Search
Find a vulnerability
Search criteria
42918 vulnerabilities by linux
CVE-2026-98868 (GCVE-0-2026-98868)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
dm-pcache: reject a kset that overruns its segment
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: reject a kset that overruns its segment
cache_replay(), the writeback worker and the GC worker read a kset of
get_kset_onmedia_size() bytes and advance the position by it. A forged
key_num makes that size exceed the segment's remaining space, so the
advance walks past the segment and trips the cache_pos_advance() BUG_ON.
Reject a kset whose on-media size exceeds cache_seg_remain() before use.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 01a700e9278da5706c865b9ca3ae70fdb7b4531d
(git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10 (git) Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-pcache/cache_gc.c",
"drivers/md/dm-pcache/cache_key.c",
"drivers/md/dm-pcache/cache_writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01a700e9278da5706c865b9ca3ae70fdb7b4531d",
"status": "affected",
"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
"versionType": "git"
},
{
"lessThan": "96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10",
"status": "affected",
"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
"versionType": "git"
},
{
"lessThan": "7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb",
"status": "affected",
"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-pcache/cache_gc.c",
"drivers/md/dm-pcache/cache_key.c",
"drivers/md/dm-pcache/cache_writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: reject a kset that overruns its segment\n\ncache_replay(), the writeback worker and the GC worker read a kset of\nget_kset_onmedia_size() bytes and advance the position by it. A forged\nkey_num makes that size exceed the segment\u0027s remaining space, so the\nadvance walks past the segment and trips the cache_pos_advance() BUG_ON.\n\nReject a kset whose on-media size exceeds cache_seg_remain() before use."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:30.658Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01a700e9278da5706c865b9ca3ae70fdb7b4531d"
},
{
"url": "https://git.kernel.org/stable/c/96e2863b1f81ea61b8d8d5d5a45d3b4c018f8e10"
},
{
"url": "https://git.kernel.org/stable/c/7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb"
}
],
"title": "dm-pcache: reject a kset that overruns its segment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98868",
"datePublished": "2026-10-18T15:51:30.658Z",
"dateReserved": "2026-09-25T10:25:14.377Z",
"dateUpdated": "2026-10-18T15:51:30.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98867 (GCVE-0-2026-98867)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
dm-pcache: bound the logical key offset from persistent memory
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-pcache: bound the logical key offset from persistent memory
cache_key_decode() takes a key's logical off from the cache device and
later indexes req_key_tree->subtrees[] by it in get_subtree(). An off
past the device forms a subtree pointer outside the array, which
rb_insert() writes through during replay.
Reject a key of zero length, or whose off+len (computed in 64 bits)
exceeds the device size, before it is used.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 3d5a87cb909c1f375f08065b20123fa5db5958d8
(git)
Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 10449703200076980704894c3d68d6796182371b (git) Affected: 1d57628ff95b32d5cfa8d8f50e07690c161e9cf0 , < 97fc4b53dbe4a983fdf093243067fa6a64562307 (git) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-pcache/cache_key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d5a87cb909c1f375f08065b20123fa5db5958d8",
"status": "affected",
"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
"versionType": "git"
},
{
"lessThan": "10449703200076980704894c3d68d6796182371b",
"status": "affected",
"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
"versionType": "git"
},
{
"lessThan": "97fc4b53dbe4a983fdf093243067fa6a64562307",
"status": "affected",
"version": "1d57628ff95b32d5cfa8d8f50e07690c161e9cf0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-pcache/cache_key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: bound the logical key offset from persistent memory\n\ncache_key_decode() takes a key\u0027s logical off from the cache device and\nlater indexes req_key_tree-\u003esubtrees[] by it in get_subtree(). An off\npast the device forms a subtree pointer outside the array, which\nrb_insert() writes through during replay.\n\nReject a key of zero length, or whose off+len (computed in 64 bits)\nexceeds the device size, before it is used."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:29.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d5a87cb909c1f375f08065b20123fa5db5958d8"
},
{
"url": "https://git.kernel.org/stable/c/10449703200076980704894c3d68d6796182371b"
},
{
"url": "https://git.kernel.org/stable/c/97fc4b53dbe4a983fdf093243067fa6a64562307"
}
],
"title": "dm-pcache: bound the logical key offset from persistent memory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98867",
"datePublished": "2026-10-18T15:51:29.499Z",
"dateReserved": "2026-09-25T10:25:14.377Z",
"dateUpdated": "2026-10-18T15:51:29.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98866 (GCVE-0-2026-98866)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
Add a sched_cache_grp pointer to task_struct so that scheduler code
can access the cache group directly via the task, without going
through mm->sched_cache_grp. This decouples the scheduler's hot-path
accesses from the mm_struct.
Each task holds its own refcount on the sched_cache_group, separate
from the reference held by its mm_struct. The reference is acquired
in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().
This fixes the use-after-free when account_mm_sched() reaches the group
through a task whose mm is being switched, as reported by Hyunwoo:
https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/
Convert all scheduler code in fair.c and exit.c to use
p->sched_cache_grp instead of p->mm->sched_cache_grp.
Keep the fork/exec/exit reference management out of the generic mm
paths: add sched_cache_fork(), sched_cache_fork_cleanup(),
sched_cache_exec_mmap() and sched_cache_exit_mm() in
kernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),
so fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper
instead of open-coding the refcounting under #ifdef. Also add
sched_cache_group_get() and task_cache_group_get().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
df0d98475954d655571979aa061ecb07d7e00392 , < 9436130e6da72af63289a4acb3aa0c1df07a3928
(git)
Affected: df0d98475954d655571979aa061ecb07d7e00392 , < b636fef85bda7d1bab9c0a45067ab1508d79d946 (git) |
|
| Linux | Linux |
Affected:
7.2
Unaffected: 0 , < 7.2 (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/exec.c",
"include/linux/sched.h",
"kernel/exit.c",
"kernel/fork.c",
"kernel/sched/fair.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9436130e6da72af63289a4acb3aa0c1df07a3928",
"status": "affected",
"version": "df0d98475954d655571979aa061ecb07d7e00392",
"versionType": "git"
},
{
"lessThan": "b636fef85bda7d1bab9c0a45067ab1508d79d946",
"status": "affected",
"version": "df0d98475954d655571979aa061ecb07d7e00392",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/exec.c",
"include/linux/sched.h",
"kernel/exit.c",
"kernel/fork.c",
"kernel/sched/fair.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/cache: Introduce task_struct-\u003esched_cache_grp to fix UAF\n\nAdd a sched_cache_grp pointer to task_struct so that scheduler code\ncan access the cache group directly via the task, without going\nthrough mm-\u003esched_cache_grp. This decouples the scheduler\u0027s hot-path\naccesses from the mm_struct.\n\nEach task holds its own refcount on the sched_cache_group, separate\nfrom the reference held by its mm_struct. The reference is acquired\nin copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().\nThis fixes the use-after-free when account_mm_sched() reaches the group\nthrough a task whose mm is being switched, as reported by Hyunwoo:\n\n https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/\n\nConvert all scheduler code in fair.c and exit.c to use\np-\u003esched_cache_grp instead of p-\u003emm-\u003esched_cache_grp.\n\nKeep the fork/exec/exit reference management out of the generic mm\npaths: add sched_cache_fork(), sched_cache_fork_cleanup(),\nsched_cache_exec_mmap() and sched_cache_exit_mm() in\nkernel/sched/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),\nso fs/exec.c, kernel/fork.c and kernel/exit.c each call one helper\ninstead of open-coding the refcounting under #ifdef. Also add\nsched_cache_group_get() and task_cache_group_get()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:27.883Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9436130e6da72af63289a4acb3aa0c1df07a3928"
},
{
"url": "https://git.kernel.org/stable/c/b636fef85bda7d1bab9c0a45067ab1508d79d946"
}
],
"title": "sched/cache: Introduce task_struct-\u003esched_cache_grp to fix UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98866",
"datePublished": "2026-10-18T15:51:27.883Z",
"dateReserved": "2026-09-25T10:25:14.377Z",
"dateUpdated": "2026-10-18T15:51:27.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98865 (GCVE-0-2026-98865)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
sched_ext: Don't run ops.dequeue() with a DSQ lock held
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Don't run ops.dequeue() with a DSQ lock held
ops.dequeue() is invoked with the source user DSQ's lock still held on
the consume and move paths (scx_consume_dispatch_q(),
move_task_between_dsqs()). A BPF scheduler which locks the source user
DSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq -
self-deadlocks.
ops.dequeue() can only call the "any" kfuncs and none of them can lock a
builtin DSQ, so the global and bypass paths can't deadlock; however,
all DSQ locks share one lockdep class, so iterating any user DSQ from
ops.dequeue() on those paths trips the recursion check.
Move the invocation after the DSQ unlock on all three paths.
SCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer
so that the callback is invoked exactly once.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d , < fe499ae9da46e297f578d4346c4c8e338c3118db
(git)
Affected: ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d , < cb86607ada73185f321baa7f9d94a08a3a40bbf5 (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/internal.h",
"kernel/sched/ext/sub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe499ae9da46e297f578d4346c4c8e338c3118db",
"status": "affected",
"version": "ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d",
"versionType": "git"
},
{
"lessThan": "cb86607ada73185f321baa7f9d94a08a3a40bbf5",
"status": "affected",
"version": "ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/internal.h",
"kernel/sched/ext/sub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don\u0027t run ops.dequeue() with a DSQ lock held\n\nops.dequeue() is invoked with the source user DSQ\u0027s lock still held on\nthe consume and move paths (scx_consume_dispatch_q(),\nmove_task_between_dsqs()). A BPF scheduler which locks the source user\nDSQ from ops.dequeue() - e.g. by iterating it with bpf_iter_scx_dsq -\nself-deadlocks.\n\nops.dequeue() can only call the \"any\" kfuncs and none of them can lock a\nbuiltin DSQ, so the global and bypass paths can\u0027t deadlock; however,\nall DSQ locks share one lockdep class, so iterating any user DSQ from\nops.dequeue() on those paths trips the recursion check.\n\nMove the invocation after the DSQ unlock on all three paths.\nSCX_TASK_IN_CUSTODY is cleared under the lock serializing the transfer\nso that the callback is invoked exactly once."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:26.449Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe499ae9da46e297f578d4346c4c8e338c3118db"
},
{
"url": "https://git.kernel.org/stable/c/cb86607ada73185f321baa7f9d94a08a3a40bbf5"
}
],
"title": "sched_ext: Don\u0027t run ops.dequeue() with a DSQ lock held",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98865",
"datePublished": "2026-10-18T15:51:26.449Z",
"dateReserved": "2026-09-25T10:25:14.377Z",
"dateUpdated": "2026-10-18T15:51:26.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98864 (GCVE-0-2026-98864)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") moved the final
ops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the
custody update and ops.dequeue() precede it. A task can thus be found on a
DSQ while still SCX_OPSS_DISPATCHING.
The dequeue and core-sched pick paths wait for the state to clear in
ops_dequeue() but the reenqueue paths don't. A reenqueue in that window runs
ops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed.
The dispatcher's final store then overwrites it with SCX_OPSS_NONE and
finish_dispatch() drops every later dispatch of the task.
Wait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for
reenqueue, the same way ops_dequeue() does.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d , < 43457bf6550044c40bd6d3fcdf9ea66f5a55d139
(git)
Affected: ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d , < 7de9a6fb44eae4f05e68c805d58b9c618815adfa (git) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/internal.h",
"kernel/sched/ext/sub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43457bf6550044c40bd6d3fcdf9ea66f5a55d139",
"status": "affected",
"version": "ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d",
"versionType": "git"
},
{
"lessThan": "7de9a6fb44eae4f05e68c805d58b9c618815adfa",
"status": "affected",
"version": "ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/ext/ext.c",
"kernel/sched/ext/internal.h",
"kernel/sched/ext/sub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task\n\nebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\") moved the final\nops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the\ncustody update and ops.dequeue() precede it. A task can thus be found on a\nDSQ while still SCX_OPSS_DISPATCHING.\n\nThe dequeue and core-sched pick paths wait for the state to clear in\nops_dequeue() but the reenqueue paths don\u0027t. A reenqueue in that window runs\nops.enqueue() and sets SCX_OPSS_QUEUED before the dispatch has completed.\nThe dispatcher\u0027s final store then overwrites it with SCX_OPSS_NONE and\nfinish_dispatch() drops every later dispatch of the task.\n\nWait for SCX_OPSS_DISPATCHING to clear before dequeueing a task for\nreenqueue, the same way ops_dequeue() does."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:25.532Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43457bf6550044c40bd6d3fcdf9ea66f5a55d139"
},
{
"url": "https://git.kernel.org/stable/c/7de9a6fb44eae4f05e68c805d58b9c618815adfa"
}
],
"title": "sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98864",
"datePublished": "2026-10-18T15:51:25.532Z",
"dateReserved": "2026-09-25T10:25:14.377Z",
"dateUpdated": "2026-10-18T15:51:25.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98863 (GCVE-0-2026-98863)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the
nested pages fails in the KVM_RUN path. If userspace re-runs the vCPU, and
vmcs02 holds valid PFNs from the *previous* run of L2, then KVM could
re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.
