Vulnerability-Lookup

CVE-2026-64406 (GCVE-0-2026-64406)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-10-19 20:38

Title

Bluetooth: fix UAF in bt_accept_dequeue()

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:40 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c0577c55219be42b6…
https://git.kernel.org/stable/c/96ad400d5132eb333…
https://git.kernel.org/stable/c/0a98ff4e7b867f72f…
https://git.kernel.org/stable/c/c66a95e60b65d876a…
https://git.kernel.org/stable/c/6303ed4bbe0095f4c…
https://git.kernel.org/stable/c/26168db1ce5a9766c…
https://git.kernel.org/stable/c/50c662bdcd51b0303…
https://git.kernel.org/stable/c/4bd0b274054f2679f…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 751de6ec671fe75ad9cf65a0638d2a06b6a5984d , < c0577c55219be42b6ea2ea8db11e85bfab6f4e8d (git) Affected: 407217734835d21d4e0105ebf347860dc1806f88 , < 96ad400d5132eb333f28f6f1e2d58f0728ca9547 (git) Affected: 7eebd4c2c86f573af87ff165d08a83432eb0b919 , < 0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0 (git) Affected: 5d86d2f1b4d9a508c441d3e45277ae1a73cfed57 , < c66a95e60b65d876a927123b0ed36bd6177d9ca6 (git) Affected: 87c543e2f78d0871f271df92dab98901bbd5b6f5 , < 6303ed4bbe0095f4cc195225479bf506e010d1db (git) Affected: added1213395071470a900cc845a042fb51882a6 , < 26168db1ce5a9766cde021b18e590a101c056614 (git) Affected: ab1513597c6cf17cd1ad2a21e3b045421b48e022 , < 50c662bdcd51b03033a0abed6716bfd377ba1049 (git) Affected: ab1513597c6cf17cd1ad2a21e3b045421b48e022 , < 4bd0b274054f2679f28b70222b607bb0afc3ab9a (git) Affected: a5ca86a6097a8b030ca3226cd300b17ed330f966 (git) Affected: 5.10.259 , < 5.10.261 (semver) Affected: 5.15.210 , < 5.15.212 (semver) Affected: 6.1.175 , < 6.1.178 (semver) Affected: 6.6.142 , < 6.6.145 (semver) Affected: 6.12.92 , < 6.12.96 (semver) Affected: 6.18.34 , < 6.18.39 (semver) Affected: 7.0.11 , < 7.1 (semver)	guessed
Linux	Linux	Affected: 7.1 Unaffected: 0 , < 7.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64406",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:40:14.651940Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:38:27.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c",
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0577c55219be42b6ea2ea8db11e85bfab6f4e8d",
              "status": "affected",
              "version": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
              "versionType": "git"
            },
            {
              "lessThan": "96ad400d5132eb333f28f6f1e2d58f0728ca9547",
              "status": "affected",
              "version": "407217734835d21d4e0105ebf347860dc1806f88",
              "versionType": "git"
            },
            {
              "lessThan": "0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0",
              "status": "affected",
              "version": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
              "versionType": "git"
            },
            {
              "lessThan": "c66a95e60b65d876a927123b0ed36bd6177d9ca6",
              "status": "affected",
              "version": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
              "versionType": "git"
            },
            {
              "lessThan": "6303ed4bbe0095f4cc195225479bf506e010d1db",
              "status": "affected",
              "version": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
              "versionType": "git"
            },
            {
              "lessThan": "26168db1ce5a9766cde021b18e590a101c056614",
              "status": "affected",
              "version": "added1213395071470a900cc845a042fb51882a6",
              "versionType": "git"
            },
            {
              "lessThan": "50c662bdcd51b03033a0abed6716bfd377ba1049",
              "status": "affected",
              "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
              "versionType": "git"
            },
            {
              "lessThan": "4bd0b274054f2679f28b70222b607bb0afc3ab9a",
              "status": "affected",
              "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.96",
              "status": "affected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.39",
              "status": "affected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c",
            "net/bluetooth/l2cap_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.259",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.210",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.175",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.12.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable child is created through an incoming Bluetooth link, with its teardown driven by connection and disconnection events from a nearby peer. Bluetooth radio reachability is adjacent rather than routable network access.\nAC:L - The attacker can control listener cleanup and use an adjacent peer to connect and disconnect before the fixed channel becomes ready, producing the final queue-only reference state. The trigger is repeatable and Bluetooth BR/EDR support is a common default configuration.\nPR:L - Unprivileged SOCK_STREAM or SOCK_SEQPACKET L2CAP sockets and dynamic or fixed-CID binds require no capability; only raw sockets and reserved PSM binds are privileged. Although AF_BLUETOOTH requires init_net, an ordinary host user or user namespace without a new network namespace can reach it.\nUI:N - The attacker can close their own listener while controlling the peer connection lifecycle, requiring no action from another user.\nS:U - Exploitation compromises the vulnerable host kernel but does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The freed struct sock comes from the general kmalloc-2k cache and can be reclaimed with attacker-controlled data. Subsequent socket and channel dereferences can be developed into arbitrary kernel-memory disclosure.\nI:H - The UAF causes an atomic write to freed memory followed by further operations on the freed socket and channel, enabling heap-spray-based corruption and potential control-flow hijacking.\nA:H - The confirmed post-free write can cause a kernel oops or panic, and the attacker can repeat the connection, disconnection, and cleanup sequence."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:04.583Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db"
        },
        {
          "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614"
        },
        {
          "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a"
        }
      ],
      "title": "Bluetooth: fix UAF in bt_accept_dequeue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64406",
    "datePublished": "2026-07-25T08:50:47.978Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-10-19T20:38:27.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64406",
      "date": "2026-11-09",
      "epss": "0.00275",
      "percentile": "0.2006"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:50:55.000Z",
      "cve": "CVE-2026-64406",
      "id": "msrc_CVE-2026-64406",
      "initial_release_date": "2026-07-26T01:09:11.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: fix UAF in bt_accept_dequeue()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64406.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/af_bluetooth.c",
                  "net/bluetooth/l2cap_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c0577c55219be42b6ea2ea8db11e85bfab6f4e8d",
                    "status": "affected",
                    "version": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96ad400d5132eb333f28f6f1e2d58f0728ca9547",
                    "status": "affected",
                    "version": "407217734835d21d4e0105ebf347860dc1806f88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0",
                    "status": "affected",
                    "version": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c66a95e60b65d876a927123b0ed36bd6177d9ca6",
                    "status": "affected",
                    "version": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6303ed4bbe0095f4cc195225479bf506e010d1db",
                    "status": "affected",
                    "version": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "26168db1ce5a9766cde021b18e590a101c056614",
                    "status": "affected",
                    "version": "added1213395071470a900cc845a042fb51882a6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "50c662bdcd51b03033a0abed6716bfd377ba1049",
                    "status": "affected",
                    "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bd0b274054f2679f28b70222b607bb0afc3ab9a",
                    "status": "affected",
                    "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.261",
                    "status": "affected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.212",
                    "status": "affected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.178",
                    "status": "affected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.142",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.96",
                    "status": "affected",
                    "version": "6.12.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.39",
                    "status": "affected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "affected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/af_bluetooth.c",
