is slab, here the top 56 bits of a
linear-map address
Require the MAC header the helper rewrites to be present, so such a
frame is dropped rather than transmitted.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 40a5cc4b7251c74f3341332a226d02200e96bccf
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f42562dd027dc4ed103fae17b2206e73ea1963c4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40a5cc4b7251c74f3341332a226d02200e96bccf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f42562dd027dc4ed103fae17b2206e73ea1963c4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: require the MAC header to be present in __vlan_insert_inner_tag()\n\n__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),\nnever that mac_len bytes of MAC header are present. Its ETH_HLEN\nwrappers - __vlan_insert_tag() under skb_vlan_push(), and\nvlan_insert_tag() under validate_xmit_vlan() on the generic transmit\npath - therefore rewrite the first 16 bytes at skb-\u003edata: a 12-byte\nmemmove plus two 2-byte stores at +12 and +14. No caller supplies the\nbound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().\n\nAn IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a\none-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a\nhwaccel tag; the next - clsact \"action vlan push\" or\nbpf_skb_vlan_push() - enters the helper with skb-\u003elen still 1. The\nhead comes from skbuff_small_head without __GFP_ZERO, so each push\ndrags bytes from beyond skb-\u003etail into the frame. After three the\none-byte send leaves as 13 bytes carrying 11 bytes of uninitialised\nslab:\n\n 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81\n `------------------------------\u0027\n only 0x5a was sent; the rest is slab, here the top 56 bits of a\n linear-map address\n\nRequire the MAC header the helper rewrites to be present, so such a\nframe is dropped rather than transmitted."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:17.832Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40a5cc4b7251c74f3341332a226d02200e96bccf"
},
{
"url": "https://git.kernel.org/stable/c/f42562dd027dc4ed103fae17b2206e73ea1963c4"
},
{
"url": "https://git.kernel.org/stable/c/59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc"
},
{
"url": "https://git.kernel.org/stable/c/ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a"
}
],
"title": "vlan: require the MAC header to be present in __vlan_insert_inner_tag()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98377",
"datePublished": "2026-10-09T07:34:17.832Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:17.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98376 (GCVE-0-2026-98376)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:34 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
bpf: Use array_map_meta_equal for percpu array inner map replacement
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use array_map_meta_equal for percpu array inner map replacement
percpu_array_map_ops.map_meta_equal points to the generic
bpf_map_meta_equal(), which does not compare max_entries. When a
percpu array serves as an inner map, replacing it with one that has
fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()
inlines the original template's index_mask as a JIT immediate, a lookup
on the replacement map can access pptrs[] out of bounds.
Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),
which already enforces the max_entries equality check.
Add a selftest to verify that replacing a percpu array inner map with
a differently-sized one is rejected.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "593980175389a05793f6060aa20e626330960395",
"status": "affected",
"version": "db69718b8efac802c7cc20d5a6c7dfc913f99c43",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c",
"tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use array_map_meta_equal for percpu array inner map replacement\n\npercpu_array_map_ops.map_meta_equal points to the generic\nbpf_map_meta_equal(), which does not compare max_entries. When a\npercpu array serves as an inner map, replacing it with one that has\nfewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()\ninlines the original template\u0027s index_mask as a JIT immediate, a lookup\non the replacement map can access pptrs[] out of bounds.\n\nPoint percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),\nwhich already enforces the max_entries equality check.\n\nAdd a selftest to verify that replacing a percpu array inner map with\na differently-sized one is rejected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:17.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"
}
],
"title": "bpf: Use array_map_meta_equal for percpu array inner map replacement",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98376",
"datePublished": "2026-10-09T07:34:17.043Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:17.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98375 (GCVE-0-2026-98375)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:10 – Updated: 2026-10-09 07:34
VLAI
EPSS
VEX
Title
xen/netfront: drop RX packets with a short Ethernet header
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: drop RX packets with a short Ethernet header
handle_incoming_queue() pulls pull_to bytes into the head before
calling eth_type_trans(). pull_to is the length of the first RX slot,
capped at RX_COPY_THRESHOLD, and that length comes from the backend.
Nothing checks it against ETH_HLEN.
If the first slot is shorter than ETH_HLEN and more slots follow, the
head ends up shorter than an Ethernet header while skb->len is longer,
and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is
shorter than ETH_HLEN, eth_type_trans() reads the header past the end
of the data instead.
Pull at least ETH_HLEN, and drop the packet if that fails, which also
drops packets too short to hold an Ethernet header. This also checks
the return value of the pull, which was ignored.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "089e58805c452e52179482b1025a8e309a57f801",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc7",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc7",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb-\u003elen is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:34:16.178Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801"
}
],
"title": "xen/netfront: drop RX packets with a short Ethernet header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98375",
"datePublished": "2026-10-09T07:10:45.930Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-09T07:34:16.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98374 (GCVE-0-2026-98374)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:01 – Updated: 2026-10-07 13:01
VLAI
EPSS
VEX
Title
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.