Note, both SVM and VMX (as of commit 11722439fb20 ("KVM: nVMX: Ensure
KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit") ensure the request
is cleared on VM-Exit (including the "forced" case), i.e. there is no risk
of double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request
trying to map the nested pages.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
671ddc700fd08b94967b1e2a937020e30c838609 , < 525694a6021ec6c8f7ce1f38acdf2dd77698fec1
(git)
Affected: 671ddc700fd08b94967b1e2a937020e30c838609 , < 942192dbcd3a06695ef6b31cf10a41a21cf014d8 (git) Affected: 671ddc700fd08b94967b1e2a937020e30c838609 , < 10180a277549339020b08000206092c07e0bff5a (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc5 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "525694a6021ec6c8f7ce1f38acdf2dd77698fec1",
"status": "affected",
"version": "671ddc700fd08b94967b1e2a937020e30c838609",
"versionType": "git"
},
{
"lessThan": "942192dbcd3a06695ef6b31cf10a41a21cf014d8",
"status": "affected",
"version": "671ddc700fd08b94967b1e2a937020e30c838609",
"versionType": "git"
},
{
"lessThan": "10180a277549339020b08000206092c07e0bff5a",
"status": "affected",
"version": "671ddc700fd08b94967b1e2a937020e30c838609",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc5",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n\nRe-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the\nnested pages fails in the KVM_RUN path. If userspace re-runs the vCPU, and\nvmcs02 holds valid PFNs from the *previous* run of L2, then KVM could\nre-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.\n\nNote, both SVM and VMX (as of commit 11722439fb20 (\"KVM: nVMX: Ensure\nKVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit\") ensure the request\nis cleared on VM-Exit (including the \"forced\" case), i.e. there is no risk\nof double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request\ntrying to map the nested pages."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:24.446Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1"
},
{
"url": "https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8"
},
{
"url": "https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"
}
],
"title": "KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98863",
"datePublished": "2026-10-18T15:51:24.446Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:24.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98862 (GCVE-0-2026-98862)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
audit: fix exe mark UAF in kill_rules()
Summary
In the Linux kernel, the following vulnerability has been resolved:
audit: fix exe mark UAF in kill_rules()
kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit
tree is pruned. It drops entry->rule.exe before removing the rule from
the RCU-visible filter lists.
After a rule has been installed with AUDIT_ADD_RULE, which requires
CAP_AUDIT_CONTROL, removing the watched directory can race with another
task that is still evaluating the rule. In that case, fsnotify can free
the executable mark before the reader reaches audit_mark_compare(),
causing a use-after-free.
KASAN reports:
BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0
Unlink the published rules from the RCU-visible lists and retain them
on tree->rules for cleanup. If any rule has an executable mark, wait for
a single RCU grace period before removing the marks and scheduling the
entries for freeing. Otherwise, call_rcu() already provides the required
deferred freeing without a synchronous wait.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
34d99af52ad40bd498ba66970579a5bc1fb1a3bc , < 304960900991157e6883bdf0b39782b690545ee8
(git)
Affected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc , < 88633025f20ba9c32ccdb3efc86eafdf98cb825c (git) Affected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc , < f2cc5462b78559c7628a9f8ac9a9592e7783183a (git) Affected: 34d99af52ad40bd498ba66970579a5bc1fb1a3bc , < aa650d87a498844060eecb1d336f4d46f4d1b0b3 (git) |
|
| Linux | Linux |
Affected:
4.3
Unaffected: 0 , < 4.3 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/audit_tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "304960900991157e6883bdf0b39782b690545ee8",
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"versionType": "git"
},
{
"lessThan": "88633025f20ba9c32ccdb3efc86eafdf98cb825c",
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"versionType": "git"
},
{
"lessThan": "f2cc5462b78559c7628a9f8ac9a9592e7783183a",
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"versionType": "git"
},
{
"lessThan": "aa650d87a498844060eecb1d336f4d46f4d1b0b3",
"status": "affected",
"version": "34d99af52ad40bd498ba66970579a5bc1fb1a3bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/audit_tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix exe mark UAF in kill_rules()\n\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry-\u003erule.exe before removing the rule from\nthe RCU-visible filter lists.\n\nAfter a rule has been installed with AUDIT_ADD_RULE, which requires\nCAP_AUDIT_CONTROL, removing the watched directory can race with another\ntask that is still evaluating the rule. In that case, fsnotify can free\nthe executable mark before the reader reaches audit_mark_compare(),\ncausing a use-after-free.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0\n\nUnlink the published rules from the RCU-visible lists and retain them\non tree-\u003erules for cleanup. If any rule has an executable mark, wait for\na single RCU grace period before removing the marks and scheduling the\nentries for freeing. Otherwise, call_rcu() already provides the required\ndeferred freeing without a synchronous wait."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:23.224Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/304960900991157e6883bdf0b39782b690545ee8"
},
{
"url": "https://git.kernel.org/stable/c/88633025f20ba9c32ccdb3efc86eafdf98cb825c"
},
{
"url": "https://git.kernel.org/stable/c/f2cc5462b78559c7628a9f8ac9a9592e7783183a"
},
{
"url": "https://git.kernel.org/stable/c/aa650d87a498844060eecb1d336f4d46f4d1b0b3"
}
],
"title": "audit: fix exe mark UAF in kill_rules()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98862",
"datePublished": "2026-10-18T15:51:23.224Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:23.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98861 (GCVE-0-2026-98861)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
unregister_fprobe() and unregister_fprobe_async() (used by BPF
kprobe-multi) rely on standard RCU grace periods (synchronize_rcu()
and call_rcu()) to wait until in-flight fprobe handlers complete before
freeing the fprobe.
However, if an fprobe handler executes while RCU is not watching (such
as in the idle loop or nohz_full extended quiescent states), standard
RCU does not track preemption-disabled sections. Consequently,
synchronize_rcu() does not wait for those executions, which can lead
to a use-after-free if the fprobe is freed immediately after
unregistration. Ensure handlers exit early when !rcu_is_watching().
Furthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously
used guard(rcu)() and rcu_read_lock(), which invoke lockdep on every
hit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep
recursion if probed functions interact with lockdep.
Since rhltable_lookup() and rhl_for_each_entry_rcu() use
rcu_dereference_all_check() (which checks rcu_read_lock_any_held()),
holding preemption disabled via rcu_read_lock_sched_notrace() is fully
valid and sufficient so long as rcu_is_watching() is true.
Define and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),
fprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path
rcu_read_lock() and lockdep overhead while guaranteeing safe grace
period synchronization.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
56b4cfcf1518245493c60fd39c56978f508f1816 , < a85d0f00671b4d4527317c10ba018680f7d8d673
(git)
Affected: 657b594b2084b39a4bc6d8493aa2140cb00cea49 , < dd4a0d4993633b45470abf6da4ea0ca563402245 (git) Affected: 657b594b2084b39a4bc6d8493aa2140cb00cea49 , < e0a6249190402a28f1e2925a81acf573157d55ef (git) Affected: a4f6a9005ed6cfd360ef2520430927f05f92ffb0 (git) Affected: 6.18.34 , < 6.18.56 (semver) Affected: 7.0.11 , < 7.1 (semver) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/fprobe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a85d0f00671b4d4527317c10ba018680f7d8d673",
"status": "affected",
"version": "56b4cfcf1518245493c60fd39c56978f508f1816",
"versionType": "git"
},
{
"lessThan": "dd4a0d4993633b45470abf6da4ea0ca563402245",
"status": "affected",
"version": "657b594b2084b39a4bc6d8493aa2140cb00cea49",
"versionType": "git"
},
{
"lessThan": "e0a6249190402a28f1e2925a81acf573157d55ef",
"status": "affected",
"version": "657b594b2084b39a4bc6d8493aa2140cb00cea49",
"versionType": "git"
},
{
"status": "affected",
"version": "a4f6a9005ed6cfd360ef2520430927f05f92ffb0",
"versionType": "git"
},
{
"lessThan": "6.18.56",
"status": "affected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/fprobe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.18.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe handlers complete before\nfreeing the fprobe.\n\nHowever, if an fprobe handler executes while RCU is not watching (such\nas in the idle loop or nohz_full extended quiescent states), standard\nRCU does not track preemption-disabled sections. Consequently,\nsynchronize_rcu() does not wait for those executions, which can lead\nto a use-after-free if the fprobe is freed immediately after\nunregistration. Ensure handlers exit early when !rcu_is_watching().\n\nFurthermore, fprobe_fgraph_entry() and fprobe_ftrace_entry() previously\nused guard(rcu)() and rcu_read_lock(), which invoke lockdep on every\nhit under CONFIG_PROVE_LOCKING. This adds overhead and can cause lockdep\nrecursion if probed functions interact with lockdep.\n\nSince rhltable_lookup() and rhl_for_each_entry_rcu() use\nrcu_dereference_all_check() (which checks rcu_read_lock_any_held()),\nholding preemption disabled via rcu_read_lock_sched_notrace() is fully\nvalid and sufficient so long as rcu_is_watching() is true.\n\nDefine and use guard(rcu_sched_notrace)() across fprobe_ftrace_entry(),\nfprobe_fgraph_entry(), and fprobe_return(). This eliminates fast-path\nrcu_read_lock() and lockdep overhead while guaranteeing safe grace\nperiod synchronization."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:22.271Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a85d0f00671b4d4527317c10ba018680f7d8d673"
},
{
"url": "https://git.kernel.org/stable/c/dd4a0d4993633b45470abf6da4ea0ca563402245"
},
{
"url": "https://git.kernel.org/stable/c/e0a6249190402a28f1e2925a81acf573157d55ef"
}
],
"title": "fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98861",
"datePublished": "2026-10-18T15:51:22.271Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:22.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98860 (GCVE-0-2026-98860)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
As reported by Sashiko:
If a transport driver encounters a hardware error and returns a negative
error code such as -EPIPE, ret is implicitly promoted to size_t when
compared against size. This causes the negative error code to evaluate
as a large positive number, making the (ret > size) condition true.
This silently converts the hardware error into a success return value
and copies the unmodified buffer back, which could leave BPF programs
operating on uninitialized or stale data.
Fix this by casting size into ssize_t to return the actual negative
error code.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d6efaa50af62fb0790dd1fd4e7e5506b46312510 , < 8b85ef0f561039e249c3f883c5280a1449c6dbee
(git)
Affected: 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 , < 97be6396817bd3b11d06239010d27902940bfaa9 (git) Affected: 2b658c1c442ec1cd9eec5ead98d68662c40fe645 , < f9f808227554b2c116fd07dd2328ecd74ea3f411 (git) Affected: 2b658c1c442ec1cd9eec5ead98d68662c40fe645 , < 3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c (git) Affected: eb57dae20fdf6f3069cdc07821fa3bb46de381d7 (git) Affected: 6.12.78 , < 6.12.113 (semver) Affected: 6.18.20 , < 6.18.56 (semver) Affected: 6.19.10 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/bpf/hid_bpf_dispatch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8b85ef0f561039e249c3f883c5280a1449c6dbee",
"status": "affected",
"version": "d6efaa50af62fb0790dd1fd4e7e5506b46312510",
"versionType": "git"
},
{
"lessThan": "97be6396817bd3b11d06239010d27902940bfaa9",
"status": "affected",
"version": "73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1",
"versionType": "git"
},
{
"lessThan": "f9f808227554b2c116fd07dd2328ecd74ea3f411",
"status": "affected",
"version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645",
"versionType": "git"
},
{
"lessThan": "3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c",
"status": "affected",
"version": "2b658c1c442ec1cd9eec5ead98d68662c40fe645",
"versionType": "git"
},
{
"status": "affected",
"version": "eb57dae20fdf6f3069cdc07821fa3bb46de381d7",
"versionType": "git"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThan": "6.18.56",
"status": "affected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/bpf/hid_bpf_dispatch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.18.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against size. This causes the negative error code to evaluate\nas a large positive number, making the (ret \u003e size) condition true.\n\nThis silently converts the hardware error into a success return value\nand copies the unmodified buffer back, which could leave BPF programs\noperating on uninitialized or stale data.\n\nFix this by casting size into ssize_t to return the actual negative\nerror code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:21.403Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b85ef0f561039e249c3f883c5280a1449c6dbee"
},
{
"url": "https://git.kernel.org/stable/c/97be6396817bd3b11d06239010d27902940bfaa9"
},
{
"url": "https://git.kernel.org/stable/c/f9f808227554b2c116fd07dd2328ecd74ea3f411"
},
{
"url": "https://git.kernel.org/stable/c/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c"
}
],
"title": "HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98860",
"datePublished": "2026-10-18T15:51:21.403Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:21.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98859 (GCVE-0-2026-98859)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
HID: multitouch: stop the release timer from being rearmed on remove
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: multitouch: stop the release timer from being rearmed on remove
mt_remove() quiesces the sticky-finger timer before stopping the
hardware:
timer_delete_sync(&td->release_timer);
sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group);
hid_hw_stop(hdev);
timer_delete_sync() waits for a running callback and dequeues the timer,
but it does not stop the timer from being armed again. The transport is
still delivering reports at that point, and the report path rearms it:
if (app->quirks & MT_QUIRK_STICKY_FINGERS) {
if (td->mt_io_flags & MT_IO_SLOTS_MASK)
mod_timer(&td->release_timer,
jiffies + msecs_to_jiffies(100));
A report that arrives after timer_delete_sync() has returned therefore
leaves the timer queued. td is allocated with devm_kzalloc() against
hdev->dev, so it is freed when the driver is unbound, after mt_remove()
returns. When the timer fires afterwards, mt_expired_timeout()
dereferences the freed td:
struct mt_device *td = timer_container_of(td, t, release_timer);
struct hid_device *hdev = td->hdev;
if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
Simply moving the teardown after hid_hw_stop() does not fix this on its
own, because mt_expired_timeout() calls mt_release_contacts(), which
walks hdev->inputs; the timer still has to be quiesced before
hid_hw_stop() tears the input devices down.