                  "net/bluetooth/l2cap_sock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "429937D6-6F74-403A-B60A-AA311A9FA3AB",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "5.10.259",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "42434AE1-4361-420E-AC94-62114ADF9A54",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.15.210",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6476CFBE-7300-465C-8DBA-620D3D005F5A",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "6.1.175",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D144D922-9AD2-409A-85E8-D8620FC3CA68",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.6.142",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BDFE208F-4818-458A-AFBE-4ADB1689BDAF",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.12.92",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1CDB605-6051-43A2-A590-8940B9A47D45",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.18.34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F099E30C-99C7-4E28-BFFA-57D8DCD36E9B",
                    "versionEndExcluding": "7.1",
                    "versionStartIncluding": "7.0.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E69D5CC8-02A4-44DA-A9D9-12B8E0C6AF08",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "7.1.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:-:*:*:*:*:*:*",
                    "matchCriteriaId": "42591D75-4648-4AF0-B193-8AE633EFFACF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths."
          }
        ],
        "id": "CVE-2026-64406",
        "lastModified": "2026-10-19T21:17:35.963",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-64406",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:40:14.651940Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-25T10:17:24.243",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-05T22:03:51+00:00",
      "cve": "CVE-2026-64406",
      "id": "CVE-2026-64406",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "15",
      "product_status:known_not_affected": "185",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: fix UAF in bt_accept_dequeue()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64406.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-64406",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T15:40:14.651940Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T15:40:15.328Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/bluetooth/af_bluetooth.c",
                "net/bluetooth/l2cap_sock.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "c0577c55219be42b6ea2ea8db11e85bfab6f4e8d",
                  "status": "affected",
                  "version": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
                  "versionType": "git"
                },
                {
                  "lessThan": "96ad400d5132eb333f28f6f1e2d58f0728ca9547",
                  "status": "affected",
                  "version": "407217734835d21d4e0105ebf347860dc1806f88",
                  "versionType": "git"
                },
                {
                  "lessThan": "0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0",
                  "status": "affected",
                  "version": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
                  "versionType": "git"
                },
                {
                  "lessThan": "c66a95e60b65d876a927123b0ed36bd6177d9ca6",
                  "status": "affected",
                  "version": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
                  "versionType": "git"
                },
                {
                  "lessThan": "6303ed4bbe0095f4cc195225479bf506e010d1db",
                  "status": "affected",
                  "version": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "26168db1ce5a9766cde021b18e590a101c056614",
                  "status": "affected",
                  "version": "added1213395071470a900cc845a042fb51882a6",
                  "versionType": "git"
                },
                {
                  "lessThan": "50c662bdcd51b03033a0abed6716bfd377ba1049",
                  "status": "affected",
                  "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
                  "versionType": "git"
                },
                {
                  "lessThan": "4bd0b274054f2679f28b70222b607bb0afc3ab9a",
                  "status": "affected",
                  "version": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.10.261",
                  "status": "affected",
                  "version": "5.10.259",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.15.212",
                  "status": "affected",
                  "version": "5.15.210",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.1.178",
                  "status": "affected",
                  "version": "6.1.175",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.6.145",
                  "status": "affected",
                  "version": "6.6.142",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.12.96",
                  "status": "affected",
                  "version": "6.12.92",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.18.39",
                  "status": "affected",
                  "version": "6.18.34",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.1",
                  "status": "affected",
                  "version": "7.0.11",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/bluetooth/af_bluetooth.c",
                "net/bluetooth/l2cap_sock.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "7.1"
                },
                {
                  "lessThan": "7.1",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.261",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.212",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.178",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.145",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.96",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.39",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.1.*",
                  "status": "unaffected",
                  "version": "7.1.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.261",
                      "versionStartIncluding": "5.10.259",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.212",
                      "versionStartIncluding": "5.15.210",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.178",
                      "versionStartIncluding": "6.1.175",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.145",
                      "versionStartIncluding": "6.6.142",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.96",
                      "versionStartIncluding": "6.12.92",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.39",
                      "versionStartIncluding": "6.18.34",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.1.4",
                      "versionStartIncluding": "7.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2",
                      "versionStartIncluding": "7.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "7.0.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - The vulnerable child is created through an incoming Bluetooth link, with its teardown driven by connection and disconnection events from a nearby peer. Bluetooth radio reachability is adjacent rather than routable network access.\nAC:L - The attacker can control listener cleanup and use an adjacent peer to connect and disconnect before the fixed channel becomes ready, producing the final queue-only reference state. The trigger is repeatable and Bluetooth BR/EDR support is a common default configuration.\nPR:L - Unprivileged SOCK_STREAM or SOCK_SEQPACKET L2CAP sockets and dynamic or fixed-CID binds require no capability; only raw sockets and reserved PSM binds are privileged. Although AF_BLUETOOTH requires init_net, an ordinary host user or user namespace without a new network namespace can reach it.\nUI:N - The attacker can close their own listener while controlling the peer connection lifecycle, requiring no action from another user.\nS:U - Exploitation compromises the vulnerable host kernel but does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The freed struct sock comes from the general kmalloc-2k cache and can be reclaimed with attacker-controlled data. Subsequent socket and channel dereferences can be developed into arbitrary kernel-memory disclosure.\nI:H - The UAF causes an atomic write to freed memory followed by further operations on the freed socket and channel, enabling heap-spray-based corruption and potential control-flow hijacking.\nA:H - The confirmed post-free write can cause a kernel oops or panic, and the attacker can repeat the connection, disconnection, and cleanup sequence."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T04:55:04.583Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d"
            },
            {
              "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547"
            },
            {
              "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0"
            },
            {
              "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6"
            },
            {
              "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db"
            },
            {
              "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614"
            },
            {
              "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049"
            },
            {
              "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a"
            }
          ],
          "title": "Bluetooth: fix UAF in bt_accept_dequeue()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-64406",
        "datePublished": "2026-07-25T08:50:47.978Z",
        "dateReserved": "2026-07-19T15:36:31.786Z",
        "dateUpdated": "2026-10-19T20:38:27.281Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-VM2J-8CH2-X289