The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue(). An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:
BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
Read of size 4 at addr ffff88800604d928 by task swapper/1/0
Call Trace:
tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
Sync the hint to the copy.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c31b70c9968fe9c4194d1b5d06d07596a3b680de , < fad6d429651e748365e93ca54645accc212f0018
(git)
Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < c5b4da1f403a658c1c19766be2b426003ada419f (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 71d45049b0d631dfdbf3c65305f7fca676de023b (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < e3ea71cb1408a013ed4e8a757b815f1a919324bd (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 631aa4cb45099f09e9385dd786bd291c6270bfc4 (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < 0f87720c7e4bcab07c24888b3cf12bfe857bb90e (git) Affected: c31b70c9968fe9c4194d1b5d06d07596a3b680de , < fe99bbeee5c5dbd3abc30721a8079ced59649d97 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fad6d429651e748365e93ca54645accc212f0018",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "c5b4da1f403a658c1c19766be2b426003ada419f",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "71d45049b0d631dfdbf3c65305f7fca676de023b",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "e3ea71cb1408a013ed4e8a757b815f1a919324bd",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "631aa4cb45099f09e9385dd786bd291c6270bfc4",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "0f87720c7e4bcab07c24888b3cf12bfe857bb90e",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "fe99bbeee5c5dbd3abc30721a8079ced59649d97",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:01:48.600Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"
},
{
"url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"
},
{
"url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"
},
{
"url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"
},
{
"url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"
},
{
"url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"
},
{
"url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"
}
],
"title": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98374",
"datePublished": "2026-10-07T13:01:48.600Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-07T13:01:48.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98373 (GCVE-0-2026-98373)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:01 – Updated: 2026-10-07 13:01
VLAI
EPSS
VEX
Title
mm/hugetlb: preserve mremap address delta when skipping page tables
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: preserve mremap address delta when skipping page tables
move_hugetlb_page_tables() optimizes mremap() by advancing to the last
entry in the page table when the source page table does not exist, either
initially or after unsharing a PMD table. The common loop increment then
steps to the first entry in the next page table.
However, the code advances both the source and destination addresses to
the last entries in their respective page tables, which is wrong. The
destination address must be advanced only by the same amount as the source
address.
If the source and destination offsets within their page tables differ, the
destination address can be advanced too far, causing follow-up issues.
Fix this by advancing the destination address by the source advance
distance.
With a reproducer, we were able to trigger a kernel panic on x86-64. With
this fix in place, we can no longer reproduce the issue.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff
(git)
Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 850cc4a84b36a0062dcd0391acd2450e20ab0767 (git) Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 480a39b0a12c977ed6e755f3d12a23424c57d11f (git) Affected: e95a9851787bbb3cd4deb40fe8bab03f731852d1 , < 9bdad082d44bdcf93716973dcba6be77e8a06e7b (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.55 , ≤ 6.18.* (semver) Unaffected: 7.2.9 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "850cc4a84b36a0062dcd0391acd2450e20ab0767",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "480a39b0a12c977ed6e755f3d12a23424c57d11f",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "9bdad082d44bdcf93716973dcba6be77e8a06e7b",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: preserve mremap address delta when skipping page tables\n\nmove_hugetlb_page_tables() optimizes mremap() by advancing to the last\nentry in the page table when the source page table does not exist, either\ninitially or after unsharing a PMD table. The common loop increment then\nsteps to the first entry in the next page table.\n\nHowever, the code advances both the source and destination addresses to\nthe last entries in their respective page tables, which is wrong. The\ndestination address must be advanced only by the same amount as the source\naddress.\n\nIf the source and destination offsets within their page tables differ, the\ndestination address can be advanced too far, causing follow-up issues. \nFix this by advancing the destination address by the source advance\ndistance.\n\nWith a reproducer, we were able to trigger a kernel panic on x86-64. With\nthis fix in place, we can no longer reproduce the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:01:47.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff"
},
{
"url": "https://git.kernel.org/stable/c/850cc4a84b36a0062dcd0391acd2450e20ab0767"
},
{
"url": "https://git.kernel.org/stable/c/480a39b0a12c977ed6e755f3d12a23424c57d11f"
},
{
"url": "https://git.kernel.org/stable/c/9bdad082d44bdcf93716973dcba6be77e8a06e7b"
}
],
"title": "mm/hugetlb: preserve mremap address delta when skipping page tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98373",
"datePublished": "2026-10-07T13:01:47.433Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-07T13:01:47.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}