Use timer_shutdown_sync() instead, which additionally makes any later
mod_timer() a no-op, so neither ordering constraint has to be traded off
against the other. This is the final-teardown pattern the function was
introduced for, and hid-wiimote already uses it for the same reason.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4f4001bc76fd1a138a501fbd3d68cce72cbf96ce , < 1f1bd9a3117f082eb891c0986c4f0e04cd974c9a
(git)
Affected: 4f4001bc76fd1a138a501fbd3d68cce72cbf96ce , < 0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787 (git) Affected: 4f4001bc76fd1a138a501fbd3d68cce72cbf96ce , < a0125ca86e405b8a704e96157a6c10ca51087652 (git) Affected: 4f4001bc76fd1a138a501fbd3d68cce72cbf96ce , < 5acb2dace582f061aab5e14c399ac9480315f44b (git) |
|
| Linux | Linux |
Affected:
4.13
Unaffected: 0 , < 4.13 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-multitouch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f1bd9a3117f082eb891c0986c4f0e04cd974c9a",
"status": "affected",
"version": "4f4001bc76fd1a138a501fbd3d68cce72cbf96ce",
"versionType": "git"
},
{
"lessThan": "0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787",
"status": "affected",
"version": "4f4001bc76fd1a138a501fbd3d68cce72cbf96ce",
"versionType": "git"
},
{
"lessThan": "a0125ca86e405b8a704e96157a6c10ca51087652",
"status": "affected",
"version": "4f4001bc76fd1a138a501fbd3d68cce72cbf96ce",
"versionType": "git"
},
{
"lessThan": "5acb2dace582f061aab5e14c399ac9480315f44b",
"status": "affected",
"version": "4f4001bc76fd1a138a501fbd3d68cce72cbf96ce",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-multitouch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: stop the release timer from being rearmed on remove\n\nmt_remove() quiesces the sticky-finger timer before stopping the\nhardware:\n\n timer_delete_sync(\u0026td-\u003erelease_timer);\n\n sysfs_remove_group(\u0026hdev-\u003edev.kobj, \u0026mt_attribute_group);\n hid_hw_stop(hdev);\n\ntimer_delete_sync() waits for a running callback and dequeues the timer,\nbut it does not stop the timer from being armed again. The transport is\nstill delivering reports at that point, and the report path rearms it:\n\n if (app-\u003equirks \u0026 MT_QUIRK_STICKY_FINGERS) {\n if (td-\u003emt_io_flags \u0026 MT_IO_SLOTS_MASK)\n mod_timer(\u0026td-\u003erelease_timer,\n jiffies + msecs_to_jiffies(100));\n\nA report that arrives after timer_delete_sync() has returned therefore\nleaves the timer queued. td is allocated with devm_kzalloc() against\nhdev-\u003edev, so it is freed when the driver is unbound, after mt_remove()\nreturns. When the timer fires afterwards, mt_expired_timeout()\ndereferences the freed td:\n\n struct mt_device *td = timer_container_of(td, t, release_timer);\n struct hid_device *hdev = td-\u003ehdev;\n\n if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, \u0026td-\u003emt_io_flags))\n\nSimply moving the teardown after hid_hw_stop() does not fix this on its\nown, because mt_expired_timeout() calls mt_release_contacts(), which\nwalks hdev-\u003einputs; the timer still has to be quiesced before\nhid_hw_stop() tears the input devices down.\n\nUse timer_shutdown_sync() instead, which additionally makes any later\nmod_timer() a no-op, so neither ordering constraint has to be traded off\nagainst the other. This is the final-teardown pattern the function was\nintroduced for, and hid-wiimote already uses it for the same reason."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:20.456Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f1bd9a3117f082eb891c0986c4f0e04cd974c9a"
},
{
"url": "https://git.kernel.org/stable/c/0c19a6c1d25fd5ed66d1f80dc6f6e56cc1f0a787"
},
{
"url": "https://git.kernel.org/stable/c/a0125ca86e405b8a704e96157a6c10ca51087652"
},
{
"url": "https://git.kernel.org/stable/c/5acb2dace582f061aab5e14c399ac9480315f44b"
}
],
"title": "HID: multitouch: stop the release timer from being rearmed on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98859",
"datePublished": "2026-10-18T15:51:20.456Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:20.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98858 (GCVE-0-2026-98858)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
io_uring: fix task_work add use-after-free with SQPOLL
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix task_work add use-after-free with SQPOLL
For SQPOLL, the sqpoll thread runs task_work off its own list and
doesn't need to be told about it, so it can pop and complete a request
as soon as mpscq_push() has published it. If that was the last request
holding the ring alive, io_ring_exit_work() then frees the ctx, stops
the thread, and with it the tctx, while io_req_normal_work_add() is
still looking at both after the push:
BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510
Read of size 4 at addr ff11000000ca0000 by task repro/55
(...)
BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70
Write of size 8 at addr ff11000000c3bd00 by task repro/55
Hold an RCU read lock across the add, like io_req_local_work_add() already
does, and have io_ring_exit_work() wait for a grace period for SQPOLL rings
as well before freeing the ctx.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
af5d68f8892f8ee8f137648b79ceb2abc153a19b , < 42b3332efacfd2140be4cd0dedad4fb96b8ae90e
(git)
Affected: af5d68f8892f8ee8f137648b79ceb2abc153a19b , < 891bd8335a0de3bb15c3b797ce3026bbb0dbef6c (git) Affected: af5d68f8892f8ee8f137648b79ceb2abc153a19b , < 395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3 (git) Affected: af5d68f8892f8ee8f137648b79ceb2abc153a19b , < a92193c91e8839fe5fc209616ea95465ae4b919d (git) |
|
| Linux | Linux |
Affected:
6.9
Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/io_uring.c",
"io_uring/tw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "42b3332efacfd2140be4cd0dedad4fb96b8ae90e",
"status": "affected",
"version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
"versionType": "git"
},
{
"lessThan": "891bd8335a0de3bb15c3b797ce3026bbb0dbef6c",
"status": "affected",
"version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
"versionType": "git"
},
{
"lessThan": "395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3",
"status": "affected",
"version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
"versionType": "git"
},
{
"lessThan": "a92193c91e8839fe5fc209616ea95465ae4b919d",
"status": "affected",
"version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/io_uring.c",
"io_uring/tw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix task_work add use-after-free with SQPOLL\n\nFor SQPOLL, the sqpoll thread runs task_work off its own list and\ndoesn\u0027t need to be told about it, so it can pop and complete a request\nas soon as mpscq_push() has published it. If that was the last request\nholding the ring alive, io_ring_exit_work() then frees the ctx, stops\nthe thread, and with it the tctx, while io_req_normal_work_add() is\nstill looking at both after the push:\n\n BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510\n Read of size 4 at addr ff11000000ca0000 by task repro/55\n (...)\n BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70\n Write of size 8 at addr ff11000000c3bd00 by task repro/55\n\nHold an RCU read lock across the add, like io_req_local_work_add() already\ndoes, and have io_ring_exit_work() wait for a grace period for SQPOLL rings\nas well before freeing the ctx."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:19.578Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/42b3332efacfd2140be4cd0dedad4fb96b8ae90e"
},
{
"url": "https://git.kernel.org/stable/c/891bd8335a0de3bb15c3b797ce3026bbb0dbef6c"
},
{
"url": "https://git.kernel.org/stable/c/395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3"
},
{
"url": "https://git.kernel.org/stable/c/a92193c91e8839fe5fc209616ea95465ae4b919d"
}
],
"title": "io_uring: fix task_work add use-after-free with SQPOLL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98858",
"datePublished": "2026-10-18T15:51:19.578Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:19.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98857 (GCVE-0-2026-98857)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
ipvs: bound LBLCR and LBLC cache growth
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: bound LBLCR and LBLC cache growth
ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for
every previously unseen destination address. The table max_size only
tells the periodic collector to reclaim entries after the cache has
already exceeded the limit. It does not reclaim entries that the
attacker continues to use.
Reject new cache entries once either table reaches max_size * 3 / 2.
The extra headroom lets the periodic collector catch up while the
existing scheduler fallback continues to use the selected destination
when cache creation fails. New traffic therefore stays serviceable
without growing the tables further.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 31028d7b970962fbeda1e9131405c76551094300
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6316d17324bd4ca400c26adb7b656c6e3447c209 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 16c83c047ecfaf226ad81d45d77fa11a3184d0e4 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2a3c3de660f96865f303fd25f1285f2ffbfd521d (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_lblc.c",
"net/netfilter/ipvs/ip_vs_lblcr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "31028d7b970962fbeda1e9131405c76551094300",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6316d17324bd4ca400c26adb7b656c6e3447c209",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "16c83c047ecfaf226ad81d45d77fa11a3184d0e4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2a3c3de660f96865f303fd25f1285f2ffbfd521d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_lblc.c",
"net/netfilter/ipvs/ip_vs_lblcr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic therefore stays serviceable\nwithout growing the tables further."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:17.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300"
},
{
"url": "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209"
},
{
"url": "https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4"
},
{
"url": "https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d"
}
],
"title": "ipvs: bound LBLCR and LBLC cache growth",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98857",
"datePublished": "2026-10-18T15:51:17.262Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:17.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98856 (GCVE-0-2026-98856)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
kprobes: Skip disarmed probes when checking optkprobe overlap
Summary
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Skip disarmed probes when checking optkprobe overlap
On x86, an optkprobe at A replaces five bytes with a jump. If a disabled
probe B is at A+2, get_optimized_kprobe() stops at B when arming a new
probe C at A+4. It leaves A optimized:
A A+1 A+2 A+3 A+4
A's jump | e9 | d0 | d1 | d2 | d3 |
after C | e9 | d0 | d1 | d2 | cc |
The INT3 for C overwrites the last byte of A's jump displacement, so
execution can jump to the wrong address. B can have prepared optinsns
while disarmed, but has no jump to unoptimize.
Continue past disarmed and unprepared probes to find the active optimized
probe before arming a probe in its jump.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
afd66255b9a48f5851326ddae50e2203fbf71dc9 , < 985a568171e7bdba6dcde3420d0e5bb515813457
(git)
Affected: afd66255b9a48f5851326ddae50e2203fbf71dc9 , < 6745fa65f4115045431c0c15610e876855a04625 (git) Affected: afd66255b9a48f5851326ddae50e2203fbf71dc9 , < 526fac219e8b7d3369b43026bd0a1df51b811cd4 (git) Affected: afd66255b9a48f5851326ddae50e2203fbf71dc9 , < 7a39c732a22ec4a369af9e19fbe3d666ec83eec4 (git) |
|
| Linux | Linux |
Affected:
2.6.34
Unaffected: 0 , < 2.6.34 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/kprobes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "985a568171e7bdba6dcde3420d0e5bb515813457",
"status": "affected",
"version": "afd66255b9a48f5851326ddae50e2203fbf71dc9",
"versionType": "git"
},
{
"lessThan": "6745fa65f4115045431c0c15610e876855a04625",
"status": "affected",
"version": "afd66255b9a48f5851326ddae50e2203fbf71dc9",
"versionType": "git"
},
{
"lessThan": "526fac219e8b7d3369b43026bd0a1df51b811cd4",
"status": "affected",
"version": "afd66255b9a48f5851326ddae50e2203fbf71dc9",
"versionType": "git"
},
{
"lessThan": "7a39c732a22ec4a369af9e19fbe3d666ec83eec4",
"status": "affected",
"version": "afd66255b9a48f5851326ddae50e2203fbf71dc9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/kprobes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip disarmed probes when checking optkprobe overlap\n\nOn x86, an optkprobe at A replaces five bytes with a jump. If a disabled\nprobe B is at A+2, get_optimized_kprobe() stops at B when arming a new\nprobe C at A+4. It leaves A optimized:\n\n A A+1 A+2 A+3 A+4\n A\u0027s jump | e9 | d0 | d1 | d2 | d3 |\n after C | e9 | d0 | d1 | d2 | cc |\n\nThe INT3 for C overwrites the last byte of A\u0027s jump displacement, so\nexecution can jump to the wrong address. B can have prepared optinsns\nwhile disarmed, but has no jump to unoptimize.\n\nContinue past disarmed and unprepared probes to find the active optimized\nprobe before arming a probe in its jump."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:12.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/985a568171e7bdba6dcde3420d0e5bb515813457"
},
{
"url": "https://git.kernel.org/stable/c/6745fa65f4115045431c0c15610e876855a04625"
},
{
"url": "https://git.kernel.org/stable/c/526fac219e8b7d3369b43026bd0a1df51b811cd4"
},
{
"url": "https://git.kernel.org/stable/c/7a39c732a22ec4a369af9e19fbe3d666ec83eec4"
}
],
"title": "kprobes: Skip disarmed probes when checking optkprobe overlap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98856",
"datePublished": "2026-10-18T15:51:12.359Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:12.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98855 (GCVE-0-2026-98855)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
of/overlay: put property on deadprops only after changeset add succeeds
Summary
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: put property on deadprops only after changeset add succeeds
add_changeset_property() links a new property of a not-yet-live
target node into the node's deadprops list before handing it to
of_changeset_add_property(). If that fails, the error path frees the
property but leaves the freed pointer linked in deadprops, and
of_node_release() frees it a second time when the aborted overlay's
node is released.