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix UAF in bt_accept_dequeue()

bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference.

bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup.

Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.

Severity

8.0 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:24Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in bt_accept_dequeue()\n\nbt_accept_get() takes a temporary reference before dropping the accept\nqueue lock. bt_accept_dequeue() currently drops that reference before\nbt_accept_unlink(), leaving only the queue reference.\n\nbt_accept_unlink() drops the queue reference. The subsequent\nsock_hold() therefore accesses freed memory if it was the final\nreference, as observed by KASAN during listening L2CAP socket cleanup.\n\nRetain the temporary queue-walk reference through unlink and hand it to\nthe caller on success. Drop it explicitly on the closed and\nnot-yet-connected paths.",
  "id": "GHSA-vm2j-8ch2-x289",
  "modified": "2026-07-27T06:30:36Z",
  "published": "2026-07-25T12:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64406"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OESA-2026-3453 (CVE-2026-23336)

Vulnerability from osv_openeuler – Published: 2026-08-20 09:59 – Updated: 2026-08-20 09:59 – Source website

Summary

kernel security update

Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()

There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller:

BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK>

The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2026-23336)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()

l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap_ecred_conn_rsp (the ECRED connection response, 8 bytes with result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes with result at offset 0).

This causes two problems:

The sizeof(*rsp) length check requires 8 bytes instead of the correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected with -EPROTO.
rsp->result reads from offset 6 instead of offset 0, returning wrong data when the packet is large enough to pass the check.

Fix by using the correct type. Also pass the already byte-swapped result variable to BT_DBG instead of the raw __le16 field.(CVE-2026-43062)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix & Optimize table creation from possibly unaligned memory

Source blob may come from userspace and might be unaligned. Try to optize the copying process by avoiding unaligned memory accesses.

Added Fixes tag
Added "Fix &" to description as this doesn't just optimize but fixes a potential unaligned memory access jj: remove duplicate word "convert" in comment trigger checkpatch warning

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: validate payload size before accessing journal metadata

r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block.

A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets.

Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing.(CVE-2026-46070)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows:

a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous).
the PDE mapping is changed from outside the guest.
the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped.
the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3.
any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED).

The underlying issue is that KVM's walking of shadow PTEs assumes that if a SPTE is present when KVM wants to install a non-leaf SPTE, then the existing kvm_mmu_page must be for the correct gfn. Because the only way for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... which shouldn't happen, but actually only happens in response to a guest write.

That bug dates back literally forever, as even the first version of KVM assumes that the GFN matches and walks into the "wrong" shadow page. However, that was only an imprecision until 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") came along.

Fix it by checking for a target gfn mismatch and zapping the existing SPTE. That way the old SP and rmap entries are gone, KVM installs the rmap in the right location, and everyone is happy.(CVE-2026-46113)

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/flexfiles: reject zero filehandle version count

ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL.

A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists.

Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser.

A QEMU/KASAN run with a malformed flexfiles layout hit:

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception

The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.(CVE-2026-53392)

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the err_out label to roll back the console state. However, the current rollback logic forgets to restore the hi_font state, leading to a severe state machine corruption.

Earlier in the function, set_vc_hi_font() might be called to change vc->vc_hi_font_mask and mutate the screen buffer. If vc_resize() subsequently fails, the err_out path restores vc_font.charcount but entirely skips rolling back the vc_hi_font_mask and the screen buffer.

This mismatch leaves the terminal in a desynchronized state. Because vc_hi_font_mask remains set, the VT subsystem will still accept character indices greater than 255 from userspace and write them to the screen buffer. Subsequent rendering calls (e.g., fbcon_putcs()) will then use these inflated indices to access the reverted, 256-character font array, leading to a deterministic out-of-bounds read and potential kernel memory disclosure.