Record the changeset entry first and link the property into deadprops
only on success. of_changeset_add_property() never looks at the
node's property lists, so the order of the two steps is otherwise
immaterial, and the error path frees a property that nothing
references.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f96278810150fc39085d1872e5b39ea06366d03e , < d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a
(git)
Affected: f96278810150fc39085d1872e5b39ea06366d03e , < 7dc6a769153c0457077a0da4888a00f61e66de15 (git) Affected: f96278810150fc39085d1872e5b39ea06366d03e , < 5857035a3b53a4e7b5a0d5a740189901ece0b079 (git) Affected: f96278810150fc39085d1872e5b39ea06366d03e , < 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c (git) Affected: b52ca352489be8beb7de3a8181509a0deaf72e21 (git) Affected: 4.19.49 , < 4.20 (semver) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/of/overlay.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a",
"status": "affected",
"version": "f96278810150fc39085d1872e5b39ea06366d03e",
"versionType": "git"
},
{
"lessThan": "7dc6a769153c0457077a0da4888a00f61e66de15",
"status": "affected",
"version": "f96278810150fc39085d1872e5b39ea06366d03e",
"versionType": "git"
},
{
"lessThan": "5857035a3b53a4e7b5a0d5a740189901ece0b079",
"status": "affected",
"version": "f96278810150fc39085d1872e5b39ea06366d03e",
"versionType": "git"
},
{
"lessThan": "814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c",
"status": "affected",
"version": "f96278810150fc39085d1872e5b39ea06366d03e",
"versionType": "git"
},
{
"status": "affected",
"version": "b52ca352489be8beb7de3a8181509a0deaf72e21",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.49",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/of/overlay.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.49",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: put property on deadprops only after changeset add succeeds\n\nadd_changeset_property() links a new property of a not-yet-live\ntarget node into the node\u0027s deadprops list before handing it to\nof_changeset_add_property(). If that fails, the error path frees the\nproperty but leaves the freed pointer linked in deadprops, and\nof_node_release() frees it a second time when the aborted overlay\u0027s\nnode is released.\n\nRecord the changeset entry first and link the property into deadprops\nonly on success. of_changeset_add_property() never looks at the\nnode\u0027s property lists, so the order of the two steps is otherwise\nimmaterial, and the error path frees a property that nothing\nreferences."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:09.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a"
},
{
"url": "https://git.kernel.org/stable/c/7dc6a769153c0457077a0da4888a00f61e66de15"
},
{
"url": "https://git.kernel.org/stable/c/5857035a3b53a4e7b5a0d5a740189901ece0b079"
},
{
"url": "https://git.kernel.org/stable/c/814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c"
}
],
"title": "of/overlay: put property on deadprops only after changeset add succeeds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98855",
"datePublished": "2026-10-18T15:51:09.970Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:09.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98854 (GCVE-0-2026-98854)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
of/overlay: only treat a positive changeset id as registered
Summary
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: only treat a positive changeset id as registered
of_overlay_fdt_apply() stores the idr_alloc() return value in
ovcs->id before checking it. On failure the stored id is negative,
free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove()
is called with a negative id and list_del() runs on ovcs->ovcs_list,
which is not initialized until after the id allocation. An allocation
failure at that point dereferences NULL.
Make free_overlay_changeset() treat only a strict-positive id as
registered. The rest of the function already copes with a
partially-initialized ovcs, so the error path stays a plain
goto err_free_ovcs.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
61b4de4e0b384f4a22c55c3bada604da49cec4e1 , < c08a54df9d33dcd6ff089adc9434b2c008af3a39
(git)
Affected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 , < 0d1525fdcd3355672b7485d61e55df6824ab5ad1 (git) Affected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 , < c875407c34dadaef0599834ad9c815f4c9f50d15 (git) Affected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 , < 44081d708b5b885487bac792db78324b7b4c267d (git) |
|
| Linux | Linux |
Affected:
4.15
Unaffected: 0 , < 4.15 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/of/overlay.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c08a54df9d33dcd6ff089adc9434b2c008af3a39",
"status": "affected",
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"versionType": "git"
},
{
"lessThan": "0d1525fdcd3355672b7485d61e55df6824ab5ad1",
"status": "affected",
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"versionType": "git"
},
{
"lessThan": "c875407c34dadaef0599834ad9c815f4c9f50d15",
"status": "affected",
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"versionType": "git"
},
{
"lessThan": "44081d708b5b885487bac792db78324b7b4c267d",
"status": "affected",
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/of/overlay.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs-\u003eid before checking it. On failure the stored id is negative,\nfree_overlay_changeset()\u0027s \"if (ovcs-\u003eid)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs-\u003eovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\n\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initialized ovcs, so the error path stays a plain\ngoto err_free_ovcs."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:06.167Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39"
},
{
"url": "https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1"
},
{
"url": "https://git.kernel.org/stable/c/c875407c34dadaef0599834ad9c815f4c9f50d15"
},
{
"url": "https://git.kernel.org/stable/c/44081d708b5b885487bac792db78324b7b4c267d"
}
],
"title": "of/overlay: only treat a positive changeset id as registered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98854",
"datePublished": "2026-10-18T15:51:06.167Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:06.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98853 (GCVE-0-2026-98853)
Vulnerability from nvd – Published: 2026-10-18 15:51 – Updated: 2026-10-18 15:51
VLAI
EPSS
VEX
Title
net: gso: limit recursive IP-in-IP segmentation
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: gso: limit recursive IP-in-IP segmentation
IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()
for each nested IP header. encap_level tracks header bytes, not callback
depth, so a deep chain can exhaust the kernel stack. Making
inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP
GSO/TSO later made the path reachable. The IPv6 stackable path was
introduced separately and uses the same guard.
Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once
per top-level GSO operation and preserved across GRE/UDP context changes.
Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first
five entries pass, and the sixth returns -EINVAL before dispatching
another GSO callback.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3347c960295583eee3fd58e5c539fb1972fbc005 , < c949646c900e879afce47df1b607fa320eb63bf2
(git)
Affected: 3347c960295583eee3fd58e5c539fb1972fbc005 , < 006c8b834aed8b02bd8fb9fb05e9e7ead37d1763 (git) |
|
| Linux | Linux |
Affected:
3.13
Unaffected: 0 , < 3.13 (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/gso.h",
"net/core/gso.c",
"net/ipv4/af_inet.c",
"net/ipv6/ip6_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c949646c900e879afce47df1b607fa320eb63bf2",
"status": "affected",
"version": "3347c960295583eee3fd58e5c539fb1972fbc005",
"versionType": "git"
},
{
"lessThan": "006c8b834aed8b02bd8fb9fb05e9e7ead37d1763",
"status": "affected",
"version": "3347c960295583eee3fd58e5c539fb1972fbc005",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/gso.h",
"net/core/gso.c",
"net/ipv4/af_inet.c",
"net/ipv6/ip6_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:51:02.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2"
},
{
"url": "https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"
}
],
"title": "net: gso: limit recursive IP-in-IP segmentation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98853",
"datePublished": "2026-10-18T15:51:02.683Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:51:02.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98852 (GCVE-0-2026-98852)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
net: extend IPv6 exthdr detection of tunneled packets
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: extend IPv6 exthdr detection of tunneled packets
Commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM
GSO fallback") split skb_gso_has_extension_hdr() into mutually exclusive
branches on skb->encapsulation. This did not yet address all paths:
1. With skb->encapsulation set, the outer header is not checked. IPv6
tunnels such as ip6_gre and ip6_tunnel add an outer Destination
Options header by default (encap_limit). Their GSO packets skip
software GSO, then skb_csum_hwoffload_help() sees the outer extension
header and calls skb_checksum_help() on the GSO skb, which warns and
drops it.
2. Tunnels over IPv6 without an outer transport header, such as
ip6_tunnel, leave skb->transport_header at the inner transport
header. skb_network_header_len() then spans the outer IPv6, tunnel
and inner IP headers, a false positive.
3. UDP tunnels without an inner network header, such as SCTP-in-UDP or
PSP, have no inner IPv6 header to check. Decide on the outer header
alone.
4. Directly dereferencing inner_ip_hdr(skb)->version without
skb_header_pointer() is unsafe.
Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if
set, on the inner IPv6 header. Read the headers with skb_header_pointer().
Keep the skb_network_header_len() check when !skb->encapsulation to also
catch encapsulated packets without skb->encapsulation (e.g., virtio).
Use the same helper in skb_csum_hwoffload_help(). Its open coded test
has the false positive of (2) and ignores the inner header.
Background: checksum offload of tunneled packets invariants:
Non-GSO skb:
- If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes
the outer checksum in software and the device offloads only the inner L4
checksum.
- If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP,
Remote Checksum Offload), the device offloads the outer UDP or GRE
checksum instead.
GSO skb:
- A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM
computes both inner and outer checksums per segment.
The outer checksum is seeded with only the pseudo-header checksum.
A NETIF_F_IPV6_CSUM device must parse through the outer headers to
reach the inner ones.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
33670f780e0120c3dacda188c512bbffe0b6044c , < 44ba9dc568c878b699d05e7cf699572dc9df4b59
(git)
Affected: a98b78116a27e2a57b696b569b2cb431c95cf9b6 , < aa480f05aed7a9eee87d4a6fc90647fe9679c670 (git) Affected: c4336a07eb6b2526dc2b62928b5104b41a7f81f5 , < cabacdf98e09eb74599c4d97d7bd7fd659598fb7 (git) Affected: c4336a07eb6b2526dc2b62928b5104b41a7f81f5 , < 5f0764cb1c81a9712bce605d38efe6d844a70b29 (git) Affected: 2094a7cf91b71367b649f991aacc7b579f793d0b (git) Affected: ed71cf465c75f5688b07a35d373cd1d6b589c8ea (git) Affected: 732fdeb2987c94b439d51f5cb9addddc2fc48c42 (git) Affected: 6.12.81 , < 6.12.113 (semver) Affected: 6.18.22 , < 6.18.56 (semver) Affected: 6.1.168 , < 6.2 (semver) Affected: 6.6.134 , < 6.7 (semver) Affected: 6.19.12 , < 6.20 (semver) |
|
| Linux | Linux |
Affected:
7.0
Unaffected: 0 , < 7.0 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44ba9dc568c878b699d05e7cf699572dc9df4b59",
"status": "affected",
"version": "33670f780e0120c3dacda188c512bbffe0b6044c",
"versionType": "git"
},
{
"lessThan": "aa480f05aed7a9eee87d4a6fc90647fe9679c670",
"status": "affected",
"version": "a98b78116a27e2a57b696b569b2cb431c95cf9b6",
"versionType": "git"
},
{
"lessThan": "cabacdf98e09eb74599c4d97d7bd7fd659598fb7",
"status": "affected",
"version": "c4336a07eb6b2526dc2b62928b5104b41a7f81f5",
"versionType": "git"
},
{
"lessThan": "5f0764cb1c81a9712bce605d38efe6d844a70b29",
"status": "affected",
"version": "c4336a07eb6b2526dc2b62928b5104b41a7f81f5",
"versionType": "git"
},
{
"status": "affected",
"version": "2094a7cf91b71367b649f991aacc7b579f793d0b",
"versionType": "git"
},
{
"status": "affected",
"version": "ed71cf465c75f5688b07a35d373cd1d6b589c8ea",
"versionType": "git"
},
{
"status": "affected",
"version": "732fdeb2987c94b439d51f5cb9addddc2fc48c42",
"versionType": "git"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThan": "6.18.56",
"status": "affected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.18.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.134",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: extend IPv6 exthdr detection of tunneled packets\n\nCommit c4336a07eb6b (\"net: correctly handle tunneled traffic on IPV6_CSUM\nGSO fallback\") split skb_gso_has_extension_hdr() into mutually exclusive\nbranches on skb-\u003eencapsulation. This did not yet address all paths:\n\n1. With skb-\u003eencapsulation set, the outer header is not checked. IPv6\n tunnels such as ip6_gre and ip6_tunnel add an outer Destination\n Options header by default (encap_limit). Their GSO packets skip\n software GSO, then skb_csum_hwoffload_help() sees the outer extension\n header and calls skb_checksum_help() on the GSO skb, which warns and\n drops it.\n\n2. Tunnels over IPv6 without an outer transport header, such as\n ip6_tunnel, leave skb-\u003etransport_header at the inner transport\n header. skb_network_header_len() then spans the outer IPv6, tunnel\n and inner IP headers, a false positive.\n\n3. UDP tunnels without an inner network header, such as SCTP-in-UDP or\n PSP, have no inner IPv6 header to check. Decide on the outer header\n alone.\n\n4. Directly dereferencing inner_ip_hdr(skb)-\u003eversion without\n skb_header_pointer() is unsafe.\n\nInstead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if\nset, on the inner IPv6 header. Read the headers with skb_header_pointer().\nKeep the skb_network_header_len() check when !skb-\u003eencapsulation to also\ncatch encapsulated packets without skb-\u003eencapsulation (e.g., virtio).\n\nUse the same helper in skb_csum_hwoffload_help(). Its open coded test\nhas the false positive of (2) and ignores the inner header.\n\nBackground: checksum offload of tunneled packets invariants:\n\nNon-GSO skb:\n- If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes\n the outer checksum in software and the device offloads only the inner L4\n checksum.\n- If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP,\n Remote Checksum Offload), the device offloads the outer UDP or GRE\n checksum instead.\n\nGSO skb:\n- A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM\n computes both inner and outer checksums per segment.\n The outer checksum is seeded with only the pseudo-header checksum.\n\nA NETIF_F_IPV6_CSUM device must parse through the outer headers to\nreach the inner ones."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:55.946Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44ba9dc568c878b699d05e7cf699572dc9df4b59"
},
{
"url": "https://git.kernel.org/stable/c/aa480f05aed7a9eee87d4a6fc90647fe9679c670"
},
{
"url": "https://git.kernel.org/stable/c/cabacdf98e09eb74599c4d97d7bd7fd659598fb7"
},
{
"url": "https://git.kernel.org/stable/c/5f0764cb1c81a9712bce605d38efe6d844a70b29"
}
],
"title": "net: extend IPv6 exthdr detection of tunneled packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98852",
"datePublished": "2026-10-18T15:50:55.946Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:50:55.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98851 (GCVE-0-2026-98851)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
netfilter: nft_flow_offload: drop flowtable reference on init error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_flow_offload: drop flowtable reference on init error path
nft_flow_offload_init() bumps the flowtable use count with
nft_use_inc() before calling nf_ct_netns_get(). When the latter
fails, the error is returned as-is and the reference is leaked.