Fix this by adding the missing rollback logic for the hi_font mask and screen buffer in the error path.(CVE-2026-53402)

In the Linux kernel, the following vulnerability has been resolved:

pNFS: Fix use-after-free in pnfs_update_layout()

When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields.

Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).(CVE-2026-63800)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Prefer NLA_NUL_STRING

These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator.

Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING.

As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLA_NUL_STRING use is the simpler solution.(CVE-2026-63860)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: mxuport: fix memory corruption with small endpoint

Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size.(CVE-2026-63899)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: digi_acceleport: fix memory corruption with small endpoints

Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers than expected.(CVE-2026-63901)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.(CVE-2026-63924)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: fix missing length checks in hidp_input_report()

hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data.

hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement.

Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard.(CVE-2026-63947)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

ipv6_rpl_srh_decompress() computes:

outhdr-&gt;hdrlen = (((n + 1) * sizeof(struct in6_addr)) &gt;&gt; 3);

hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):

(128 * 16) &gt;&gt; 3 = 256, truncated to 0 as __u8

The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet.

The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit.

Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.(CVE-2026-63984)

In the Linux kernel, the following vulnerability has been resolved:

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set.

This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535.

Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part.

Note that iptunnel_pmtud_check_icmpv6()) is fine.(CVE-2026-63992)

In the Linux kernel, the following vulnerability has been resolved:

tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6

Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head.

Fix this possible UAF by initializing the local variables after the skb_cow() call.

Remove skb_reset_network_header() calls which were not needed.(CVE-2026-63994)

In the Linux kernel, the following vulnerability has been resolved:

ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon.

Only after unregister_net_sysctl_table() we can be sure no threads can possibly use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.(CVE-2026-64002)

In the Linux kernel, the following vulnerability has been resolved:

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation.

A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30.

Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.(CVE-2026-64276)

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix adapter deregistration race

Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device.

Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name).(CVE-2026-64279)

In the Linux kernel, the following vulnerability has been resolved:

exfat: bound uniname advance in exfat_find_dir_entry()

In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length:

if (++order == 2)
    uniname = p_uniname-&gt;name;
else
    uniname += EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
name_len += len;
unichar = *(uniname+len);
*(uniname+len) = 0x0;

uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len grows only by the actual extracted length, which is shorter when a name fragment contains an early NUL. The only guard is name_len >= MAX_NAME_LENGTH, so a crafted directory with many short name fragments lets uniname run far past the p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small, causing an out-of-bounds read and write at *(uniname+len).

The sibling extractor exfat_get_uniname_from_ext_entry() already stops on a short fragment (the lockstep len != EXFAT_FILE_NAME_LEN guard added in commit d42334578eba ("exfat: check if filename entries exceeds max filename length")); exfat_find_dir_entry() never got the equivalent. Track the per-entry write offset as a count and reject a fragment once the offset, or the offset plus the extracted length, would exceed MAX_NAME_LENGTH, before forming the output pointer.(CVE-2026-64296)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - validate RSA CRT component lengths

The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with:

memcpy(dst + half_key_sz - len, src, len)

When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption.

Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds.(CVE-2026-64304)

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: digi_acceleport: fix write buffer corruption

The digi_write_inb_command() is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the urb on timeout.

To make things worse, for commands like break control where no timeout is used, the driver would corrupt the urb immediately due to a broken jiffies comparison (on 32-bit machines this takes five minutes of uptime to trigger due to INITIAL_JIFFIES).

Fix this by adding the missing return on timeout and waiting indefinitely when no timeout has been specified as intended.

This issue was (sort of) flagged by Sashiko when reviewing an unrelated change to the driver.(CVE-2026-64333)

In the Linux kernel, the following vulnerability has been resolved:

USB: legousbtower: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")(CVE-2026-64340)

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptrace_may_access() with exec_update_lock (part 1)

Fix the easy cases where procfs currently calls ptrace_may_access() without exec_update_lock protection, where the fix is to simply add the extra lock or use mm_access():

do_task_stat(): grab exec_update_lock
proc_pid_wchan(): grab exec_update_lock
proc_map_files_lookup(): use mm_access() instead of get_task_mm()
proc_map_files_readdir(): use mm_access() instead of get_task_mm()
proc_ns_get_link(): grab exec_update_lock
proc_ns_readlink(): grab exec_update_lock(CVE-2026-64371)

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set.

Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server.(CVE-2026-64388)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue(). bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.(CVE-2026-64406)

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds:

BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ...

Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.(CVE-2026-64550)

In the Linux kernel, a use-after-free vulnerability exists in the SCTP ASCONF processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport. For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address, but nothing protects asconf->transport. A single ASCONF can carry [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source, causing the freed transport to be dereferenced, potentially leading to system crash or code execution.(CVE-2026-64564)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer destroy_previous_session() until after NTLM authentication

In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM.

Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.(CVE-2026-68130)

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

__decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write.

An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.

BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670!

idryomov: do the same in __decode_pg_upmap_items()

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-23336	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-43062	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-45893	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-46070	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-46113	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-53392	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-53402	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63800	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63860	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63899	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63901	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63924	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63947	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63984	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63992	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63994	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64002	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64276	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64279	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64296	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64304	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64333	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64340	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64371	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64388	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64406	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64550	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-64564	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-68130	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-68159	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bpftool-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "bpftool-debuginfo-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-debuginfo-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-debugsource-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-devel-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-headers-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-source-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-tools-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-tools-debuginfo-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "kernel-tools-devel-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "perf-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "perf-debuginfo-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "python3-perf-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm",
          "python3-perf-debuginfo-5.10.0-329.0.0.230.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "kernel-5.10.0-329.0.0.230.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "bpftool-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "bpftool-debuginfo-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-debuginfo-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-debugsource-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-devel-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-headers-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-source-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-tools-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-tools-debuginfo-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "kernel-tools-devel-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "perf-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "perf-debuginfo-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "python3-perf-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm",
          "python3-perf-debuginfo-5.10.0-329.0.0.230.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0-329.0.0.230.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel rfkill_block work in wiphy_unregister()\n\nThere is a use-after-free error in cfg80211_shutdown_all_interfaces found\nby syzkaller:\n\nBUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220\nRead of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326\nCPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nWorkqueue: events cfg80211_rfkill_block_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x116/0x1f0\n print_report+0xcd/0x630\n kasan_report+0xe0/0x110\n cfg80211_shutdown_all_interfaces+0x213/0x220\n cfg80211_rfkill_block_work+0x1e/0x30\n process_one_work+0x9cf/0x1b70\n worker_thread+0x6c8/0xf10\n kthread+0x3c5/0x780\n ret_from_fork+0x56d/0x700\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\n\nThe problem arises due to the rfkill_block work is not cancelled when wiphy\nis being unregistered. In order to fix the issue cancel the corresponding\nwork in wiphy_unregister().\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2026-23336)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()\n\nl2cap_ecred_reconf_rsp() casts the incoming data to struct\nl2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with\nresult at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes\nwith result at offset 0).\n\nThis causes two problems:\n\n - The sizeof(*rsp) length check requires 8 bytes instead of the\n   correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected\n   with -EPROTO.\n\n - rsp-\u0026gt;result reads from offset 6 instead of offset 0, returning\n   wrong data when the packet is large enough to pass the check.\n\nFix by using the correct type.  Also pass the already byte-swapped\nresult variable to BT_DBG instead of the raw __le16 field.(CVE-2026-43062)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix \u0026amp; Optimize table creation from possibly unaligned memory\n\nSource blob may come from userspace and might be unaligned.\nTry to optize the copying process by avoiding unaligned memory accesses.\n\n- Added Fixes tag\n- Added \u0026quot;Fix \u0026amp;\u0026quot; to description as this doesn\u0026apos;t just optimize but fixes\n        a potential unaligned memory access\n[jj: remove duplicate word \u0026quot;convert\u0026quot; in comment trigger checkpatch warning](CVE-2026-45893)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: validate payload size before accessing journal metadata\n\nr5c_recovery_analyze_meta_block() and\nr5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a\njournal metadata block using on-disk payload size fields without\nvalidating them against the remaining space in the metadata block.\n\nA corrupted journal contains payload sizes extending beyond the PAGE_SIZE\nboundary can cause out-of-bounds reads when accessing payload fields or\ncomputing offsets.\n\nAdd bounds validation for each payload type to ensure the full payload\nfits within meta_size before processing.(CVE-2026-46070)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected GFN\n\nThe shadow MMU computes GFNs for direct shadow pages using sp-\u0026gt;gfn plus\nthe SPTE index. This assumption breaks for shadow paging if the guest\npage tables are modified between VM entries (similar to commit\naad885e77496, \u0026quot;KVM: x86/mmu: Drop/zap existing present SPTE even\nwhen creating an MMIO SPTE\u0026quot;, 2026-03-27).  The flow is as follows:\n\n- a PDE is installed for a 2MB mapping, and a page in that area is\n  accessed.  KVM creates a kvm_mmu_page consisting of 512 4KB pages;\n  the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because\n  the guest\u0026apos;s mapping is a huge page (and thus contiguous).\n\n- the PDE mapping is changed from outside the guest.\n\n- the guest accesses another page in the same 2MB area.  KVM installs\n  a new leaf SPTE and rmap entry; the SPTE uses the \u0026quot;correct\u0026quot; GFN\n  (i.e. based on the new mapping, as changed in the previous step) but\n  that GFN is outside of the [sp-\u0026gt;gfn, sp-\u0026gt;gfn + 511] range; therefore\n  the rmap entry cannot be found and removed when the kvm_mmu_page\n  is zapped.\n\n- the memslot that covers the first 2MB mapping is deleted, and the\n  kvm_mmu_page for the now-invalid GPA is zapped.  However, rmap_remove()\n  only looks at the [sp-\u0026gt;gfn, sp-\u0026gt;gfn + 511] range established in step 1,\n  and fails to find the rmap entry that was recorded by step 3.\n\n- any operation that causes an rmap walk for the same page accessed\n  by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page.\n  This includes dirty logging or MMU notifier invalidations (e.g., from\n  MADV_DONTNEED).\n\nThe underlying issue is that KVM\u0026apos;s walking of shadow PTEs assumes that\nif a SPTE is present when KVM wants to install a non-leaf SPTE, then the\nexisting kvm_mmu_page must be for the correct gfn.  Because the only way\nfor the gfn to be wrong is if KVM messed up and failed to zap a SPTE...\nwhich shouldn\u0026apos;t happen, but *actually* only happens in response to a\nguest write.\n\nThat bug dates back literally forever, as even the first version of KVM\nassumes that the GFN matches and walks into the \u0026quot;wrong\u0026quot; shadow page.\nHowever, that was only an imprecision until 2032a93d66fa (\u0026quot;KVM: MMU:\nDon\u0026apos;t allocate gfns page for direct mmu pages\u0026quot;) came along.\n\nFix it by checking for a target gfn mismatch and zapping the existing\nSPTE.  That way the old SP and rmap entries are gone, KVM installs\nthe rmap in the right location, and everyone is happy.(CVE-2026-46113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info-\u0026gt;fh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n  RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n  ff_layout_encode_layoutreturn+0x683/0x970\n  nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n  Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly.(CVE-2026-53392)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()\n\nWhen fbcon_do_set_font() fails (e.g., due to a memory allocation failure\ninside vc_resize() under heavy memory pressure), it jumps to the `err_out`\nlabel to roll back the console state. However, the current rollback logic\nforgets to restore the `hi_font` state, leading to a severe state machine\ncorruption.\n\nEarlier in the function, `set_vc_hi_font()` might be called to change\n`vc-\u0026gt;vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`\nsubsequently fails, the `err_out` path restores `vc_font.charcount`\nbut entirely skips rolling back the `vc_hi_font_mask` and the screen\nbuffer.\n\nThis mismatch leaves the terminal in a desynchronized state. Because\n`vc_hi_font_mask` remains set, the VT subsystem will still accept\ncharacter indices greater than 255 from userspace and write them to the\nscreen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will\nthen use these inflated indices to access the reverted, 256-character\nfont array, leading to a deterministic out-of-bounds read and potential\nkernel memory disclosure.\n\nFix this by adding the missing rollback logic for the `hi_font` mask\nand screen buffer in the error path.(CVE-2026-53402)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix use-after-free in pnfs_update_layout()\n\nWhen hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(),\nthe code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds,\npnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(),\nwhich still references \u0026apos;lo\u0026apos;. This results in a use-after-free when the\ntracepoint accesses lo\u0026apos;s fields.\n\nFix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).(CVE-2026-63800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Prefer NLA_NUL_STRING\n\nThese attributes are evaluated as c-string (passed to strcmp), but\nNLA_STRING doesn\u0026apos;t check for the presence of a \\0 terminator.\n\nEither this needs to switch to nla_strcmp() and needs to adjust printf fmt\nspecifier to not use plain %s, or this needs to use NLA_NUL_STRING.\n\nAs the code has been this way for long time, it seems to me that userspace\ndoes include the terminating nul, even tough its not enforced so far, and\nthus NLA_NUL_STRING use is the simpler solution.(CVE-2026-63860)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mxuport: fix memory corruption with small endpoint\n\nMake sure that the bulk-out endpoint max packet size is at least eight\nbytes to avoid user-controlled slab corruption should a malicious device\nreport a smaller size.(CVE-2026-63899)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix memory corruption with small endpoints\n\nAdd the missing bulk-out buffer size sanity checks to avoid\nout-of-bounds memory accesses or slab corruption should a malicious\ndevice report smaller buffers than expected.(CVE-2026-63901)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\nipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.\nLet\u0026apos;s recompute nh pointer to make sure any change won\u0026apos;t mess things up.(CVE-2026-63924)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: fix missing length checks in hidp_input_report()\n\nhidp_input_report() reads keyboard and mouse payload data from an skb\nwithout first verifying that skb-\u0026gt;len contains enough data.\n\nhidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching\nto hidp_input_report(). If a paired device sends a truncated packet,\nthe handler reads beyond the valid skb data, resulting in an\nout-of-bounds read of skb data. The OOB bytes may be interpreted as\nphantom key presses or spurious mouse movement.\n\nReplace the open-coded length tracking and pointer arithmetic with\nskb_pull_data() calls. skb_pull_data() returns NULL if the requested\nbytes are not present, eliminating the need for a manual size variable\nand the separate skb-\u0026gt;len guard.(CVE-2026-63947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()\n\nipv6_rpl_srh_decompress() computes:\n\n    outhdr-\u0026gt;hdrlen = (((n + 1) * sizeof(struct in6_addr)) \u0026gt;\u0026gt; 3);\n\nhdrlen is __u8. For n \u0026gt;= 127 the result exceeds 255 and silently\ntruncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):\n\n    (128 * 16) \u0026gt;\u0026gt; 3 = 256, truncated to 0 as __u8\n\nThe caller in ipv6_rpl_srh_rcv() then places the compressed header\nat buf + ((ohdr-\u0026gt;hdrlen + 1) \u0026lt;\u0026lt; 3). With hdrlen=0 this is buf + 8,\nbut the decompressed region occupies buf[0..2055] (8-byte header\nplus 128 full addresses). The compressed header overlaps the\ndecompressed data, and ipv6_rpl_srh_compress() writes into this\noverlap, corrupting the routing header of the forwarded packet.\n\nThe existing guard at exthdrs.c:546 checks (n + 1) \u0026gt; 255, which\nprevents n+1 from overflowing unsigned char (the segments_left\nfield), but does not prevent the computed hdrlen from overflowing\n__u8. n=127 passes because 128 \u0026lt;= 255, yet hdrlen=256 does not\nfit.\n\nTighten the bound to (n + 1) \u0026gt; 127. This caps n at 126, giving\nhdrlen = (127 * 16) \u0026gt;\u0026gt; 3 = 254, which fits in __u8. The compressed\nheader then lands at buf + ((254 + 1) \u0026lt;\u0026lt; 3) = buf + 2040, exactly\npast the decompressed region (buf[0..2039]). No overlap. 127\nsegments is well beyond any realistic RPL deployment.(CVE-2026-63984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: do not assume transport header in iptunnel_pmtud_check_icmp()\n\nIn some cases, iptunnel_pmtud_check_icmp() can be called while\nskb transport header is not set.\n\nThis triggers an out-of-bound access, because\n(typeof(skb-\u0026gt;transport_header))~0U is 65535.\n\nAccess the icmp header based on IPv4 network header,\nafter making sure icmp-\u0026gt;type is present in skb linear part.\n\nNote that iptunnel_pmtud_check_icmpv6()) is fine.(CVE-2026-63992)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()\n\nSashiko found that iptunnel_pmtud_build_icmp() and\niptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr()\nbefore an skb_cow() call which can reallocate skb-\u0026gt;head.\n\nFix this possible UAF by initializing the local variables\nafter the skb_cow() call.\n\nRemove skb_reset_network_header() calls which were not needed.(CVE-2026-63994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net-\u0026gt;ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net-\u0026gt;ipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.(CVE-2026-64002)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u0026gt;gpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u0026gt;keycodemax is set to the full gpioled_count while input-\u0026gt;keycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u0026gt; 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.(CVE-2026-64276)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter deregistration race\n\nAdapters can be looked up by their id using i2c_get_adapter() which\ntakes a reference to the embedded struct device.\n\nRemove the adapter from the IDR before tearing it down during\nderegistration (and on registration failure) to make sure its resources\nare not accessed after having been freed (e.g. the device name).(CVE-2026-64279)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nexfat: bound uniname advance in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the\noutput pointer by a fixed amount while the loop guard only tracks the\naccumulated name length:\n\n\tif (++order == 2)\n\t\tuniname = p_uniname-\u0026gt;name;\n\telse\n\t\tuniname += EXFAT_FILE_NAME_LEN;\n\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\tname_len += len;\n\tunichar = *(uniname+len);\n\t*(uniname+len) = 0x0;\n\nuniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len\ngrows only by the actual extracted length, which is shorter when a name\nfragment contains an early NUL.  The only guard is\n`name_len \u0026gt;= MAX_NAME_LENGTH`, so a crafted directory with many short\nname fragments lets uniname run far past the\np_uniname-\u0026gt;name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,\ncausing an out-of-bounds read and write at *(uniname+len).\n\nThe sibling extractor exfat_get_uniname_from_ext_entry() already stops\non a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard\nadded in commit d42334578eba (\u0026quot;exfat: check if filename entries exceeds\nmax filename length\u0026quot;)); exfat_find_dir_entry() never got the\nequivalent.  Track the per-entry write offset as a count and reject a\nfragment once the offset, or the offset plus the extracted length, would\nexceed MAX_NAME_LENGTH, before forming the output pointer.