The upper layers do not balance it either: nf_tables_newexpr()
clears expr->ops when the expression init callback fails, so the
nft_expr_more() iteration in nft_rule_expr_deactivate() and
nf_tables_rule_destroy() stops right before the failed expression
and its ->destroy callback, which would drop the reference, never
runs.
Each failed rule addition therefore leaks one flowtable reference
and the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE
keeps reporting -EBUSY even though no rule references it.
Save the nf_ct_netns_get() return value and undo the nft_use_inc()
when it fails, restoring the inc/dec pairing within
nft_flow_offload_init() itself.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a3c90f7a2323b331ae816d5b0633e68148e25d04 , < 64ac0cb574c740bf723affb79b646eeba920db6b
(git)
Affected: a3c90f7a2323b331ae816d5b0633e68148e25d04 , < c5f91098edee98c015f78488460a0609e62582a5 (git) Affected: a3c90f7a2323b331ae816d5b0633e68148e25d04 , < 4cd378423a33194a773c267fc58606d28fce95cf (git) Affected: a3c90f7a2323b331ae816d5b0633e68148e25d04 , < 747928b5d4ff8c8de55138a54c13980e4bb88578 (git) |
|
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_flow_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "64ac0cb574c740bf723affb79b646eeba920db6b",
"status": "affected",
"version": "a3c90f7a2323b331ae816d5b0633e68148e25d04",
"versionType": "git"
},
{
"lessThan": "c5f91098edee98c015f78488460a0609e62582a5",
"status": "affected",
"version": "a3c90f7a2323b331ae816d5b0633e68148e25d04",
"versionType": "git"
},
{
"lessThan": "4cd378423a33194a773c267fc58606d28fce95cf",
"status": "affected",
"version": "a3c90f7a2323b331ae816d5b0633e68148e25d04",
"versionType": "git"
},
{
"lessThan": "747928b5d4ff8c8de55138a54c13980e4bb88578",
"status": "affected",
"version": "a3c90f7a2323b331ae816d5b0633e68148e25d04",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_flow_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: drop flowtable reference on init error path\n\nnft_flow_offload_init() bumps the flowtable use count with\nnft_use_inc() before calling nf_ct_netns_get(). When the latter\nfails, the error is returned as-is and the reference is leaked.\n\nThe upper layers do not balance it either: nf_tables_newexpr()\nclears expr-\u003eops when the expression init callback fails, so the\nnft_expr_more() iteration in nft_rule_expr_deactivate() and\nnf_tables_rule_destroy() stops right before the failed expression\nand its -\u003edestroy callback, which would drop the reference, never\nruns.\n\nEach failed rule addition therefore leaks one flowtable reference\nand the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE\nkeeps reporting -EBUSY even though no rule references it.\n\nSave the nf_ct_netns_get() return value and undo the nft_use_inc()\nwhen it fails, restoring the inc/dec pairing within\nnft_flow_offload_init() itself."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:50.910Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/64ac0cb574c740bf723affb79b646eeba920db6b"
},
{
"url": "https://git.kernel.org/stable/c/c5f91098edee98c015f78488460a0609e62582a5"
},
{
"url": "https://git.kernel.org/stable/c/4cd378423a33194a773c267fc58606d28fce95cf"
},
{
"url": "https://git.kernel.org/stable/c/747928b5d4ff8c8de55138a54c13980e4bb88578"
}
],
"title": "netfilter: nft_flow_offload: drop flowtable reference on init error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98851",
"datePublished": "2026-10-18T15:50:50.910Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:50:50.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98850 (GCVE-0-2026-98850)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
net/packet: prevent TX_RING byte count overflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/packet: prevent TX_RING byte count overflow
tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds
each valid packet length to the signed int len_sum. Userspace can
recycle completed frames concurrently, so a single blocking send call
is not bounded by the ring size.
After enough successful transmissions len_sum wraps into the negative
range. In particular, 65536 65535-byte frames followed by a 65007-byte
frame produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats
that as an impossible return and triggers a BUG. On systems configured
to panic on oops, a CAP_NET_RAW holder can panic the host kernel.
Stop before the next frame would make the byte count exceed INT_MAX.
The positive short count leaves that frame pending for a later send
call.
A two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build
of Linux 7.3-rc4. With this change, the same reproducer returned the
expected positive short count without an oops.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < be12b221c0301111eeb023be04add3c6ad7c21fe
(git)
Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 69ca64bbb528898916f309552053c32a04a36ebc (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 9fd63d284e251332f4874ef9023cde472f315f86 (git) Affected: 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 , < 2cf81fc9505b148b1b70068303ea6ea4b1212403 (git) |
|
| Linux | Linux |
Affected:
2.6.31
Unaffected: 0 , < 2.6.31 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be12b221c0301111eeb023be04add3c6ad7c21fe",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "69ca64bbb528898916f309552053c32a04a36ebc",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "9fd63d284e251332f4874ef9023cde472f315f86",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
},
{
"lessThan": "2cf81fc9505b148b1b70068303ea6ea4b1212403",
"status": "affected",
"version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on oops, a CAP_NET_RAW holder can panic the host kernel.\n\nStop before the next frame would make the byte count exceed INT_MAX.\nThe positive short count leaves that frame pending for a later send\ncall.\n\nA two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build\nof Linux 7.3-rc4. With this change, the same reproducer returned the\nexpected positive short count without an oops."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:50.062Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be12b221c0301111eeb023be04add3c6ad7c21fe"
},
{
"url": "https://git.kernel.org/stable/c/69ca64bbb528898916f309552053c32a04a36ebc"
},
{
"url": "https://git.kernel.org/stable/c/9fd63d284e251332f4874ef9023cde472f315f86"
},
{
"url": "https://git.kernel.org/stable/c/2cf81fc9505b148b1b70068303ea6ea4b1212403"
}
],
"title": "net/packet: prevent TX_RING byte count overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98850",
"datePublished": "2026-10-18T15:50:50.062Z",
"dateReserved": "2026-09-25T10:25:14.376Z",
"dateUpdated": "2026-10-18T15:50:50.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98849 (GCVE-0-2026-98849)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
pfcp: fix socket lifetime on netdevice registration failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
pfcp: fix socket lifetime on netdevice registration failure
pfcp_newlink() creates the UDP socket before register_netdevice().
If registration fails after pfcp_dev_init() succeeds, the core calls
pfcp_dev_uninit(), which releases the socket and clears pfcp->sk.
The newlink error path then releases it again, causing a NULL pointer
dereference. This was observed with failslab fault injection:
FAULT_INJECTION: forcing a failure.
kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)
BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50
Read of size 8 at addr 0000000000000120 by task ip/1037
Call trace:
show_stack+0x18/0x24 (C)
dump_stack_lvl+0x78/0x90
print_report+0x468/0x5cc
kasan_report+0xa4/0xf0
__asan_load8+0x7c/0xd0
udp_tunnel_sock_release+0x1c/0x50
pfcp_newlink+0x128/0x184
rtnl_newlink+0x848/0xe44
rtnetlink_rcv_msg+0x468/0x514
netlink_rcv_skb+0xc0/0x1f0
rtnetlink_rcv+0x18/0x24
netlink_unicast+0x4b8/0x558
netlink_sendmsg+0x2b8/0x584
...
Return from pfcp_del_sock() if pfcp->sk is NULL.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
76c8764ef36a5d37ea2e551bda28ac7f028383ba , < dcb8f6a79c3360a440c399d85df465a6e59351f1
(git)
Affected: 76c8764ef36a5d37ea2e551bda28ac7f028383ba , < 4b8ce1686dea1a10805a0807bf492409b0300ee1 (git) Affected: 76c8764ef36a5d37ea2e551bda28ac7f028383ba , < 2cee3603ec1d9b5ec7f2121ea3efe9488e906f46 (git) Affected: 76c8764ef36a5d37ea2e551bda28ac7f028383ba , < 0f17d2e3dd9cda3ee6d94033d5e5489af168920d (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/pfcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dcb8f6a79c3360a440c399d85df465a6e59351f1",
"status": "affected",
"version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba",
"versionType": "git"
},
{
"lessThan": "4b8ce1686dea1a10805a0807bf492409b0300ee1",
"status": "affected",
"version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba",
"versionType": "git"
},
{
"lessThan": "2cee3603ec1d9b5ec7f2121ea3efe9488e906f46",
"status": "affected",
"version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba",
"versionType": "git"
},
{
"lessThan": "0f17d2e3dd9cda3ee6d94033d5e5489af168920d",
"status": "affected",
"version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/pfcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: fix socket lifetime on netdevice registration failure\n\npfcp_newlink() creates the UDP socket before register_netdevice().\nIf registration fails after pfcp_dev_init() succeeds, the core calls\npfcp_dev_uninit(), which releases the socket and clears pfcp-\u003esk.\nThe newlink error path then releases it again, causing a NULL pointer\ndereference. This was observed with failslab fault injection:\n\n FAULT_INJECTION: forcing a failure.\n kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)\n BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50\n Read of size 8 at addr 0000000000000120 by task ip/1037\n Call trace:\n show_stack+0x18/0x24 (C)\n dump_stack_lvl+0x78/0x90\n print_report+0x468/0x5cc\n kasan_report+0xa4/0xf0\n __asan_load8+0x7c/0xd0\n udp_tunnel_sock_release+0x1c/0x50\n pfcp_newlink+0x128/0x184\n rtnl_newlink+0x848/0xe44\n rtnetlink_rcv_msg+0x468/0x514\n netlink_rcv_skb+0xc0/0x1f0\n rtnetlink_rcv+0x18/0x24\n netlink_unicast+0x4b8/0x558\n netlink_sendmsg+0x2b8/0x584\n ...\n\nReturn from pfcp_del_sock() if pfcp-\u003esk is NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:48.743Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dcb8f6a79c3360a440c399d85df465a6e59351f1"
},
{
"url": "https://git.kernel.org/stable/c/4b8ce1686dea1a10805a0807bf492409b0300ee1"
},
{
"url": "https://git.kernel.org/stable/c/2cee3603ec1d9b5ec7f2121ea3efe9488e906f46"
},
{
"url": "https://git.kernel.org/stable/c/0f17d2e3dd9cda3ee6d94033d5e5489af168920d"
}
],
"title": "pfcp: fix socket lifetime on netdevice registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98849",
"datePublished": "2026-10-18T15:50:48.743Z",
"dateReserved": "2026-09-25T10:25:14.375Z",
"dateUpdated": "2026-10-18T15:50:48.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98848 (GCVE-0-2026-98848)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
rtc: ac100: Assign .num before accessing .hws
Summary
In the Linux kernel, the following vulnerability has been resolved:
rtc: ac100: Assign .num before accessing .hws
Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero.
This occurs in ac100_rtc_register_clks() due to .num being assigned only
after every clkout clock has been stored in .hws[]. With
CONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC
15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report
during probe, and with CONFIG_UBSAN_TRAP the first store traps.
Initialize .num with AC100_CLKOUT_NUM, the number of elements .hws[] was
allocated with, right after the allocation. That is the value the loop
counter ends up at on the success path anyway, so the provider's
behaviour is unchanged.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f316cdff8d677db9ad9c90acb44c4cd535b0ee27 , < 6bb55381daf1a1bed0657189a1396e7467712525
(git)
Affected: f316cdff8d677db9ad9c90acb44c4cd535b0ee27 , < 160619b38707241e22569f9c983a4b3d0890996a (git) Affected: f316cdff8d677db9ad9c90acb44c4cd535b0ee27 , < ad1bf77039cba83373bf1eff3784655e3e3ed2ab (git) Affected: f316cdff8d677db9ad9c90acb44c4cd535b0ee27 , < 6a4117eee82dd85f11bf898bf66026764011eeb6 (git) |
|
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/rtc/rtc-ac100.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6bb55381daf1a1bed0657189a1396e7467712525",
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"versionType": "git"
},
{
"lessThan": "160619b38707241e22569f9c983a4b3d0890996a",
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"versionType": "git"
},
{
"lessThan": "ad1bf77039cba83373bf1eff3784655e3e3ed2ab",
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"versionType": "git"
},
{
"lessThan": "6a4117eee82dd85f11bf898bf66026764011eeb6",
"status": "affected",
"version": "f316cdff8d677db9ad9c90acb44c4cd535b0ee27",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/rtc/rtc-ac100.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Assign .num before accessing .hws\n\nCommit f316cdff8d67 (\"clk: Annotate struct clk_hw_onecell_data with\n__counted_by\") annotated the hws member of \u0027struct clk_hw_onecell_data\u0027\nwith __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)\nabout the number of elements in .hws[], so that it can warn when .hws[]\nis accessed out of bounds. As noted in that change, the __counted_by\nmember must be initialized with the number of elements before the first\narray access happens, otherwise there will be a warning from each access\nprior to the initialization because the number of elements is zero.\nThis occurs in ac100_rtc_register_clks() due to .num being assigned only\nafter every clkout clock has been stored in .hws[]. With\nCONFIG_UBSAN_BOUNDS and a compiler that implements __counted_by (GCC\n15.1+ or Clang 20.1+), this triggers an array-index-out-of-bounds report\nduring probe, and with CONFIG_UBSAN_TRAP the first store traps.\n\nInitialize .num with AC100_CLKOUT_NUM, the number of elements .hws[] was\nallocated with, right after the allocation. That is the value the loop\ncounter ends up at on the success path anyway, so the provider\u0027s\nbehaviour is unchanged."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:47.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6bb55381daf1a1bed0657189a1396e7467712525"
},
{
"url": "https://git.kernel.org/stable/c/160619b38707241e22569f9c983a4b3d0890996a"
},
{
"url": "https://git.kernel.org/stable/c/ad1bf77039cba83373bf1eff3784655e3e3ed2ab"
},
{
"url": "https://git.kernel.org/stable/c/6a4117eee82dd85f11bf898bf66026764011eeb6"
}
],
"title": "rtc: ac100: Assign .num before accessing .hws",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98848",
"datePublished": "2026-10-18T15:50:47.105Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:47.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98847 (GCVE-0-2026-98847)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
rtc: spear: initialize IRQ state before requesting alarm IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
rtc: spear: initialize IRQ state before requesting alarm IRQ
devm_request_irq() enables the interrupt before it returns, so the handler
may run while probe is still initializing the device. Initialize the MMIO
address and spinlock before requesting the alarm IRQ.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0942a71e435f5198921e8f072540f208f0176542 , < c02aa67ea34a826c2cb1aa65d77cf32fafb7eec3
(git)
Affected: 0942a71e435f5198921e8f072540f208f0176542 , < e0cabda9b6f4dd276c55c40bdbb251e8507ae60e (git) Affected: 0942a71e435f5198921e8f072540f208f0176542 , < cb6d6a7fbff0414b9eed505d17687b4b7e38fee8 (git) Affected: 0942a71e435f5198921e8f072540f208f0176542 , < 055ef5ce9f67a6a3a1363fa663007f8196cc0fb8 (git) |
|
| Linux | Linux |
Affected:
3.0
Unaffected: 0 , < 3.0 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/rtc/rtc-spear.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c02aa67ea34a826c2cb1aa65d77cf32fafb7eec3",
"status": "affected",
"version": "0942a71e435f5198921e8f072540f208f0176542",
"versionType": "git"
},
{
"lessThan": "e0cabda9b6f4dd276c55c40bdbb251e8507ae60e",
"status": "affected",
"version": "0942a71e435f5198921e8f072540f208f0176542",
"versionType": "git"
},
{
"lessThan": "cb6d6a7fbff0414b9eed505d17687b4b7e38fee8",
"status": "affected",
"version": "0942a71e435f5198921e8f072540f208f0176542",
"versionType": "git"
},
{
"lessThan": "055ef5ce9f67a6a3a1363fa663007f8196cc0fb8",
"status": "affected",
"version": "0942a71e435f5198921e8f072540f208f0176542",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/rtc/rtc-spear.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: spear: initialize IRQ state before requesting alarm IRQ\n\ndevm_request_irq() enables the interrupt before it returns, so the handler\nmay run while probe is still initializing the device. Initialize the MMIO\naddress and spinlock before requesting the alarm IRQ."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:40.825Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c02aa67ea34a826c2cb1aa65d77cf32fafb7eec3"
},
{
"url": "https://git.kernel.org/stable/c/e0cabda9b6f4dd276c55c40bdbb251e8507ae60e"
},
{
"url": "https://git.kernel.org/stable/c/cb6d6a7fbff0414b9eed505d17687b4b7e38fee8"
},
{
"url": "https://git.kernel.org/stable/c/055ef5ce9f67a6a3a1363fa663007f8196cc0fb8"
}
],
"title": "rtc: spear: initialize IRQ state before requesting alarm IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98847",
"datePublished": "2026-10-18T15:50:40.825Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:40.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98846 (GCVE-0-2026-98846)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
sctp_wait_for_connect() drops the socket lock while it sleeps. An
out-of-the-blue ABORT can then be processed from the socket backlog and
unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets
RCV_SHUTDOWN, the waiter breaks with err == 0 before checking
asoc->base.dead. Its final sctp_association_put() can then free the
association, leaving sctp_sendmsg_to_asoc() to continue with a dangling
pointer.
Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()
before using the association again. The check only accesses the socket,
so it needs no additional association reference. Return the existing
-ESRCH so that sctp_sendmsg() skips freeing a new association that may
already have been destroyed.
Keep sctp_wait_for_connect() unchanged to preserve its behavior for the
connect() caller.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
668c9beb9020d5834ee9e43c208190a07d2b1928 , < e8f972b1759d26bbefe4c524caae1ed7c8a593bd
(git)
Affected: 668c9beb9020d5834ee9e43c208190a07d2b1928 , < e701345d886e831fb593a0870d69c8c5de6fc938 (git) Affected: 668c9beb9020d5834ee9e43c208190a07d2b1928 , < 222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669 (git) Affected: 668c9beb9020d5834ee9e43c208190a07d2b1928 , < 4f1da630d13de0370e2f6361f961f1c8b384af1c (git) |
|
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8f972b1759d26bbefe4c524caae1ed7c8a593bd",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "e701345d886e831fb593a0870d69c8c5de6fc938",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
},
{
"lessThan": "4f1da630d13de0370e2f6361f961f1c8b384af1c",
"status": "affected",
"version": "668c9beb9020d5834ee9e43c208190a07d2b1928",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd, SHUT_RD) sets\nRCV_SHUTDOWN, the waiter breaks with err == 0 before checking\nasoc-\u003ebase.dead. Its final sctp_association_put() can then free the\nassociation, leaving sctp_sendmsg_to_asoc() to continue with a dangling\npointer.\n\nCheck RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()\nbefore using the association again. The check only accesses the socket,\nso it needs no additional association reference. Return the existing\n-ESRCH so that sctp_sendmsg() skips freeing a new association that may\nalready have been destroyed.\n\nKeep sctp_wait_for_connect() unchanged to preserve its behavior for the\nconnect() caller."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:34.714Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8f972b1759d26bbefe4c524caae1ed7c8a593bd"
},
{
"url": "https://git.kernel.org/stable/c/e701345d886e831fb593a0870d69c8c5de6fc938"
},
{
"url": "https://git.kernel.org/stable/c/222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669"
},
{
"url": "https://git.kernel.org/stable/c/4f1da630d13de0370e2f6361f961f1c8b384af1c"
}
],
"title": "sctp: check RCV_SHUTDOWN after the sendmsg connect wait",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98846",
"datePublished": "2026-10-18T15:50:34.714Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:34.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98845 (GCVE-0-2026-98845)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
tpm: Disable TPM on null key name mismatch
Summary
In the Linux kernel, the following vulnerability has been resolved:
tpm: Disable TPM on null key name mismatch
The null key name check exists to protect against TPM reset attacks, so
a mismatch should stop the device from serving further requests.
Currently it does not disable the chip when it finds a mismatch.
The mismatch is logged:
tpm tpm0: null key integrity check failed
but the chip keeps serving commands:
/ # tpm2_getcap -c properties-fixed
TPM_PT_FAMILY_INDICATOR:
as UINT32: 0x08322e3000
as string: "2.0"
...
tpm2_load_null() where the null key name check is run sets the chip as
disabled only if the rc is non zero. When the mismatch is seen, rc is
zero at that point and it returns success. The other issue is that the
caller expects the null key handle to be populated when the function
returns 0 which it does here without writing the handle and proceeds
assuming the null key handle is valid.
During the test, I noticed that tpm2_start_auth_session() uses the
uninitialized stack value as the key handle since tpm2_load_null()
returns 0 despite the integrity failure and proceeds with
TPM2_CC_START_AUTH_SESS with this value as salt key handle.
Set rc to -ENODEV on the mismatch. The error path then disables the chip
and returns the correct code to the caller.
Tested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making
TPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name
of the re-created null key. The chip is now disabled on the mismatch.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cc7d8594342a25693d40fe96f97e5c6c29ee609c , < a03d0c64cd827a622578623a78defd66b6593b82
(git)
Affected: cc7d8594342a25693d40fe96f97e5c6c29ee609c , < 96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa (git) Affected: cc7d8594342a25693d40fe96f97e5c6c29ee609c , < f6599d8830fe7ddab7334cc17846fd9ac9a7fa50 (git) Affected: cc7d8594342a25693d40fe96f97e5c6c29ee609c , < 015fb29a748342a186f37b602ac70017098c8251 (git) Affected: 294984ce51c19c2af3d0d71e1c8bd589bc86b8e2 (git) Affected: 386c7cc6c06d64cbf36d15c5e2319814765e107c (git) Affected: 6.11.7 , < 6.12 (semver) Affected: 6.11.10 , < 6.12 (semver) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm2-sessions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a03d0c64cd827a622578623a78defd66b6593b82",
"status": "affected",
"version": "cc7d8594342a25693d40fe96f97e5c6c29ee609c",
"versionType": "git"
},
{
"lessThan": "96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa",
"status": "affected",
"version": "cc7d8594342a25693d40fe96f97e5c6c29ee609c",
"versionType": "git"
},
{
"lessThan": "f6599d8830fe7ddab7334cc17846fd9ac9a7fa50",
"status": "affected",
"version": "cc7d8594342a25693d40fe96f97e5c6c29ee609c",
"versionType": "git"
},
{
"lessThan": "015fb29a748342a186f37b602ac70017098c8251",
"status": "affected",
"version": "cc7d8594342a25693d40fe96f97e5c6c29ee609c",
"versionType": "git"
},
{
"status": "affected",
"version": "294984ce51c19c2af3d0d71e1c8bd589bc86b8e2",
"versionType": "git"
},
{
"status": "affected",
"version": "386c7cc6c06d64cbf36d15c5e2319814765e107c",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.7",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm2-sessions.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Disable TPM on null key name mismatch\n\nThe null key name check exists to protect against TPM reset attacks, so\na mismatch should stop the device from serving further requests.\nCurrently it does not disable the chip when it finds a mismatch.\n\nThe mismatch is logged:\n\n tpm tpm0: null key integrity check failed\n\nbut the chip keeps serving commands:\n\n / # tpm2_getcap -c properties-fixed\n TPM_PT_FAMILY_INDICATOR:\n as UINT32: 0x08322e3000\n as string: \"2.0\"\n ...\n\ntpm2_load_null() where the null key name check is run sets the chip as\ndisabled only if the rc is non zero. When the mismatch is seen, rc is\nzero at that point and it returns success. The other issue is that the\ncaller expects the null key handle to be populated when the function\nreturns 0 which it does here without writing the handle and proceeds\nassuming the null key handle is valid.\n\nDuring the test, I noticed that tpm2_start_auth_session() uses the\nuninitialized stack value as the key handle since tpm2_load_null()\nreturns 0 despite the integrity failure and proceeds with\nTPM2_CC_START_AUTH_SESS with this value as salt key handle.\n\nSet rc to -ENODEV on the mismatch. The error path then disables the chip\nand returns the correct code to the caller.\n\nTested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making\nTPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name\nof the re-created null key. The chip is now disabled on the mismatch."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:27.596Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a03d0c64cd827a622578623a78defd66b6593b82"
},
{
"url": "https://git.kernel.org/stable/c/96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa"
},
{
"url": "https://git.kernel.org/stable/c/f6599d8830fe7ddab7334cc17846fd9ac9a7fa50"
},
{
"url": "https://git.kernel.org/stable/c/015fb29a748342a186f37b602ac70017098c8251"
}
],
"title": "tpm: Disable TPM on null key name mismatch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98845",
"datePublished": "2026-10-18T15:50:27.596Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:27.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98844 (GCVE-0-2026-98844)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
netfs: clear post-EOF pagecache when extending a file via write
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: clear post-EOF pagecache when extending a file via write
Fix netfs to erase the contents of a hole created after the EOF by an
ordinary write if dirty data has been previously left there by writes
through an mmapped region. Neither the buffered nor the unbuffered/DIO
write path clears that stale pagecache.
Zero the tail of the folio straddling the EOF before an extending
write. That is the only folio that can hold data written past the EOF
through an mmap, as pages wholly beyond the EOF can't be faulted in.
The folio is zeroed rather than dropped so a concurrent extending write
can't lose data.
Both write paths downgrade the i_rwsem to shared, so extending writes
can run concurrently and the i_size read by the caller may be stale by
the time the folio is locked. Re-read i_size under the folio lock and
clamp the zeroed range up to it, so a racing write that already put
data into the folio isn't clobbered.
Wait for any writeback on the folio to finish before zeroing it so that
the pagecache isn't modified while it may still be read by the transport
during transmission. Honour IOCB_NOWAIT by returning -EAGAIN rather
than blocking on the folio lock, on writeback, or in folio_mkclean()'s
rmap walk when the folio is mapped.
truncate_pagecache() can't be used here: it must be called with the
i_rwsem held exclusively, but these write paths only hold it shared,
and it would block unconditionally, breaking IOCB_NOWAIT.
Callers that hold i_rwsem exclusively for the whole resize (truncate,
setattr, fallocate, clone) exclude any genuine concurrent buffered
writer, so staleness can instead be decided from the folio's dirty
state, as pagecache_isize_extended() already does for filesystems that
serialise writes against truncate/setattr via a single i_rwsem.
Export netfs_clear_stale_post_isize() helper to handle such case.