(CVE-2026-64296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate RSA CRT component lengths\n\nThe generic RSA key parser (rsa_helper.c) bounds each CRT component (p,\nq, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()\nallocates half-size DMA buffers (key_sz / 2) and right-aligns each\ncomponent with:\n\n    memcpy(dst + half_key_sz - len, src, len)\n\nWhen a CRT component is larger than half_key_sz the subtraction\nunderflows and memcpy writes past the DMA buffer, causing memory\ncorruption.\n\nAdd a len \u0026gt; half_key_sz check next to the existing !len check for each\nof the five CRT components so the driver falls back to the non-CRT path\ninstead of writing out of bounds.(CVE-2026-64304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix write buffer corruption\n\nThe digi_write_inb_command() is supposed to wait for the write urb to\nbecome available or return an error, but instead it updates the transfer\nbuffer and tries to resubmit the urb on timeout.\n\nTo make things worse, for commands like break control where no timeout\nis used, the driver would corrupt the urb immediately due to a broken\njiffies comparison (on 32-bit machines this takes five minutes of uptime\nto trigger due to INITIAL_JIFFIES).\n\nFix this by adding the missing return on timeout and waiting\nindefinitely when no timeout has been specified as intended.\n\nThis issue was (sort of) flagged by Sashiko when reviewing an unrelated\nchange to the driver.(CVE-2026-64333)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\u0026quot;locking/mutex: Document that mutex_unlock() is\n                   non-atomic\u0026quot;)\n[2] 2b9d9e0a9ba0 (\u0026quot;locking/mutex: Clarify that mutex_unlock(), and most\n                   other sleeping locks, can still use the lock object\n                   after it\u0026apos;s unlocked\u0026quot;)(CVE-2026-64340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nproc: protect ptrace_may_access() with exec_update_lock (part 1)\n\nFix the easy cases where procfs currently calls ptrace_may_access() without\nexec_update_lock protection, where the fix is to simply add the extra lock\nor use mm_access():\n\n - do_task_stat(): grab exec_update_lock\n - proc_pid_wchan(): grab exec_update_lock\n - proc_map_files_lookup(): use mm_access() instead of get_task_mm()\n - proc_map_files_readdir(): use mm_access() instead of get_task_mm()\n - proc_ns_get_link(): grab exec_update_lock\n - proc_ns_readlink(): grab exec_update_lock(CVE-2026-64371)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix chown/chgrp with SMB3 POSIX Extensions\n\nOwnership (chown) and group (chgrp) modifications were being ignored when\nmounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or\nCIFS_MOUNT_MODE_FROM_SID were also explicitly set.\n\nFix this by checking for posix_extensions in cifs_setattr_nounix() when\nupdating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map\nand set the ownership/group information on the server.(CVE-2026-64388)\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue(). bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses freed memory if it was the final reference, as observed by KASAN during listening L2CAP socket cleanup. Retain the temporary queue-walk reference through unlink and hand it to the caller on success. Drop it explicitly on the closed and not-yet-connected paths.(CVE-2026-64406)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: validate MAP frame length before ingress parsing\n\nWhen ingress deaggregation is disabled, rmnet_map_ingress_handler() passes\nthe skb straight to __rmnet_map_ingress_handler(), skipping the length\nvalidation that rmnet_map_deaggregate() performs on the aggregated path.\nThe parser then dereferences the MAP header and csum header/trailer based on\nthe on-wire pkt_len without checking skb-\u0026gt;len, so a short frame is read out\nof bounds:\n\n  BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet\n  Read of size 1 at addr ffff88801118ed00 by task exploit/147\n  Call Trace:\n   ...\n   rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)\n   __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)\n   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)\n   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)\n   netif_receive_skb (net/core/dev.c:6460)\n   tun_get_user (drivers/net/tun.c:1955)\n   tun_chr_write_iter (drivers/net/tun.c:2001)\n   vfs_write (fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n\nFactor that validation out of rmnet_map_deaggregate() into\nrmnet_map_validate_packet_len() and run it on the no-aggregation path too.\nThe MAP header is bounds-checked first, since this path can receive a frame\nshorter than the header.(CVE-2026-64550)\n\nIn the Linux kernel, a use-after-free vulnerability exists in the SCTP ASCONF processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf-\u0026gt;transport. For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet\u0026apos;s source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address, but nothing protects asconf-\u0026gt;transport. A single ASCONF can carry [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source, causing the freed transport to be dereferenced, potentially leading to system crash or code execution.(CVE-2026-64564)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: defer destroy_previous_session() until after NTLM authentication\n\nIn ntlm_authenticate(), destroy_previous_session() is called using a\nuser pointer resolved from the client-supplied NTLM blob username field\nbefore the NTLMv2 response is validated. An authenticated attacker can\nset the NTLM blob username to match a victim account and set\nPreviousSessionId to the victim\u0026apos;s session ID; destroy_previous_session()\ndestroys the victim\u0026apos;s session while ksmbd_decode_ntlmssp_auth_blob()\nsubsequently rejects the request with -EPERM.\n\nMove destroy_previous_session() and the prev_id assignment to after\nksmbd_decode_ntlmssp_auth_blob() returns success and use sess-\u0026gt;user\nrather than the pre-authentication lookup result. This matches the\nordering already used by krb5_authenticate(), where\ndestroy_previous_session() is called only after\nksmbd_krb5_authenticate() returns success.(CVE-2026-68130)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n  BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n  Write of size 4 ... by task exploit\n   kasan_report (mm/kasan/report.c:595)\n   ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n   calc_target (net/ceph/osd_client.c:1638)\n   __submit_request (net/ceph/osd_client.c:2394)\n   ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n   ceph_osdc_call (net/ceph/osd_client.c:5164)\n   rbd_dev_image_probe (drivers/block/rbd.c:6899)\n   do_rbd_add (drivers/block/rbd.c:7138)\n   ...\n  kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ](CVE-2026-68159)",
  "id": "OESA-2026-3453",
  "modified": "2026-08-20T09:59:07Z",
  "published": "2026-08-20T09:59:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3453"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23336"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43062"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45893"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46070"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46113"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53392"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53402"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63800"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63860"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63899"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63901"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63924"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63947"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63984"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63992"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63994"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64002"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64276"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64279"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64296"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64304"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64333"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64371"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64388"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64406"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64550"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68130"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68159"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2026-23336",
    "CVE-2026-43062",
    "CVE-2026-45893",
    "CVE-2026-46070",
    "CVE-2026-46113",
    "CVE-2026-53392",
    "CVE-2026-53402",
    "CVE-2026-63800",
    "CVE-2026-63860",
    "CVE-2026-63899",
    "CVE-2026-63901",
    "CVE-2026-63924",
    "CVE-2026-63947",
    "CVE-2026-63984",
    "CVE-2026-63992",
    "CVE-2026-63994",
    "CVE-2026-64002",
    "CVE-2026-64276",
    "CVE-2026-64279",
    "CVE-2026-64296",
    "CVE-2026-64304",
    "CVE-2026-64333",
    "CVE-2026-64340",
    "CVE-2026-64371",
    "CVE-2026-64388",
    "CVE-2026-64406",
    "CVE-2026-64550",
    "CVE-2026-64564",
    "CVE-2026-68130",
    "CVE-2026-68159"
  ]
}