The helper is required by the CIFS client to fix generic/363.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
153a9961b551101cd38e94e26cd92fbfd198b19b , < f8f7d86b3537e885ee620898a38b749fba8a8456
(git)
Affected: 153a9961b551101cd38e94e26cd92fbfd198b19b , < 98f6a4589e0f5f6cf819b8dd45605efc481c06ce (git) Affected: 153a9961b551101cd38e94e26cd92fbfd198b19b , < a7036a73671fc83d299bc770710fe996d9fef9ca (git) Affected: 153a9961b551101cd38e94e26cd92fbfd198b19b , < 69bf14300b50631e7c2271289d347bbd1b19a06c (git) |
|
| Linux | Linux |
Affected:
6.8
Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/filesystems/netfs_library.rst",
"fs/netfs/buffered_write.c",
"fs/netfs/direct_write.c",
"fs/netfs/internal.h",
"fs/netfs/misc.c",
"include/linux/netfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8f7d86b3537e885ee620898a38b749fba8a8456",
"status": "affected",
"version": "153a9961b551101cd38e94e26cd92fbfd198b19b",
"versionType": "git"
},
{
"lessThan": "98f6a4589e0f5f6cf819b8dd45605efc481c06ce",
"status": "affected",
"version": "153a9961b551101cd38e94e26cd92fbfd198b19b",
"versionType": "git"
},
{
"lessThan": "a7036a73671fc83d299bc770710fe996d9fef9ca",
"status": "affected",
"version": "153a9961b551101cd38e94e26cd92fbfd198b19b",
"versionType": "git"
},
{
"lessThan": "69bf14300b50631e7c2271289d347bbd1b19a06c",
"status": "affected",
"version": "153a9961b551101cd38e94e26cd92fbfd198b19b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/filesystems/netfs_library.rst",
"fs/netfs/buffered_write.c",
"fs/netfs/direct_write.c",
"fs/netfs/internal.h",
"fs/netfs/misc.c",
"include/linux/netfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: clear post-EOF pagecache when extending a file via write\n\nFix netfs to erase the contents of a hole created after the EOF by an\nordinary write if dirty data has been previously left there by writes\nthrough an mmapped region. Neither the buffered nor the unbuffered/DIO\nwrite path clears that stale pagecache.\n\nZero the tail of the folio straddling the EOF before an extending\nwrite. That is the only folio that can hold data written past the EOF\nthrough an mmap, as pages wholly beyond the EOF can\u0027t be faulted in.\nThe folio is zeroed rather than dropped so a concurrent extending write\ncan\u0027t lose data.\n\nBoth write paths downgrade the i_rwsem to shared, so extending writes\ncan run concurrently and the i_size read by the caller may be stale by\nthe time the folio is locked. Re-read i_size under the folio lock and\nclamp the zeroed range up to it, so a racing write that already put\ndata into the folio isn\u0027t clobbered.\n\nWait for any writeback on the folio to finish before zeroing it so that\nthe pagecache isn\u0027t modified while it may still be read by the transport\nduring transmission. Honour IOCB_NOWAIT by returning -EAGAIN rather\nthan blocking on the folio lock, on writeback, or in folio_mkclean()\u0027s\nrmap walk when the folio is mapped.\n\ntruncate_pagecache() can\u0027t be used here: it must be called with the\ni_rwsem held exclusively, but these write paths only hold it shared,\nand it would block unconditionally, breaking IOCB_NOWAIT.\n\nCallers that hold i_rwsem exclusively for the whole resize (truncate,\nsetattr, fallocate, clone) exclude any genuine concurrent buffered\nwriter, so staleness can instead be decided from the folio\u0027s dirty\nstate, as pagecache_isize_extended() already does for filesystems that\nserialise writes against truncate/setattr via a single i_rwsem.\nExport netfs_clear_stale_post_isize() helper to handle such case.\n\nThe helper is required by the CIFS client to fix generic/363."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:25.256Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8f7d86b3537e885ee620898a38b749fba8a8456"
},
{
"url": "https://git.kernel.org/stable/c/98f6a4589e0f5f6cf819b8dd45605efc481c06ce"
},
{
"url": "https://git.kernel.org/stable/c/a7036a73671fc83d299bc770710fe996d9fef9ca"
},
{
"url": "https://git.kernel.org/stable/c/69bf14300b50631e7c2271289d347bbd1b19a06c"
}
],
"title": "netfs: clear post-EOF pagecache when extending a file via write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98844",
"datePublished": "2026-10-18T15:50:25.256Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:25.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98843 (GCVE-0-2026-98843)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
netfs: zero gaps in read-gaps folio to avoid writing back stale data
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: zero gaps in read-gaps folio to avoid writing back stale data
netfs_read_gaps() leaves gaps around a streaming write's dirty region
unread on the server side, so a short/EOF response there left stale
folio content that later got written back.
Zero it after the read completes, not before: netfs_wait_for_read()
returns rreq->transferred once ret >= 0, so build an iterator over the
same bvec array the read used, advance past ret, and zero the rest.
The dirty region already maps to sink pages in that array rather than
the real folio, so this can't touch it, and only the actual shortfall
gets zeroed instead of the whole gap upfront.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < 512eaf01ffabf4258e945016b50df5aed940b705
(git)
Affected: ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < 2a62fe628a877c249c8286b157ee99d82840d9dc (git) Affected: ee4cdf7ba857a894ad1650d6ab77669cbbfa329e , < 8db55c5cd831a786a1a2a2d391aa80354535a353 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "512eaf01ffabf4258e945016b50df5aed940b705",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "2a62fe628a877c249c8286b157ee99d82840d9dc",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "8db55c5cd831a786a1a2a2d391aa80354535a353",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write\u0027s dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.\n\nZero it after the read completes, not before: netfs_wait_for_read()\nreturns rreq-\u003etransferred once ret \u003e= 0, so build an iterator over the\nsame bvec array the read used, advance past ret, and zero the rest.\nThe dirty region already maps to sink pages in that array rather than\nthe real folio, so this can\u0027t touch it, and only the actual shortfall\ngets zeroed instead of the whole gap upfront."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:23.578Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/512eaf01ffabf4258e945016b50df5aed940b705"
},
{
"url": "https://git.kernel.org/stable/c/2a62fe628a877c249c8286b157ee99d82840d9dc"
},
{
"url": "https://git.kernel.org/stable/c/8db55c5cd831a786a1a2a2d391aa80354535a353"
}
],
"title": "netfs: zero gaps in read-gaps folio to avoid writing back stale data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98843",
"datePublished": "2026-10-18T15:50:23.578Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:23.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98842 (GCVE-0-2026-98842)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
module: fix lost error code from codetag_load_module()
Summary
In the Linux kernel, the following vulnerability has been resolved:
module: fix lost error code from codetag_load_module()
If codetag_load_module() fails, err is not set to reflect the failure
and load_module() returns 0 after the module has been torn down.
Also, if the module is a livepatch, mod->klp_info allocated by
copy_module_elf() leaks on this error path. Free it via a new
livepatch_cleanup label.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
044d2aee6c575231ed4a24fb3d119bad0937488b , < 258310d59a82ea4854bfd9138682bbaac1153b19
(git)
Affected: 044d2aee6c575231ed4a24fb3d119bad0937488b , < bfc721eef5c13704efe6864c7da2ad4b0d75f60a (git) Affected: 044d2aee6c575231ed4a24fb3d119bad0937488b , < c79cf15eb35a4c703bf18f8c33c47e80dd660f8e (git) Affected: b6bbbb8ef48dde09c0dbd77121fa0f09b0237fec (git) Affected: 6.15.4 , < 6.16 (semver) |
|
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/module/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "258310d59a82ea4854bfd9138682bbaac1153b19",
"status": "affected",
"version": "044d2aee6c575231ed4a24fb3d119bad0937488b",
"versionType": "git"
},
{
"lessThan": "bfc721eef5c13704efe6864c7da2ad4b0d75f60a",
"status": "affected",
"version": "044d2aee6c575231ed4a24fb3d119bad0937488b",
"versionType": "git"
},
{
"lessThan": "c79cf15eb35a4c703bf18f8c33c47e80dd660f8e",
"status": "affected",
"version": "044d2aee6c575231ed4a24fb3d119bad0937488b",
"versionType": "git"
},
{
"status": "affected",
"version": "b6bbbb8ef48dde09c0dbd77121fa0f09b0237fec",
"versionType": "git"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/module/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: fix lost error code from codetag_load_module()\n\nIf codetag_load_module() fails, err is not set to reflect the failure\nand load_module() returns 0 after the module has been torn down.\n\nAlso, if the module is a livepatch, mod-\u003eklp_info allocated by\ncopy_module_elf() leaks on this error path. Free it via a new\nlivepatch_cleanup label."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:19.217Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/258310d59a82ea4854bfd9138682bbaac1153b19"
},
{
"url": "https://git.kernel.org/stable/c/bfc721eef5c13704efe6864c7da2ad4b0d75f60a"
},
{
"url": "https://git.kernel.org/stable/c/c79cf15eb35a4c703bf18f8c33c47e80dd660f8e"
}
],
"title": "module: fix lost error code from codetag_load_module()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98842",
"datePublished": "2026-10-18T15:50:19.217Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:19.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98841 (GCVE-0-2026-98841)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
virt: vmgenid: set driver_data before registering notification handlers
Summary
In the Linux kernel, the following vulnerability has been resolved:
virt: vmgenid: set driver_data before registering notification handlers
Both probe paths register their notification handler before assigning
driver_data, which the handler dereferences.
In the devicetree path, the notification IRQ can fire as soon as
devm_request_irq() registers the handler: the interrupt may already be
pending at probe time, for example when a VMM injects the
generation-changed notification while restoring a guest from a snapshot
that was taken before the driver had probed (Firecracker does exactly
this on snapshot restore). The IRQ is also requested with IRQF_SHARED,
so another device sharing the line can trigger the handler just as
early. The handler then calls vmgenid_notify(), which dereferences the
still-NULL driver_data and panics:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.38+ #1 PREEMPT(none)
Hardware name: linux,dummy-virt (DT)
pc : vmgenid_notify.isra.0+0x24/0x8c
lr : vmgenid_of_irq_handler+0x14/0x34
Call trace:
vmgenid_notify.isra.0+0x24/0x8c (P)
vmgenid_of_irq_handler+0x14/0x34
__handle_irq_event_percpu+0x44/0x1bc
handle_irq_event+0x4c/0xb4
handle_fasteoi_irq+0xf8/0x1f8
The ACPI path has the same ordering problem: the handler is installed
with acpi_install_notify_handler() before driver_data is assigned.
ACPI notifications are dispatched asynchronously from a workqueue, so
the window is narrow, but a notification arriving between the two calls
hits the same NULL dereference.
Assign driver_data before registering the handlers. The state is fully
initialized at that point, so the handlers are safe to run. Should
registration fail, the probe error path leaves no dangling pointer
behind: the driver core clears driver_data in device_unbind_cleanup().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e07606713a908eee8099883c8c830ebe33aaf748 , < 538fe5efaa9704ad820ba34b4f9df135ca873d79
(git)
Affected: e07606713a908eee8099883c8c830ebe33aaf748 , < 7a1e8daeaa466c6aaffa223e1afe9cfeece0dd47 (git) Affected: e07606713a908eee8099883c8c830ebe33aaf748 , < 8f42954ad8bf9bdbf574f2c437ad30cb2601f401 (git) Affected: e07606713a908eee8099883c8c830ebe33aaf748 , < 9f8139c6145cf17d690d6c414d43b4c0bef632fb (git) |
|
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/virt/vmgenid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "538fe5efaa9704ad820ba34b4f9df135ca873d79",
"status": "affected",
"version": "e07606713a908eee8099883c8c830ebe33aaf748",
"versionType": "git"
},
{
"lessThan": "7a1e8daeaa466c6aaffa223e1afe9cfeece0dd47",
"status": "affected",
"version": "e07606713a908eee8099883c8c830ebe33aaf748",
"versionType": "git"
},
{
"lessThan": "8f42954ad8bf9bdbf574f2c437ad30cb2601f401",
"status": "affected",
"version": "e07606713a908eee8099883c8c830ebe33aaf748",
"versionType": "git"
},
{
"lessThan": "9f8139c6145cf17d690d6c414d43b4c0bef632fb",
"status": "affected",
"version": "e07606713a908eee8099883c8c830ebe33aaf748",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/virt/vmgenid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: vmgenid: set driver_data before registering notification handlers\n\nBoth probe paths register their notification handler before assigning\ndriver_data, which the handler dereferences.\n\nIn the devicetree path, the notification IRQ can fire as soon as\ndevm_request_irq() registers the handler: the interrupt may already be\npending at probe time, for example when a VMM injects the\ngeneration-changed notification while restoring a guest from a snapshot\nthat was taken before the driver had probed (Firecracker does exactly\nthis on snapshot restore). The IRQ is also requested with IRQF_SHARED,\nso another device sharing the line can trigger the handler just as\nearly. The handler then calls vmgenid_notify(), which dereferences the\nstill-NULL driver_data and panics:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.38+ #1 PREEMPT(none)\n Hardware name: linux,dummy-virt (DT)\n pc : vmgenid_notify.isra.0+0x24/0x8c\n lr : vmgenid_of_irq_handler+0x14/0x34\n Call trace:\n vmgenid_notify.isra.0+0x24/0x8c (P)\n vmgenid_of_irq_handler+0x14/0x34\n __handle_irq_event_percpu+0x44/0x1bc\n handle_irq_event+0x4c/0xb4\n handle_fasteoi_irq+0xf8/0x1f8\n\nThe ACPI path has the same ordering problem: the handler is installed\nwith acpi_install_notify_handler() before driver_data is assigned.\nACPI notifications are dispatched asynchronously from a workqueue, so\nthe window is narrow, but a notification arriving between the two calls\nhits the same NULL dereference.\n\nAssign driver_data before registering the handlers. The state is fully\ninitialized at that point, so the handlers are safe to run. Should\nregistration fail, the probe error path leaves no dangling pointer\nbehind: the driver core clears driver_data in device_unbind_cleanup()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:15.224Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/538fe5efaa9704ad820ba34b4f9df135ca873d79"
},
{
"url": "https://git.kernel.org/stable/c/7a1e8daeaa466c6aaffa223e1afe9cfeece0dd47"
},
{
"url": "https://git.kernel.org/stable/c/8f42954ad8bf9bdbf574f2c437ad30cb2601f401"
},
{
"url": "https://git.kernel.org/stable/c/9f8139c6145cf17d690d6c414d43b4c0bef632fb"
}
],
"title": "virt: vmgenid: set driver_data before registering notification handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98841",
"datePublished": "2026-10-18T15:50:15.224Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:15.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98840 (GCVE-0-2026-98840)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
Summary
In the Linux kernel, the following vulnerability has been resolved:
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
The reload of 'vc' added by commit 8fb9ea65c9d1 ("vc_screen: reload load
of struct vc_data pointer in vcs_write() to avoid UAF") sits after the
'if (ret)' block, so the copy-failure break path exits the loop without
reloading vc. If the vc was kfree()'d via vc_port_destruct during the
unlocked copy_from_user() window, the post-loop
'if (written && vc) vcs_scr_updated(vc)' is reached with a stale
non-NULL vc. The '&& vc' guard from commit a287620312dc ("vc_screen:
fix null-ptr-deref in vcs_notifier() during concurrent vcs_write") only
handles the NULL case, not this stale-non-NULL case; vcs_notifier() then
reads param->vc->vc_num from freed memory:
BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0
Read of size 2 at addr ffff888007149190
Call Trace:
vcs_notifier+0x7c/0xd0
atomic_notifier_call_chain+0x70/0xa0
vcs_scr_updated+0x77/0xa0
vcs_write+0x71b/0x7e0
Allocated by task: vc_allocate -> con_install -> tty_open
Freed by task: kfree <- vt_ioctl (VT_DISALLOCATE -> vc_port_destruct)
Move the reload to immediately after console_lock(), before 'if (ret)',
so every break path below passes a fresh vc to the post-loop
vcs_scr_updated().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
73049768ad57145acd337102c5aa3c788e6642c8 , < 1485a3dd97ab1af2605243cabe6b604546d46dd1
(git)
Affected: 7cc3dd79777f6ae4625ec37e84dd18a26dc88bde , < 233a2e190b12884d186027d0b86d43a48799b69c (git) Affected: a287620312dc6dcb9a093417a0e589bf30fcf38a , < 9dfcadc5e003fb250dd471db90144bd5366140e9 (git) Affected: a287620312dc6dcb9a093417a0e589bf30fcf38a , < 226bd5603371cd9f6642cbb9e9a677f445de3530 (git) Affected: 43a6281790273c1b0a9ab76609ff0245b968f1e6 (git) Affected: b6bbb85cf45bf0b070e741997fe0af3a772c5ad5 (git) Affected: ff4806202749a51938236214adc0281481a57366 (git) Affected: 8232fca738011ca2ec865b46ec721d1796dc0580 (git) Affected: 74be188eb2dc1c99d63986167b9a67d415fe7326 (git) Affected: 09a43e81279b8da15526da09877134b8bcf618b0 (git) Affected: 6.12.95 , < 6.12.113 (semver) Affected: 6.18.37 , < 6.18.56 (semver) Affected: 5.10.260 , < 5.11 (semver) Affected: 5.15.211 , < 5.16 (semver) Affected: 6.1.177 , < 6.2 (semver) Affected: 6.6.144 , < 6.7 (semver) Affected: 7.0.14 , < 7.1 (semver) Affected: 7.1.2 , < 7.2 (semver) |
|
| Linux | Linux |
Affected:
7.2
Unaffected: 0 , < 7.2 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/vt/vc_screen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1485a3dd97ab1af2605243cabe6b604546d46dd1",
"status": "affected",
"version": "73049768ad57145acd337102c5aa3c788e6642c8",
"versionType": "git"
},
{
"lessThan": "233a2e190b12884d186027d0b86d43a48799b69c",
"status": "affected",
"version": "7cc3dd79777f6ae4625ec37e84dd18a26dc88bde",
"versionType": "git"
},
{
"lessThan": "9dfcadc5e003fb250dd471db90144bd5366140e9",
"status": "affected",
"version": "a287620312dc6dcb9a093417a0e589bf30fcf38a",
"versionType": "git"
},
{
"lessThan": "226bd5603371cd9f6642cbb9e9a677f445de3530",
"status": "affected",
"version": "a287620312dc6dcb9a093417a0e589bf30fcf38a",
"versionType": "git"
},
{
"status": "affected",
"version": "43a6281790273c1b0a9ab76609ff0245b968f1e6",
"versionType": "git"
},
{
"status": "affected",
"version": "b6bbb85cf45bf0b070e741997fe0af3a772c5ad5",
"versionType": "git"
},
{
"status": "affected",
"version": "ff4806202749a51938236214adc0281481a57366",
"versionType": "git"
},
{
"status": "affected",
"version": "8232fca738011ca2ec865b46ec721d1796dc0580",
"versionType": "git"
},
{
"status": "affected",
"version": "74be188eb2dc1c99d63986167b9a67d415fe7326",
"versionType": "git"
},
{
"status": "affected",
"version": "09a43e81279b8da15526da09877134b8bcf618b0",
"versionType": "git"
},
{
"lessThan": "6.12.113",
"status": "affected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThan": "6.18.56",
"status": "affected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/vt/vc_screen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.12.95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.18.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.260",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.211",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of \u0027vc\u0027 added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n\u0027if (ret)\u0027 block, so the copy-failure break path exits the loop without\nreloading vc. If the vc was kfree()\u0027d via vc_port_destruct during the\nunlocked copy_from_user() window, the post-loop\n\u0027if (written \u0026\u0026 vc) vcs_scr_updated(vc)\u0027 is reached with a stale\nnon-NULL vc. The \u0027\u0026\u0026 vc\u0027 guard from commit a287620312dc (\"vc_screen:\nfix null-ptr-deref in vcs_notifier() during concurrent vcs_write\") only\nhandles the NULL case, not this stale-non-NULL case; vcs_notifier() then\nreads param-\u003evc-\u003evc_num from freed memory:\n\n BUG: KASAN: slab-use-after-free in vcs_notifier+0x7c/0xd0\n Read of size 2 at addr ffff888007149190\n Call Trace:\n vcs_notifier+0x7c/0xd0\n atomic_notifier_call_chain+0x70/0xa0\n vcs_scr_updated+0x77/0xa0\n vcs_write+0x71b/0x7e0\n Allocated by task: vc_allocate -\u003e con_install -\u003e tty_open\n Freed by task: kfree \u003c- vt_ioctl (VT_DISALLOCATE -\u003e vc_port_destruct)\n\nMove the reload to immediately after console_lock(), before \u0027if (ret)\u0027,\nso every break path below passes a fresh vc to the post-loop\nvcs_scr_updated()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:14.029Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1485a3dd97ab1af2605243cabe6b604546d46dd1"
},
{
"url": "https://git.kernel.org/stable/c/233a2e190b12884d186027d0b86d43a48799b69c"
},
{
"url": "https://git.kernel.org/stable/c/9dfcadc5e003fb250dd471db90144bd5366140e9"
},
{
"url": "https://git.kernel.org/stable/c/226bd5603371cd9f6642cbb9e9a677f445de3530"
}
],
"title": "vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98840",
"datePublished": "2026-10-18T15:50:14.029Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:14.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98839 (GCVE-0-2026-98839)
Vulnerability from nvd – Published: 2026-10-18 15:50 – Updated: 2026-10-18 15:50
VLAI
EPSS
VEX
Title
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
In paste_selection(), the loop copies min_t(unsigned int,
vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into
tty_ldisc_receive_buf() and increments pasted += count.
Because the selection mutex (vc_sel.lock) is dropped inside the loop
Whenever the line discipline buffer fills up and paste_selection()
sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl
can replace vc_sel.buffer with a shorter selection and reduce
vc_sel.buf_len below pasted.
When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an
unsigned integer to a large positive value, causing
tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read
up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.
Fix this by terminating the loop when pasted >= vc_sel.buf_len.
Kernel stack trace (Linux 7.3.0-rc3):
==================================================================
BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650
Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65
Workqueue: events_unbound flush_to_ldisc
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x11c/0x200
__asan_memcpy+0x29/0x70
n_tty_receive_buf_common+0xa01/0x1650
tty_ldisc_receive_buf+0x66/0x110
tty_port_default_receive_buf+0x6b/0xb0
flush_to_ldisc+0x1b4/0x410
process_one_work+0x6ff/0x1110
worker_thread+0x4a8/0xb70
kthread+0x307/0x3e0
ret_from_fork+0x3ed/0x680
</TASK>
==================================================================
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 , < 037d7e3ca5c593092f4b0d471eb869a85cbddde0
(git)
Affected: e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 , < 619c6d7dd76fff15a9714fbf02ce299b737f01a2 (git) Affected: e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 , < 39495ef5d6f8019e62d65807f217a7ca8232727a (git) Affected: 54c522782fd11a720f959ee9cb5a15bb9580343d (git) Affected: 05c508edc9d0b44e4706d3c2cf14ee12aac210d2 (git) Affected: e5be0e24ffc7f5783a3864b5b958088ed15be9e8 (git) Affected: a4719f6d07b2c63223f7452c435c5f578f105cfe (git) Affected: b4492f1e7456bd162714c0ec2815c2749d930844 (git) Affected: 9a9c13ad21a8220cb70c9807a920f43520515f94 (git) Affected: 8c368d36878e2fc99285279fc5e14b3d3cb8947c (git) Affected: 3.16.83 , < 3.17 (semver) Affected: 4.4.216 , < 4.5 (semver) Affected: 4.9.216 , < 4.10 (semver) Affected: 4.14.173 , < 4.15 (semver) Affected: 4.19.109 , < 4.20 (semver) Affected: 5.4.25 , < 5.5 (semver) Affected: 5.5.9 , < 5.6 (semver) |
|
| Linux | Linux |
Affected:
5.6
Unaffected: 0 , < 5.6 (semver) Unaffected: 6.18.56 , ≤ 6.18.* (semver) Unaffected: 7.2.10 , ≤ 7.2.* (semver) Unaffected: 7.3-rc6 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/vt/selection.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "037d7e3ca5c593092f4b0d471eb869a85cbddde0",
"status": "affected",
"version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2",
"versionType": "git"
},
{
"lessThan": "619c6d7dd76fff15a9714fbf02ce299b737f01a2",
"status": "affected",
"version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2",
"versionType": "git"
},
{
"lessThan": "39495ef5d6f8019e62d65807f217a7ca8232727a",
"status": "affected",
"version": "e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2",
"versionType": "git"
},
{
"status": "affected",
"version": "54c522782fd11a720f959ee9cb5a15bb9580343d",
"versionType": "git"
},
{
"status": "affected",
"version": "05c508edc9d0b44e4706d3c2cf14ee12aac210d2",
"versionType": "git"
},
{
"status": "affected",
"version": "e5be0e24ffc7f5783a3864b5b958088ed15be9e8",
"versionType": "git"
},
{
"status": "affected",
"version": "a4719f6d07b2c63223f7452c435c5f578f105cfe",
"versionType": "git"
},
{
"status": "affected",
"version": "b4492f1e7456bd162714c0ec2815c2749d930844",
"versionType": "git"
},
{
"status": "affected",
"version": "9a9c13ad21a8220cb70c9807a920f43520515f94",
"versionType": "git"
},
{
"status": "affected",
"version": "8c368d36878e2fc99285279fc5e14b3d3cb8947c",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.83",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.216",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.216",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.173",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.109",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.25",
"versionType": "semver"
},
{
"lessThan": "5.6",
"status": "affected",
"version": "5.5.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/vt/selection.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc6",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.216",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.173",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.109",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty-\u003ereceive_room) bytes per iteration into\ntty_ldisc_receive_buf() and increments pasted += count.\n\nBecause the selection mutex (vc_sel.lock) is dropped inside the loop\nWhenever the line discipline buffer fills up and paste_selection()\nsleeps on tty-\u003ewrite_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl\ncan replace vc_sel.buffer with a shorter selection and reduce\nvc_sel.buf_len below pasted.\n\nWhen paste_selection() resumes, vc_sel.buf_len - pasted underflows as an\nunsigned integer to a large positive value, causing\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.\n\nFix this by terminating the loop when pasted \u003e= vc_sel.buf_len.\n\nKernel stack trace (Linux 7.3.0-rc3):\n ==================================================================\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650\n Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65\n Workqueue: events_unbound flush_to_ldisc\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x70/0xa0\n print_report+0x153/0x4c6\n kasan_report+0xf1/0x120\n kasan_check_range+0x11c/0x200\n __asan_memcpy+0x29/0x70\n n_tty_receive_buf_common+0xa01/0x1650\n tty_ldisc_receive_buf+0x66/0x110\n tty_port_default_receive_buf+0x6b/0xb0\n flush_to_ldisc+0x1b4/0x410\n process_one_work+0x6ff/0x1110\n worker_thread+0x4a8/0xb70\n kthread+0x307/0x3e0\n ret_from_fork+0x3ed/0x680\n \u003c/TASK\u003e\n =================================================================="
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T15:50:11.869Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/037d7e3ca5c593092f4b0d471eb869a85cbddde0"
},
{
"url": "https://git.kernel.org/stable/c/619c6d7dd76fff15a9714fbf02ce299b737f01a2"
},
{
"url": "https://git.kernel.org/stable/c/39495ef5d6f8019e62d65807f217a7ca8232727a"
}
],
"title": "vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98839",
"datePublished": "2026-10-18T15:50:11.869Z",
"dateReserved": "2026-09-25T10:25:14.373Z",
"dateUpdated": "2026-10-18T15:50:11.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}