OPENSUSE-SU-2026:11476-1

Vulnerability from csaf_opensuse - Published: 2026-08-09 00:00 - Updated: 2026-09-26 08:35

Summary

kernel-devel-7.1.7-1.1 on GA media

Severity

Moderate

Scope

351 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 16 products

Open the full advisory

OPENSUSE-SU-2026:21910-1

Vulnerability from csaf_opensuse - Published: 2026-09-22 15:26 - Updated: 2026-11-03 21:54

Summary

Security update for the Linux Kernel

Severity

Important

Scope

885 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 136 products

Open the full advisory

SUSE-SU-2026:23477-1

Vulnerability from csaf_suse - Published: 2026-09-08 12:54 - Updated: 2026-11-03 21:47

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:23481-1

Vulnerability from csaf_suse - Published: 2026-09-08 13:00 - Updated: 2026-11-03 21:47

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 11 products

Open the full advisory

SUSE-SU-2026:23528-1

Vulnerability from csaf_suse - Published: 2026-09-08 10:34 - Updated: 2026-11-03 21:47

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23529-1

Vulnerability from csaf_suse - Published: 2026-09-08 11:00 - Updated: 2026-11-03 21:47

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:23881-1

Vulnerability from csaf_suse - Published: 2026-09-22 13:18 - Updated: 2026-11-03 21:47

Summary

Security update for the Linux Kernel

Severity

Important

Scope

885 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:23887-1

Vulnerability from csaf_suse - Published: 2026-09-22 14:23 - Updated: 2026-11-03 21:47

Summary

Security update for the Linux Kernel

Severity

Important

Scope

885 vulnerabilities in this advisory, including CVE-2026-64406.

CVE-2026-64406

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 28 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-64406 (GCVE-0-2026-64406)

OESA-2026-3453 (CVE-2026-23336)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour