Vulnerability-Lookup

RHSA-2025:12746

Vulnerability from csaf_redhat - Published: 2025-08-04 16:42 - Updated: 2026-11-11 18:41

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928) * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929) * kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962) * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020) * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-49788

A flaw was found in the Linux kernel's VMware Virtual Machine Communication Interface (VMCI) driver. Memory structures allocated for queue pair event notifications contain uninitialized padding bytes that are copied directly to user space. A local attacker with access to the VMCI device can exploit this flaw to leak sensitive information from kernel memory.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-401 - Missing Release of Memory after Effective Lifetime

Affected products

Fixed 305 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-570.32.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rtla-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rtla-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rtla-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rtla-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rv-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rv-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rv-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.MAIN.EUS:rv-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-0:5.14.0-570.32.1.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-570.32.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-core-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-core-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-uki-virt-addons-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-kvm-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-64k-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-570.32.1.el9_6.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-21726

A flaw was found in the Linux kernel's parallel execution mechanism (padata). A race condition between cryptographic request processing and algorithm removal can cause a use-after-free (accessing memory after it has been released) condition during work reordering. A local user could exploit this vulnerability to trigger a denial of service (DoS) through a system crash or potentially cause memory corruption.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-21727

A use-after-free vulnerability was found in the Linux kernel's padata subsystem, in the `padata_reorder()` function. Caused by improper synchronization controls, this vulnerability can occur when a reference-counted data structure (`pd`) is decremented in one thread, freeing it, while another thread still holds a pointer to it and attempts to access it via `padata_find_next()`. This vulnerability can lead to system instability, denial of service, and potential privilege escalation.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-820 - Missing Synchronization

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-21928

A flaw was found in the Linux kernel's Intel Integrated Sensor Hub (ISH) driver. Improper memory management during driver removal causes device data to be freed prematurely while hardware cleanup operations are still in progress, leading to a use-after-free condition. A local user with administrative privileges to unload kernel drivers can trigger this flaw, causing a system crash and resulting in a Denial of Service (DoS).

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-21929

A flaw was found in the Linux kernel's Intel Integrated Sensor Hub (ISH) driver. An improper teardown order during driver removal causes memory resources to be freed while still in use, resulting in a use-after-free condition. A privileged local attacker could exploit this vulnerability during module unloading to trigger memory corruption or crash the operating system, resulting in a denial of service (DoS).

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-21962

A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. A local user with permissions to mount CIFS shares can specify an excessively large value for the closetimeo mount parameter. Because this value is converted from seconds to internal system timer units before boundary checks are performed, an integer overflow occurs, potentially resulting in system instability or a denial of service (DoS).

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-22020

A flaw was found in the Linux kernel's Realtek RTSX USB MemoryStick driver. A race condition occurs during device removal because the driver releases resources before canceling a background card-polling task, resulting in a use-after-free vulnerability. A local user with administrative privileges or an attacker with physical access to disconnect the device can exploit this flaw to cause a Denial of Service (DoS) by crashing the system or potentially execute arbitrary code.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-37890

A use-after-free vulnerability has been identified in the Linux kernel's HFSC (Hierarchical Fair Service Curve) queuing discipline when it is configured with NETEM (Network Emulation) as a child. This flaw can lead to a kernel panic or crash due to incorrect assumptions about the queue state. Exploitation of this vulnerability requires local access with CAP_NET_ADMIN privileges and control over the qdisc (queueing discipline) setup. A local attacker could leverage this flaw to achieve denial of service or escalate privileges. Given that it affects kernel memory structures, successful exploitation could result in memory corruption, data leaks, or arbitrary write capabilities, leading to a full kernel crash.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-38052

A vulnerability was found in the Linux kernel's management of network namespaces. By manipulating the lifecycle of network namespaces, an attacker could exploit this vulnerability to cause a system crash or leak sensitive system memory. Exploitation of this vulnerability requires that a user has access to the system and the ability to create or destroy network namespaces. This typically requires administrative privileges, but could be exposed to an unprivileged user who has control over container lifecycles or a user who has administrative privileges within a container.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

CVE-2025-38087

A flaw was found in the Linux kernel's Time-Aware Priority (taprio) network scheduler. A local user with permissions to configure network traffic control can exploit a race condition between scheduler updates and device notifications to trigger a use-after-free condition. This flaw could lead to kernel memory corruption, potentially allowing local privilege escalation or causing a Denial of Service (DoS) through a system crash.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2022-49788

Threats

Impact Moderate

References

65 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:12746	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2348516	external
https://bugzilla.redhat.com/show_bug.cgi?id=2356592	external
https://bugzilla.redhat.com/show_bug.cgi?id=2356594	external
https://bugzilla.redhat.com/show_bug.cgi?id=2356624	external
https://bugzilla.redhat.com/show_bug.cgi?id=2360099	external
https://bugzilla.redhat.com/show_bug.cgi?id=2363378	external
https://bugzilla.redhat.com/show_bug.cgi?id=2366848	external
https://bugzilla.redhat.com/show_bug.cgi?id=2373380	external
https://bugzilla.redhat.com/show_bug.cgi?id=2375531	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2022-49788	self
https://bugzilla.redhat.com/show_bug.cgi?id=2363378	external
https://www.cve.org/CVERecord?id=CVE-2022-49788	external
https://nvd.nist.gov/vuln/detail/CVE-2022-49788	external
https://lore.kernel.org/linux-cve-announce/202505…	external
https://access.redhat.com/security/cve/CVE-2025-21726	self
https://bugzilla.redhat.com/show_bug.cgi?id=2348600	external
https://www.cve.org/CVERecord?id=CVE-2025-21726	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21726	external
https://kernelcve.org/list/?q=CVE-2025-21726	external
https://lore.kernel.org/linux-cve-announce/202502…	external
https://access.redhat.com/security/cve/CVE-2025-21727	self
https://bugzilla.redhat.com/show_bug.cgi?id=2348516	external
https://www.cve.org/CVERecord?id=CVE-2025-21727	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21727	external
https://lore.kernel.org/linux-cve-announce/202502…	external
https://access.redhat.com/security/cve/CVE-2025-21928	self
https://bugzilla.redhat.com/show_bug.cgi?id=2356592	external
https://www.cve.org/CVERecord?id=CVE-2025-21928	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21928	external
https://lore.kernel.org/linux-cve-announce/202504…	external
https://access.redhat.com/security/cve/CVE-2025-21929	self
https://bugzilla.redhat.com/show_bug.cgi?id=2356594	external
https://www.cve.org/CVERecord?id=CVE-2025-21929	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21929	external
https://lore.kernel.org/linux-cve-announce/202504…	external
https://access.redhat.com/security/cve/CVE-2025-21962	self
https://bugzilla.redhat.com/show_bug.cgi?id=2356624	external
https://www.cve.org/CVERecord?id=CVE-2025-21962	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21962	external
https://lore.kernel.org/linux-cve-announce/202504…	external
https://access.redhat.com/security/cve/CVE-2025-22020	self
https://bugzilla.redhat.com/show_bug.cgi?id=2360099	external
https://www.cve.org/CVERecord?id=CVE-2025-22020	external
https://nvd.nist.gov/vuln/detail/CVE-2025-22020	external
https://lore.kernel.org/linux-cve-announce/202504…	external
https://access.redhat.com/security/cve/CVE-2025-37890	self
https://bugzilla.redhat.com/show_bug.cgi?id=2366848	external
https://www.cve.org/CVERecord?id=CVE-2025-37890	external
https://nvd.nist.gov/vuln/detail/CVE-2025-37890	external
https://kernelcve.org/list/?q=CVE-2025-37890	external
https://lore.kernel.org/linux-cve-announce/202505…	external
https://access.redhat.com/security/cve/CVE-2025-38052	self
https://bugzilla.redhat.com/show_bug.cgi?id=2373380	external
https://www.cve.org/CVERecord?id=CVE-2025-38052	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38052	external
https://lore.kernel.org/linux-cve-announce/202506…	external
https://access.redhat.com/security/cve/CVE-2025-38087	self
https://bugzilla.redhat.com/show_bug.cgi?id=2375531	external
https://www.cve.org/CVERecord?id=CVE-2025-38087	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38087	external
https://kernelcve.org/list/?q=CVE-2025-38087	external
https://lore.kernel.org/linux-cve-announce/202506…	external

JSON

To clipboard

Loading 1.2 MB of JSON…

BDU:2026-03966 (CVE-2022-49788)

Vulnerability from fstec – Published: 2026-03-26 – Updated: 2026-03-26 – View on bdu.fstec.ru Fixed

Title

Уязвимость функций qp_notify_peer_local() и qp_notify_peer() модуля drivers/misc/vmw_vmci/vmci_queue_pair.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функций qp_notify_peer_local() и qp_notify_peer() модуля drivers/misc/vmw_vmci/vmci_queue_pair.c ядра операционной системы Linux связана с доступом к неинициализированному указателю. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity

4.6 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:N/I:N/A:C

5.5 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation, Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-824 - Доступ неинициализированного указателя
CWE-908 - Использование неинициализированного ресурса

Aliases

CVE-2022-49788, RHSA-2025:11298, RHSA-2025:11299, RHSA-2025:12746, RHSA-2025:13029, RHSA-2025:13030, RHSA-2025:13061, RHSA-2025:13120, RHSA-2025:13135, RHSA-2025:13633, RHSA-2025:13776, RHSA-2025:13781, RHSA-2025:14136, RHSA-2025:14746, RHSA-2025:14748

References

19 references

URL
https://git.kernel.org/stable/c/f04586c2315cfd03d72ad0395705435e7ed07b1a
https://git.kernel.org/stable/c/7ccf7229b96fadc3a185d1391f814a604c7ef609
https://git.kernel.org/stable/c/5a275528025ae4bc7e2232866856dfebf84b2fad
https://git.kernel.org/stable/c/8e2f33c598370bcf828bab4d667d1d38bcd3c57d
https://git.kernel.org/stable/c/76c50d77b928a33e5290aaa9fdc10e88254ff8c7
https://git.kernel.org/stable/c/e7061dd1fef2dfb6458cd521aef27aa66f510d31
https://git.kernel.org/stable/c/62634b43d3c4e1bf62fd540196f7081bf0885c0a
https://www.cve.org/CVERecord?id=CVE-2022-49788
https://git.kernel.org/linus/e5b0d06d9b10f5f43101bd6598b076c347f9295f
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.334
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.300
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.267
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.225
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.156
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.80
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.10
https://access.redhat.com/security/cve/cve-2022-49788
https://security-tracker.debian.org/tracker/CVE-2022-49788
https://ubuntu.com/security/CVE-2022-49788

Impacted products

4 products from 4 vendors

Vendors

Canonical Ltd., Red Hat, Inc., Сообщество свободного программного обеспечения

Products

Ubuntu, Red Hat Enterprise Linux, Debian GNU/Linux, Linux

Versions

16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), от 5.5 до 5.10.155 включительно (Linux), от 5.11 до 5.15.79 включительно (Linux), от 5.16 до 6.0.9 включительно (Linux), от 4.10 до 4.14.299 включительно (Linux), от 4.15 до 4.19.266 включительно (Linux), от 4.20 до 5.4.224 включительно (Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 9.4 Extended Update Support (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), от 3.9 до 4.9.333 включительно (Linux)

Product types

Operating system

Platforms

Canonical Ltd. Ubuntu 16.04 LTS, Canonical Ltd. Ubuntu 18.04 LTS, Red Hat, Inc. Red Hat Enterprise Linux 8, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support, Сообщество свободного программного обеспечения Linux от 5.5 до 5.10.155 включительно, Сообщество свободного программного обеспечения Linux от 5.11 до 5.15.79 включительно, Сообщество свободного программного обеспечения Linux от 5.16 до 6.0.9 включительно, Сообщество свободного программного обеспечения Linux от 4.10 до 4.14.299 включительно, Сообщество свободного программного обеспечения Linux от 4.15 до 4.19.266 включительно, Сообщество свободного программного обеспечения Linux от 4.20 до 5.4.224 включительно, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Сообщество свободного программного обеспечения Linux от 3.9 до 4.9.333 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/f04586c2315cfd03d72ad0395705435e7ed07b1a https://git.kernel.org/stable/c/7ccf7229b96fadc3a185d1391f814a604c7ef609 https://git.kernel.org/stable/c/5a275528025ae4bc7e2232866856dfebf84b2fad https://git.kernel.org/stable/c/8e2f33c598370bcf828bab4d667d1d38bcd3c57d https://git.kernel.org/stable/c/76c50d77b928a33e5290aaa9fdc10e88254ff8c7 https://git.kernel.org/stable/c/e7061dd1fef2dfb6458cd521aef27aa66f510d31 https://git.kernel.org/stable/c/62634b43d3c4e1bf62fd540196f7081bf0885c0a Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2022-49788 Для программных продуктов Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2022-49788 Для программных продуктов Ubuntu: https://ubuntu.com/security/CVE-2022-49788

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Red Hat, Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "16.04 LTS (Ubuntu), 18.04 LTS (Ubuntu), 8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), \u043e\u0442 5.5 \u0434\u043e 5.10.155 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.11 \u0434\u043e 5.15.79 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.16 \u0434\u043e 6.0.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.10 \u0434\u043e 4.14.299 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.15 \u0434\u043e 4.19.266 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.20 \u0434\u043e 5.4.224 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 7 Extended Lifecycle Support (Red Hat Enterprise Linux), 9.4 Extended Update Support (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux), \u043e\u0442 3.9 \u0434\u043e 4.9.333 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/f04586c2315cfd03d72ad0395705435e7ed07b1a\nhttps://git.kernel.org/stable/c/7ccf7229b96fadc3a185d1391f814a604c7ef609\nhttps://git.kernel.org/stable/c/5a275528025ae4bc7e2232866856dfebf84b2fad\nhttps://git.kernel.org/stable/c/8e2f33c598370bcf828bab4d667d1d38bcd3c57d\nhttps://git.kernel.org/stable/c/76c50d77b928a33e5290aaa9fdc10e88254ff8c7\nhttps://git.kernel.org/stable/c/e7061dd1fef2dfb6458cd521aef27aa66f510d31\nhttps://git.kernel.org/stable/c/62634b43d3c4e1bf62fd540196f7081bf0885c0a\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2022-49788\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2022-49788\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2022-49788",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.11.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.03.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.03.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-03966",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-49788, RHSA-2025:11298, RHSA-2025:11299, RHSA-2025:12746, RHSA-2025:13029, RHSA-2025:13030, RHSA-2025:13061, RHSA-2025:13120, RHSA-2025:13135, RHSA-2025:13633, RHSA-2025:13776, RHSA-2025:13781, RHSA-2025:14136, RHSA-2025:14746, RHSA-2025:14748",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Red Hat Enterprise Linux, Debian GNU/Linux, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 16.04 LTS , Canonical Ltd. Ubuntu 18.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.5 \u0434\u043e 5.10.155 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.11 \u0434\u043e 5.15.79 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.16 \u0434\u043e 6.0.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.10 \u0434\u043e 4.14.299 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.15 \u0434\u043e 4.19.266 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.20 \u0434\u043e 5.4.224 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support , Red Hat, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support , Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support , Red Hat, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 3.9 \u0434\u043e 4.9.333 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 qp_notify_peer_local() \u0438 qp_notify_peer() \u043c\u043e\u0434\u0443\u043b\u044f drivers/misc/vmw_vmci/vmci_queue_pair.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0414\u043e\u0441\u0442\u0443\u043f \u043d\u0435\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f (CWE-824), \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (CWE-908)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 qp_notify_peer_local() \u0438 qp_notify_peer() \u043c\u043e\u0434\u0443\u043b\u044f drivers/misc/vmw_vmci/vmci_queue_pair.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043d\u0435\u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044e. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/f04586c2315cfd03d72ad0395705435e7ed07b1a\nhttps://git.kernel.org/stable/c/7ccf7229b96fadc3a185d1391f814a604c7ef609\nhttps://git.kernel.org/stable/c/5a275528025ae4bc7e2232866856dfebf84b2fad\nhttps://git.kernel.org/stable/c/8e2f33c598370bcf828bab4d667d1d38bcd3c57d\nhttps://git.kernel.org/stable/c/76c50d77b928a33e5290aaa9fdc10e88254ff8c7\nhttps://git.kernel.org/stable/c/e7061dd1fef2dfb6458cd521aef27aa66f510d31\nhttps://git.kernel.org/stable/c/62634b43d3c4e1bf62fd540196f7081bf0885c0a\nhttps://www.cve.org/CVERecord?id=CVE-2022-49788\nhttps://git.kernel.org/linus/e5b0d06d9b10f5f43101bd6598b076c347f9295f\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.334\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.300\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.267\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.225\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.156\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.80\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.10\nhttps://access.redhat.com/security/cve/cve-2022-49788\nhttps://security-tracker.debian.org/tracker/CVE-2022-49788\nhttps://ubuntu.com/security/CVE-2022-49788",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-824, CWE-908",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

CVE-2022-49788 (GCVE-0-2022-49788)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:09 – Updated: 2026-11-05 19:49

Title

misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

Summary

In the Linux kernel, the following vulnerability has been resolved: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() `struct vmci_event_qp` allocated by qp_notify_peer() contains padding, which may carry uninitialized data to the userspace, as observed by KMSAN: BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121 instrument_copy_to_user ./include/linux/instrumented.h:121 _copy_to_user+0x5f/0xb0 lib/usercopy.c:33 copy_to_user ./include/linux/uaccess.h:169 vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431 vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925 vfs_ioctl fs/ioctl.c:51 ... Uninit was stored to memory at: kmemdup+0x74/0xb0 mm/util.c:131 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271 vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339 qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479 qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662 qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750 vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940 vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488 vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927 ... Local variable ev created at: qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456 qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662 qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750 Bytes 28-31 of 48 are uninitialized Memory access of size 48 starts at ffff888035155e00 Data copied to user address 0000000020000100 Use memset() to prevent the infoleaks. Also speculatively fix qp_notify_peer_local(), which may suffer from the same problem.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:48 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7ccf7229b96fadc3a…
https://git.kernel.org/stable/c/f04586c2315cfd03d…
https://git.kernel.org/stable/c/5a275528025ae4bc7…
https://git.kernel.org/stable/c/e7061dd1fef2dfb64…
https://git.kernel.org/stable/c/62634b43d3c4e1bf6…
https://git.kernel.org/stable/c/8e2f33c598370bcf8…
https://git.kernel.org/stable/c/76c50d77b928a33e5…
https://git.kernel.org/stable/c/e5b0d06d9b10f5f43…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < 7ccf7229b96fadc3a185d1391f814a604c7ef609 (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < f04586c2315cfd03d72ad0395705435e7ed07b1a (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < 5a275528025ae4bc7e2232866856dfebf84b2fad (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < e7061dd1fef2dfb6458cd521aef27aa66f510d31 (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < 62634b43d3c4e1bf62fd540196f7081bf0885c0a (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < 8e2f33c598370bcf828bab4d667d1d38bcd3c57d (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < 76c50d77b928a33e5290aaa9fdc10e88254ff8c7 (git) Affected: 06164d2b72aa752ce4633184b3e0d97601017135 , < e5b0d06d9b10f5f43101bd6598b076c347f9295f (git)
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 4.9.334 , ≤ 4.9.* (semver) Unaffected: 4.14.300 , ≤ 4.14.* (semver) Unaffected: 4.19.267 , ≤ 4.19.* (semver) Unaffected: 5.4.225 , ≤ 5.4.* (semver) Unaffected: 5.10.156 , ≤ 5.10.* (semver) Unaffected: 5.15.80 , ≤ 5.15.* (semver) Unaffected: 6.0.10 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:48:00.593549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:49:48.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_vmci/vmci_queue_pair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ccf7229b96fadc3a185d1391f814a604c7ef609",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "f04586c2315cfd03d72ad0395705435e7ed07b1a",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "5a275528025ae4bc7e2232866856dfebf84b2fad",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "e7061dd1fef2dfb6458cd521aef27aa66f510d31",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "62634b43d3c4e1bf62fd540196f7081bf0885c0a",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "76c50d77b928a33e5290aaa9fdc10e88254ff8c7",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            },
            {
              "lessThan": "e5b0d06d9b10f5f43101bd6598b076c347f9295f",
              "status": "affected",
              "version": "06164d2b72aa752ce4633184b3e0d97601017135",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_vmci/vmci_queue_pair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.334",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.334",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.300",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.267",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.225",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.156",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.80",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.10",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()\n\n`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,\nwhich may carry uninitialized data to the userspace, as observed by\nKMSAN:\n\n  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121\n   instrument_copy_to_user ./include/linux/instrumented.h:121\n   _copy_to_user+0x5f/0xb0 lib/usercopy.c:33\n   copy_to_user ./include/linux/uaccess.h:169\n   vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431\n   vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925\n   vfs_ioctl fs/ioctl.c:51\n  ...\n\n  Uninit was stored to memory at:\n   kmemdup+0x74/0xb0 mm/util.c:131\n   dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271\n   vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339\n   qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479\n   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662\n   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750\n   vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940\n   vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488\n   vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927\n  ...\n\n  Local variable ev created at:\n   qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456\n   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662\n   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750\n\n  Bytes 28-31 of 48 are uninitialized\n  Memory access of size 48 starts at ffff888035155e00\n  Data copied to user address 0000000020000100\n\nUse memset() to prevent the infoleaks.\n\nAlso speculatively fix qp_notify_peer_local(), which may suffer from the\nsame problem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:06:47.654Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ccf7229b96fadc3a185d1391f814a604c7ef609"
        },
        {
          "url": "https://git.kernel.org/stable/c/f04586c2315cfd03d72ad0395705435e7ed07b1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a275528025ae4bc7e2232866856dfebf84b2fad"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7061dd1fef2dfb6458cd521aef27aa66f510d31"
        },
        {
          "url": "https://git.kernel.org/stable/c/62634b43d3c4e1bf62fd540196f7081bf0885c0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e2f33c598370bcf828bab4d667d1d38bcd3c57d"
        },
        {
          "url": "https://git.kernel.org/stable/c/76c50d77b928a33e5290aaa9fdc10e88254ff8c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5b0d06d9b10f5f43101bd6598b076c347f9295f"
        }
      ],
      "title": "misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49788",
    "datePublished": "2025-05-01T14:09:20.506Z",
    "dateReserved": "2025-05-01T14:05:17.223Z",
    "dateUpdated": "2026-11-05T19:49:48.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21726 (GCVE-0-2025-21726)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-10-15 01:03

Title

padata: avoid UAF for reorder_work

Summary

In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below: crypto_request crypto_request crypto_del_alg padata_do_serial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... } padata_do_serial // new request added list_add // sees the new request queue_work(reorder_work) padata_reorder queue_work_on(squeue->work) ... <kworker context> padata_serial_worker // completes new request, // no more outstanding // requests crypto_del_alg // free pd <kworker context> invoke_padata_reorder // UAF of pd To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 17:58 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/f4f1b1169fc3694f9…
https://git.kernel.org/stable/c/4c6209efea2208597…
https://git.kernel.org/stable/c/7000507bb0d2ceb54…
https://git.kernel.org/stable/c/6f45ef616775b0ce7…
https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd…
https://git.kernel.org/stable/c/a54091c24220a4cd8…
https://git.kernel.org/stable/c/dd7d37ccf6b11f3d9…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0 (git) Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1 (git) Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 7000507bb0d2ceb545c0a690e0c707c897d102c2 (git) Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 6f45ef616775b0ce7889b0f6077fc8d681ab30bc (git) Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac (git) Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < a54091c24220a4cd847d5b4f36d678edacddbaf0 (git) Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 (git) Affected: b4c8ed0bf977760a206997b6429a7ac91978f440 (git) Affected: e43d65719527043f1ef79ecba9d4ede58cbc7ffe (git) Affected: 5.4.19 , < 5.5 (semver) Affected: 5.5.3 , < 5.6 (semver)
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.76 , ≤ 6.6.* (semver) Unaffected: 6.12.13 , ≤ 6.12.* (semver) Unaffected: 6.13.2 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:58:10.478288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:28.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:27.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:03:46.766Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "7000507bb0d2ceb545c0a690e0c707c897d102c2",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "6f45ef616775b0ce7889b0f6077fc8d681ab30bc",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "a54091c24220a4cd847d5b4f36d678edacddbaf0",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "dd7d37ccf6b11f3d95e797ebe4e9e886d0332600",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b4c8ed0bf977760a206997b6429a7ac91978f440",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e43d65719527043f1ef79ecba9d4ede58cbc7ffe",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: avoid UAF for reorder_work\n\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\ncan not avoid potential UAF issue for reorder_work. This issue can\nhappen just as below:\n\ncrypto_request\t\t\tcrypto_request\t\tcrypto_del_alg\npadata_do_serial\n  ...\n  padata_reorder\n    // processes all remaining\n    // requests then breaks\n    while (1) {\n      if (!padata)\n        break;\n      ...\n    }\n\n\t\t\t\tpadata_do_serial\n\t\t\t\t  // new request added\n\t\t\t\t  list_add\n    // sees the new request\n    queue_work(reorder_work)\n\t\t\t\t  padata_reorder\n\t\t\t\t    queue_work_on(squeue-\u003ework)\n...\n\n\t\t\t\t\u003ckworker context\u003e\n\t\t\t\tpadata_serial_worker\n\t\t\t\t// completes new request,\n\t\t\t\t// no more outstanding\n\t\t\t\t// requests\n\n\t\t\t\t\t\t\tcrypto_del_alg\n\t\t\t\t\t\t\t  // free pd\n\n\u003ckworker context\u003e\ninvoke_padata_reorder\n  // UAF of pd\n\nTo avoid UAF for \u0027reorder_work\u0027, get \u0027pd\u0027 ref before put \u0027reorder_work\u0027\ninto the \u0027serial_wq\u0027 and put \u0027pd\u0027 ref until the \u0027serial_wq\u0027 finish."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable padata reorder machinery is driven through pcrypt, reached locally via AF_ALG (`algif_aead`) socket operations or local xfrm/IPsec setup, and the `pd` free is triggered by local crypto-netlink/CPU-hotplug activity. No remote peer can reach or free the `parallel_data` object, so the attack requires local system access.\nAC:L - The attacker controls both sides of the race \u2014 they submit an unbounded stream of concurrent pcrypt AEAD requests to keep `reorder_work` queued while simultaneously driving the shell/pd teardown, and `serial_wq` is allocated with `max_active=1`, so `reorder_work` is routinely stalled behind serial workers, widening the window. Repeated attempts in a tight loop make the race reliably winnable, as the LTP `pcrypt_aead01` reproducer for the sibling bug demonstrates.\nPR:L - An unprivileged local user can fully drive the parallel/serial request side with no capability check at all via `AF_ALG` `algif_aead` binding `pcrypt(rfc4106(gcm(aes)))`, and the pd-release side is reachable through `padata_replace()` on CPU hotplug (suspend/resume, which logind grants to active unprivileged sessions) as well as through crypto netlink. No root-only gate is required on the path that actually corrupts memory.\nUI:N - The attacker issues both the crypto requests and the teardown that frees `parallel_data` themselves; no victim must mount a filesystem, open a file, or take any other action.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After `pd` is freed and reclaimed by sprayed attacker data, `padata_reorder()` follows `pd-\u003eps-\u003epinst`, `pd-\u003ereorder_list`, `pd-\u003esqueue` and `pd-\u003ecpumask.pcpu` out of the freed object, giving an attacker-directed read primitive over arbitrary kernel memory and disclosure of kernel state.\nI:H - The same freed object yields write primitives \u2014 `spin_trylock_bh(\u0026pd-\u003elock)`, `refcount_inc(\u0026pd-\u003erefcnt)`, `++pd-\u003eprocessed`, and especially `list_del_init()`/`list_add_tail()` through attacker-controlled `reorder_list`/`squeue` pointers, plus a controlled `workqueue_struct *` fed to `queue_work_on()` \u2014 which is exploitable for arbitrary write and control-flow hijack leading to privilege escalation.\nA:H - Even without successful heap grooming, dereferencing the freed `parallel_data` reliably produces a KASAN slab-use-after-free splat, spinlock corruption, and kernel oops/panic, taking the whole system down; the crash can be reproduced repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:59.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600"
        }
      ],
      "title": "padata: avoid UAF for reorder_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21726",
    "datePublished": "2025-02-27T02:07:32.861Z",
    "dateReserved": "2024-12-29T08:45:45.754Z",
    "dateUpdated": "2026-10-15T01:03:46.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21727 (GCVE-0-2025-21727)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-10-15 01:03

Title

padata: fix UAF in padata_reorder

Summary

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01). This can be explained as bellow: pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker crypto_del_alg padata_put_pd_cnt // sub refcnt padata_free_shell padata_put_pd(ps->pd); // pd is freed // loop again, but pd is freed // call padata_find_next, UAF } In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF. As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls to finish. [1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/ [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 17:58 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/f78170bee51469734…
https://git.kernel.org/stable/c/f3e0b9f790f8e8065…
https://git.kernel.org/stable/c/0ae2f332cfd2d74cf…
https://git.kernel.org/stable/c/bbccae982e9fa1d7a…
https://git.kernel.org/stable/c/573ac9c70bf7885dc…
https://git.kernel.org/stable/c/80231f069240d52e9…
https://git.kernel.org/stable/c/e01780ea466117273…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < f78170bee51469734b1a306a74fc5f777bb22ba6 (git) Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < f3e0b9f790f8e8065d59e67b565a83154d9f3079 (git) Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < 0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd (git) Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de (git) Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < 573ac9c70bf7885dc85d82fa44550581bfc3b738 (git) Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < 80231f069240d52e98b6a317456c67b2eafd0781 (git) Affected: b128a30409356df65f1a51cff3eb986cac8cfedc , < e01780ea4661172734118d2a5f41bc9720765668 (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.129 , ≤ 6.1.* (semver) Unaffected: 6.6.76 , ≤ 6.6.* (semver) Unaffected: 6.12.13 , ≤ 6.12.* (semver) Unaffected: 6.13.2 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21727",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:58:06.104597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:27.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:30.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:03:48.046Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f78170bee51469734b1a306a74fc5f777bb22ba6",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            },
            {
              "lessThan": "f3e0b9f790f8e8065d59e67b565a83154d9f3079",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            },
            {
              "lessThan": "0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            },
            {
              "lessThan": "bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            },
            {
              "lessThan": "573ac9c70bf7885dc85d82fa44550581bfc3b738",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            },
            {
              "lessThan": "80231f069240d52e98b6a317456c67b2eafd0781",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            },
            {
              "lessThan": "e01780ea4661172734118d2a5f41bc9720765668",
              "status": "affected",
              "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: fix UAF in padata_reorder\n\nA bug was found when run ltp test:\n\nBUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0\nRead of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206\n\nCPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+\nWorkqueue: pdecrypt_parallel padata_parallel_worker\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x32/0x50\nprint_address_description.constprop.0+0x6b/0x3d0\nprint_report+0xdd/0x2c0\nkasan_report+0xa5/0xd0\npadata_find_next+0x29/0x1a0\npadata_reorder+0x131/0x220\npadata_parallel_worker+0x3d/0xc0\nprocess_one_work+0x2ec/0x5a0\n\nIf \u0027mdelay(10)\u0027 is added before calling \u0027padata_find_next\u0027 in the\n\u0027padata_reorder\u0027 function, this issue could be reproduced easily with\nltp test (pcrypt_aead01).\n\nThis can be explained as bellow:\n\npcrypt_aead_encrypt\n...\npadata_do_parallel\nrefcount_inc(\u0026pd-\u003erefcnt); // add refcnt\n...\npadata_do_serial\npadata_reorder // pd\nwhile (1) {\npadata_find_next(pd, true); // using pd\nqueue_work_on\n...\npadata_serial_worker\t\t\t\tcrypto_del_alg\npadata_put_pd_cnt // sub refcnt\n\t\t\t\t\t\tpadata_free_shell\n\t\t\t\t\t\tpadata_put_pd(ps-\u003epd);\n\t\t\t\t\t\t// pd is freed\n// loop again, but pd is freed\n// call padata_find_next, UAF\n}\n\nIn the padata_reorder function, when it loops in \u0027while\u0027, if the alg is\ndeleted, the refcnt may be decreased to 0 before entering\n\u0027padata_find_next\u0027, which leads to UAF.\n\nAs mentioned in [1], do_serial is supposed to be called with BHs disabled\nand always happen under RCU protection, to address this issue, add\nsynchronize_rcu() in \u0027padata_free_shell\u0027 wait for all _do_serial calls\nto finish.\n\n[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/\n[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable padata/pcrypt path is driven through local syscalls \u2014 an AF_ALG socket bound to `pcrypt(...)` submitting aead requests, and the racing teardown via crypto module autoload or the NETLINK_CRYPTO socket. No remote peer can reach or free the padata shell on its own.\nAC:L - The attacker controls both sides of the race: they flood concurrent pcrypt requests to keep `padata_reorder()` spinning in its loop while triggering instance teardown, and can widen the window with CPU contention and many parallel workers. The commit confirms it reproduces with a stock LTP test (pcrypt_aead01) once the loop is delayed, meaning it is a naturally occurring, repeatable window.\nPR:L - A basic unprivileged local user can both instantiate and continuously drive pcrypt via AF_ALG (`alg_bind` performs no capability check) and trigger the teardown side, since `crypto_alg_finish_registration()` \u2192 `crypto_remove_spawns()` destroys the pcrypt instance when an equal-or-higher-priority same-named implementation registers \u2014 a module autoload reachable from the same unprivileged bind path.\nUI:N - Exploitation is entirely attacker-driven through socket operations and crypto requests; no victim action, mount, or file open is required.\nS:U - The use-after-free corrupts kernel slab memory and stays within the kernel\u0027s own security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Reclaiming the freed `struct parallel_data` gives the attacker control of `pd-\u003ereorder_list`, whose per-CPU dereference in `padata_find_next()` becomes an attacker-directed kernel read, and `pd-\u003eps-\u003epinst` is likewise dereferenced \u2014 yielding disclosure of arbitrary kernel memory.\nI:H - The same UAF provides write primitives \u2014 `list_del_init()` unlink on an attacker-controlled reorder list, `++pd-\u003eprocessed` / `pd-\u003ecpu` writes, and most severely `queue_work(pinst-\u003eserial_wq, \u0026pd-\u003ereorder_work)` invoking a function pointer living in freed, sprayable memory, enabling control-flow hijack and privilege escalation.\nA:H - Even unweaponized, the slab-use-after-free reported by KASAN dereferences freed percpu and workqueue pointers from a kworker context, reliably producing an oops or kernel panic and taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:00.224Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f78170bee51469734b1a306a74fc5f777bb22ba6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e0b9f790f8e8065d59e67b565a83154d9f3079"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de"
        },
        {
          "url": "https://git.kernel.org/stable/c/573ac9c70bf7885dc85d82fa44550581bfc3b738"
        },
        {
          "url": "https://git.kernel.org/stable/c/80231f069240d52e98b6a317456c67b2eafd0781"
        },
        {
          "url": "https://git.kernel.org/stable/c/e01780ea4661172734118d2a5f41bc9720765668"
        }
      ],
      "title": "padata: fix UAF in padata_reorder",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21727",
    "datePublished": "2025-02-27T02:07:33.501Z",
    "dateReserved": "2024-12-29T08:45:45.754Z",
    "dateUpdated": "2026-10-15T01:03:48.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21928 (GCVE-0-2025-21928)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:40 – Updated: 2026-05-11 21:09

Title

HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

Summary

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-16 13:15 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/0c1fb475ef999d6c2…
https://git.kernel.org/stable/c/d3faae7f42181865c…
https://git.kernel.org/stable/c/01b18a330cda61cc2…
https://git.kernel.org/stable/c/cf1a6015d2f6b1f0a…
https://git.kernel.org/stable/c/560f4d1299342504a…
https://git.kernel.org/stable/c/dea6a349bcaf243ff…
https://git.kernel.org/stable/c/eb0695d87a81e7c1f…
https://git.kernel.org/stable/c/07583a0010696a17f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < 0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < d3faae7f42181865c799d88c5054176f38ae4625 (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < 01b18a330cda61cc21423a7d1af92cf31ded8f60 (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < 560f4d1299342504a6ab8a47f575b5e6b8345ada (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < dea6a349bcaf243fff95dfd0428a26be6a0fb44e (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9 (git) Affected: 0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6 , < 07583a0010696a17fb0942e0b499a62785c5fc9f (git)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 5.4.291 , ≤ 5.4.* (semver) Unaffected: 5.10.235 , ≤ 5.10.* (semver) Unaffected: 5.15.179 , ≤ 5.15.* (semver) Unaffected: 6.1.131 , ≤ 6.1.* (semver) Unaffected: 6.6.83 , ≤ 6.6.* (semver) Unaffected: 6.12.19 , ≤ 6.12.* (semver) Unaffected: 6.13.7 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21928",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T13:15:05.405186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T13:19:52.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:39:26.507Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ishtp-hid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "d3faae7f42181865c799d88c5054176f38ae4625",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "01b18a330cda61cc21423a7d1af92cf31ded8f60",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "560f4d1299342504a6ab8a47f575b5e6b8345ada",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "dea6a349bcaf243fff95dfd0428a26be6a0fb44e",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            },
            {
              "lessThan": "07583a0010696a17fb0942e0b499a62785c5fc9f",
              "status": "affected",
              "version": "0b28cb4bcb17dcb5fe0763fc3e1a94398b8f6cf6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ishtp-hid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.131",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.83",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()\n\nThe system can experience a random crash a few minutes after the driver is\nremoved. This issue occurs due to improper handling of memory freeing in\nthe ishtp_hid_remove() function.\n\nThe function currently frees the `driver_data` directly within the loop\nthat destroys the HID devices, which can lead to accessing freed memory.\nSpecifically, `hid_destroy_device()` uses `driver_data` when it calls\n`hid_ishtp_set_feature()` to power off the sensor, so freeing\n`driver_data` beforehand can result in accessing invalid memory.\n\nThis patch resolves the issue by storing the `driver_data` in a temporary\nvariable before calling `hid_destroy_device()`, and then freeing the\n`driver_data` after the device is destroyed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:09:14.996Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3faae7f42181865c799d88c5054176f38ae4625"
        },
        {
          "url": "https://git.kernel.org/stable/c/01b18a330cda61cc21423a7d1af92cf31ded8f60"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394"
        },
        {
          "url": "https://git.kernel.org/stable/c/560f4d1299342504a6ab8a47f575b5e6b8345ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/dea6a349bcaf243fff95dfd0428a26be6a0fb44e"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9"
        },
        {
          "url": "https://git.kernel.org/stable/c/07583a0010696a17fb0942e0b499a62785c5fc9f"
        }
      ],
      "title": "HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21928",
    "datePublished": "2025-04-01T15:40:59.033Z",
    "dateReserved": "2024-12-29T08:45:45.788Z",
    "dateUpdated": "2026-05-11T21:09:14.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21929 (GCVE-0-2025-21929)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:40 – Updated: 2026-05-11 21:09

Title

HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()

Summary

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remove() function. The function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(), which can lead to accessing freed memory or resources during the removal process. Call Trace: ? ishtp_cl_send+0x168/0x220 [intel_ishtp] ? hid_output_report+0xe3/0x150 [hid] hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid] ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid] hid_hw_request+0x1f/0x40 [hid] sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub] _hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger] hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger] sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub] hid_device_remove+0x49/0xb0 [hid] hid_destroy_device+0x6f/0x90 [hid] ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid] hid_ishtp_cl_remove+0x6b/0xb0 [intel_ishtp_hid] ishtp_cl_device_remove+0x4a/0x60 [intel_ishtp] ... Additionally, ishtp_hid_remove() is a HID level power off, which should occur before the ISHTP level disconnect. This patch resolves the issue by reordering the calls in hid_ishtp_cl_remove(). The function ishtp_hid_remove() is now called before hid_ishtp_cl_deinit().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-16 13:14 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/9c677fe859a73f5dd…
https://git.kernel.org/stable/c/e040f11fbca868c6d…
https://git.kernel.org/stable/c/82398784142428933…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f645a90e8ff732c48dd9f18815baef08c44ac8a0 , < 9c677fe859a73f5dd3dd84c27f99e10d28047c73 (git) Affected: f645a90e8ff732c48dd9f18815baef08c44ac8a0 , < e040f11fbca868c6d151e9f2c5730c476abfcf17 (git) Affected: f645a90e8ff732c48dd9f18815baef08c44ac8a0 , < 823987841424289339fdb4ba90e6d2c3792836db (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.19 , ≤ 6.12.* (semver) Unaffected: 6.13.7 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21929",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T13:14:59.850777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T13:19:52.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ishtp-hid-client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c677fe859a73f5dd3dd84c27f99e10d28047c73",
              "status": "affected",
              "version": "f645a90e8ff732c48dd9f18815baef08c44ac8a0",
              "versionType": "git"
            },
            {
              "lessThan": "e040f11fbca868c6d151e9f2c5730c476abfcf17",
              "status": "affected",
              "version": "f645a90e8ff732c48dd9f18815baef08c44ac8a0",
              "versionType": "git"
            },
            {
              "lessThan": "823987841424289339fdb4ba90e6d2c3792836db",
              "status": "affected",
              "version": "f645a90e8ff732c48dd9f18815baef08c44ac8a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-ish-hid/ishtp-hid-client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()\n\nDuring the `rmmod` operation for the `intel_ishtp_hid` driver, a\nuse-after-free issue can occur in the hid_ishtp_cl_remove() function.\nThe function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(),\nwhich can lead to accessing freed memory or resources during the\nremoval process.\n\nCall Trace:\n ? ishtp_cl_send+0x168/0x220 [intel_ishtp]\n ? hid_output_report+0xe3/0x150 [hid]\n hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid]\n ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid]\n hid_hw_request+0x1f/0x40 [hid]\n sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub]\n _hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger]\n hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger]\n sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub]\n hid_device_remove+0x49/0xb0 [hid]\n hid_destroy_device+0x6f/0x90 [hid]\n ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid]\n hid_ishtp_cl_remove+0x6b/0xb0 [intel_ishtp_hid]\n ishtp_cl_device_remove+0x4a/0x60 [intel_ishtp]\n ...\n\nAdditionally, ishtp_hid_remove() is a HID level power off, which should\noccur before the ISHTP level disconnect.\n\nThis patch resolves the issue by reordering the calls in\nhid_ishtp_cl_remove(). The function ishtp_hid_remove() is now\ncalled before hid_ishtp_cl_deinit()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:09:16.182Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c677fe859a73f5dd3dd84c27f99e10d28047c73"
        },
        {
          "url": "https://git.kernel.org/stable/c/e040f11fbca868c6d151e9f2c5730c476abfcf17"
        },
        {
          "url": "https://git.kernel.org/stable/c/823987841424289339fdb4ba90e6d2c3792836db"
        }
      ],
      "title": "HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21929",
    "datePublished": "2025-04-01T15:40:59.761Z",
    "dateReserved": "2024-12-29T08:45:45.789Z",
    "dateUpdated": "2026-05-11T21:09:16.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21962 (GCVE-0-2025-21962)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:46 – Updated: 2026-05-23 15:57

Title

cifs: Fix integer overflow while processing closetimeo mount option

Summary

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 19:22 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/513f6cf2e906a504b…
https://git.kernel.org/stable/c/9968fcf02cf6b0f78…
https://git.kernel.org/stable/c/6c13fcb7cf59ae659…
https://git.kernel.org/stable/c/1c46673be93dd2954…
https://git.kernel.org/stable/c/b24edd5c191c2689c…
https://git.kernel.org/stable/c/d5a30fddfe2f2e540…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1d9cad9c5873097ea141ffc5da1e7921ce765aa8 , < 513f6cf2e906a504b7ab0b62b2eea993a6f64558 (git) Affected: 5efdd9122eff772eae2feae9f0fc0ec02d4846a3 , < 9968fcf02cf6b0f78fbacf3f63e782162603855a (git) Affected: 5efdd9122eff772eae2feae9f0fc0ec02d4846a3 , < 6c13fcb7cf59ae65940da1dfea80144e42921e53 (git) Affected: 5efdd9122eff772eae2feae9f0fc0ec02d4846a3 , < 1c46673be93dd2954f44fe370fb4f2b8e6214224 (git) Affected: 5efdd9122eff772eae2feae9f0fc0ec02d4846a3 , < b24edd5c191c2689c59d0509f0903f9487eb6317 (git) Affected: 5efdd9122eff772eae2feae9f0fc0ec02d4846a3 , < d5a30fddfe2f2e540f6c43b59cf701809995faef (git) Affected: 5.15.107 , < 5.15.180 (semver)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 5.15.180 , ≤ 5.15.* (semver) Unaffected: 6.1.132 , ≤ 6.1.* (semver) Unaffected: 6.6.84 , ≤ 6.6.* (semver) Unaffected: 6.12.20 , ≤ 6.12.* (semver) Unaffected: 6.13.8 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21962",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:22:06.495160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:26:32.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:04.218Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "513f6cf2e906a504b7ab0b62b2eea993a6f64558",
              "status": "affected",
              "version": "1d9cad9c5873097ea141ffc5da1e7921ce765aa8",
              "versionType": "git"
            },
            {
              "lessThan": "9968fcf02cf6b0f78fbacf3f63e782162603855a",
              "status": "affected",
              "version": "5efdd9122eff772eae2feae9f0fc0ec02d4846a3",
              "versionType": "git"
            },
            {
              "lessThan": "6c13fcb7cf59ae65940da1dfea80144e42921e53",
              "status": "affected",
              "version": "5efdd9122eff772eae2feae9f0fc0ec02d4846a3",
              "versionType": "git"
            },
            {
              "lessThan": "1c46673be93dd2954f44fe370fb4f2b8e6214224",
              "status": "affected",
              "version": "5efdd9122eff772eae2feae9f0fc0ec02d4846a3",
              "versionType": "git"
            },
            {
              "lessThan": "b24edd5c191c2689c59d0509f0903f9487eb6317",
              "status": "affected",
              "version": "5efdd9122eff772eae2feae9f0fc0ec02d4846a3",
              "versionType": "git"
            },
            {
              "lessThan": "d5a30fddfe2f2e540f6c43b59cf701809995faef",
              "status": "affected",
              "version": "5efdd9122eff772eae2feae9f0fc0ec02d4846a3",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.180",
              "status": "affected",
              "version": "5.15.107",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.15.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.84",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix integer overflow while processing closetimeo mount option\n\nUser-provided mount parameter closetimeo of type u32 is intended to have\nan upper limit, but before it is validated, the value is converted from\nseconds to jiffies which can lead to an integer overflow.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:30.927Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/513f6cf2e906a504b7ab0b62b2eea993a6f64558"
        },
        {
          "url": "https://git.kernel.org/stable/c/9968fcf02cf6b0f78fbacf3f63e782162603855a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c13fcb7cf59ae65940da1dfea80144e42921e53"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c46673be93dd2954f44fe370fb4f2b8e6214224"
        },
        {
          "url": "https://git.kernel.org/stable/c/b24edd5c191c2689c59d0509f0903f9487eb6317"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5a30fddfe2f2e540f6c43b59cf701809995faef"
        }
      ],
      "title": "cifs: Fix integer overflow while processing closetimeo mount option",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21962",
    "datePublished": "2025-04-01T15:46:59.285Z",
    "dateReserved": "2024-12-29T08:45:45.795Z",
    "dateUpdated": "2026-05-23T15:57:30.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-22020 (GCVE-0-2025-22020)

Vulnerability from cvelistv5 – Published: 2025-04-16 10:20 – Updated: 2026-08-05 11:56

Title

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

Summary

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 17:06 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/914c5e5bfceb9878f…
https://git.kernel.org/stable/c/9dfaf4d723c62bda8…
https://git.kernel.org/stable/c/31f0eaed6914333f4…
https://git.kernel.org/stable/c/52d942a5302eefb3b…
https://git.kernel.org/stable/c/6186fb2cd36317277…
https://git.kernel.org/stable/c/b094e8e3988e02e8c…
https://git.kernel.org/stable/c/0067cb7d7e7c277e9…
https://git.kernel.org/stable/c/75123adf204f997e1…
https://git.kernel.org/stable/c/4676741a3464b300b…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 914c5e5bfceb9878f3056eaf4d1c88f2cbe0a185 (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 9dfaf4d723c62bda8d9d1340e2e78acf0c190439 (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 31f0eaed6914333f42501fc7e0f6830879f5ef2d (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 52d942a5302eefb3b7a3bfee310a5a33feeedc21 (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 6186fb2cd36317277a8423687982140a7f3f7841 (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < b094e8e3988e02e8cef7a756c8d2cea9c12509ab (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 0067cb7d7e7c277e91a0887a3c24e71462379469 (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 75123adf204f997e11bbddee48408c284f51c050 (git) Affected: 6827ca573c03385439fdfc8b512d556dc7c54fc9 , < 4676741a3464b300b486e70585c3c9b692be1632 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.4.292 , ≤ 5.4.* (semver) Unaffected: 5.10.236 , ≤ 5.10.* (semver) Unaffected: 5.15.180 , ≤ 5.15.* (semver) Unaffected: 6.1.133 , ≤ 6.1.* (semver) Unaffected: 6.6.86 , ≤ 6.6.* (semver) Unaffected: 6.12.22 , ≤ 6.12.* (semver) Unaffected: 6.13.10 , ≤ 6.13.* (semver) Unaffected: 6.14.1 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22020",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:06:32.262717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:06:34.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:06.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/memstick/host/rtsx_usb_ms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "914c5e5bfceb9878f3056eaf4d1c88f2cbe0a185",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "9dfaf4d723c62bda8d9d1340e2e78acf0c190439",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "31f0eaed6914333f42501fc7e0f6830879f5ef2d",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "52d942a5302eefb3b7a3bfee310a5a33feeedc21",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "6186fb2cd36317277a8423687982140a7f3f7841",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "b094e8e3988e02e8cef7a756c8d2cea9c12509ab",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "0067cb7d7e7c277e91a0887a3c24e71462379469",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "75123adf204f997e11bbddee48408c284f51c050",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            },
            {
              "lessThan": "4676741a3464b300b486e70585c3c9b692be1632",
              "status": "affected",
              "version": "6827ca573c03385439fdfc8b512d556dc7c54fc9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/memstick/host/rtsx_usb_ms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.133",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.86",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.22",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.10",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove\n\nThis fixes the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\nRead of size 8 at addr ffff888136335380 by task kworker/6:0/140241\n\nCPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G            E      6.14.0-rc6+ #1\nTainted: [E]=UNSIGNED_MODULE\nHardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024\nWorkqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x51/0x70\n print_address_description.constprop.0+0x27/0x320\n ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\n print_report+0x3e/0x70\n kasan_report+0xab/0xe0\n ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\n rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\n ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms]\n ? __pfx___schedule+0x10/0x10\n ? kick_pool+0x3b/0x270\n process_one_work+0x357/0x660\n worker_thread+0x390/0x4c0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x190/0x1d0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 161446:\n kasan_save_stack+0x20/0x40\n kasan_save_track+0x10/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x1a7/0x470\n memstick_alloc_host+0x1f/0xe0 [memstick]\n rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms]\n platform_probe+0x60/0xe0\n call_driver_probe+0x35/0x120\n really_probe+0x123/0x410\n __driver_probe_device+0xc7/0x1e0\n driver_probe_device+0x49/0xf0\n __device_attach_driver+0xc6/0x160\n bus_for_each_drv+0xe4/0x160\n __device_attach+0x13a/0x2b0\n bus_probe_device+0xbd/0xd0\n device_add+0x4a5/0x760\n platform_device_add+0x189/0x370\n mfd_add_device+0x587/0x5e0\n mfd_add_devices+0xb1/0x130\n rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb]\n usb_probe_interface+0x15c/0x460\n call_driver_probe+0x35/0x120\n really_probe+0x123/0x410\n __driver_probe_device+0xc7/0x1e0\n driver_probe_device+0x49/0xf0\n __device_attach_driver+0xc6/0x160\n bus_for_each_drv+0xe4/0x160\n __device_attach+0x13a/0x2b0\n rebind_marked_interfaces.isra.0+0xcc/0x110\n usb_reset_device+0x352/0x410\n usbdev_do_ioctl+0xe5c/0x1860\n usbdev_ioctl+0xa/0x20\n __x64_sys_ioctl+0xc5/0xf0\n do_syscall_64+0x59/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 161506:\n kasan_save_stack+0x20/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x36/0x60\n __kasan_slab_free+0x34/0x50\n kfree+0x1fd/0x3b0\n device_release+0x56/0xf0\n kobject_cleanup+0x73/0x1c0\n rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms]\n platform_remove+0x2f/0x50\n device_release_driver_internal+0x24b/0x2e0\n bus_remove_device+0x124/0x1d0\n device_del+0x239/0x530\n platform_device_del.part.0+0x19/0xe0\n platform_device_unregister+0x1c/0x40\n mfd_remove_devices_fn+0x167/0x170\n device_for_each_child_reverse+0xc9/0x130\n mfd_remove_devices+0x6e/0xa0\n rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb]\n usb_unbind_interface+0xf3/0x3f0\n device_release_driver_internal+0x24b/0x2e0\n proc_disconnect_claim+0x13d/0x220\n usbdev_do_ioctl+0xb5e/0x1860\n usbdev_ioctl+0xa/0x20\n __x64_sys_ioctl+0xc5/0xf0\n do_syscall_64+0x59/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nLast potentially related work creation:\n kasan_save_stack+0x20/0x40\n kasan_record_aux_stack+0x85/0x90\n insert_work+0x29/0x100\n __queue_work+0x34a/0x540\n call_timer_fn+0x2a/0x160\n expire_timers+0x5f/0x1f0\n __run_timer_base.part.0+0x1b6/0x1e0\n run_timer_softirq+0x8b/0xe0\n handle_softirqs+0xf9/0x360\n __irq_exit_rcu+0x114/0x130\n sysvec_apic_timer_interrupt+0x72/0x90\n asm_sysvec_apic_timer_interrupt+0x16/0x20\n\nSecond to last potentially related work creation:\n kasan_save_stack+0x20/0x40\n kasan_record_aux_stack+0x85/0x90\n insert_work+0x29/0x100\n __queue_work+0x34a/0x540\n call_timer_fn+0x2a/0x160\n expire_timers+0x5f/0x1f0\n __run_timer_base.part.0+0x1b6/0x1e0\n run_timer_softirq+0x8b/0xe0\n handle_softirqs+0xf9/0x\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The reporter\u0027s own KASAN trace shows the free being driven entirely from userspace via usbfs ioctls (`USBDEVFS_DISCONNECT_CLAIM` and `USBDEVFS_RESET` through `usbdev_do_ioctl`), requiring no physical manipulation of the reader, only local access to `/dev/bus/usb/...`.\nAC:L - The attacker controls both sides: the poll_card delayed work is perpetually re-armed every 100 jiffies while a MemStick card is powered, so an unbind issued at any moment reliably lands with a pending timer into the freed object, and the disconnect ioctl can be repeated in a loop until the heap is groomed as desired.\nPR:L - Only an ordinary local account with usbfs access (granted to the active seat user by uaccess/plugdev udev rules on common desktop distributions) is needed; the disconnect-claim and device-reset ioctl paths perform no capability check.\nUI:N - The attacker performs the unbind/reset ioctls itself and no action by another user is required; presence of the Realtek USB card reader is a property of the affected configuration, not victim interaction.\nS:U - The use-after-free is confined to kernel slab memory within the same security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed 2048-byte object is re-read by the poll worker and, after slab reclaim, the dangling `ucr`/`pdev`/`msh` pointers loaded from it can be steered to dereference attacker-chosen kernel addresses, yielding an arbitrary-read primitive well beyond the initial 8-byte KASAN-reported leak.\nI:H - The `timer_list` and `work_struct` embedded in the freed region give a direct function-pointer hijack via `call_timer_fn()`, and `mutex_lock(\u0026ucr-\u003edev_mutex)` on a sprayed pointer provides a write primitive, so the UAF is exploitable for control-flow hijack and privilege escalation.\nA:H - The unfixed path reliably produces a slab-use-after-free that KASAN reports and that causes kernel oops/panic in ordinary (non-KASAN) kernels, and the trigger can be repeated at will by an unprivileged local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:02.551Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/914c5e5bfceb9878f3056eaf4d1c88f2cbe0a185"
        },
        {
          "url": "https://git.kernel.org/stable/c/9dfaf4d723c62bda8d9d1340e2e78acf0c190439"
        },
        {
          "url": "https://git.kernel.org/stable/c/31f0eaed6914333f42501fc7e0f6830879f5ef2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/52d942a5302eefb3b7a3bfee310a5a33feeedc21"
        },
        {
          "url": "https://git.kernel.org/stable/c/6186fb2cd36317277a8423687982140a7f3f7841"
        },
        {
          "url": "https://git.kernel.org/stable/c/b094e8e3988e02e8cef7a756c8d2cea9c12509ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/0067cb7d7e7c277e91a0887a3c24e71462379469"
        },
        {
          "url": "https://git.kernel.org/stable/c/75123adf204f997e11bbddee48408c284f51c050"
        },
        {
          "url": "https://git.kernel.org/stable/c/4676741a3464b300b486e70585c3c9b692be1632"
        }
      ],
      "title": "memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22020",
    "datePublished": "2025-04-16T10:20:37.045Z",
    "dateReserved": "2024-12-29T08:45:45.807Z",
    "dateUpdated": "2026-08-05T11:56:02.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-37890 (GCVE-0-2025-37890)

Vulnerability from cvelistv5 – Published: 2025-05-16 13:01 – Updated: 2026-08-05 11:58

Title

net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

Summary

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:42 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/273bbcfa53541cde3…
https://git.kernel.org/stable/c/e0cf8ee23e1915431…
https://git.kernel.org/stable/c/e3e949a39a91d1f82…
https://git.kernel.org/stable/c/8df7d37d626430035…
https://git.kernel.org/stable/c/6082a87af4c52f581…
https://git.kernel.org/stable/c/2e7093c7a8aba5d4f…
https://git.kernel.org/stable/c/ac39fd4a757584d78…
https://git.kernel.org/stable/c/141d34391abbb315d…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 273bbcfa53541cde38b2003ad88a59b770306421 (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < e0cf8ee23e1915431f262a7b2dee0c7a7d699af0 (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < e3e949a39a91d1f829a4890e7dfe9417ac72e4d0 (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 8df7d37d626430035b413b97cee18396b3450bef (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 6082a87af4c52f58150d40dec1716011d871ac21 (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 2e7093c7a8aba5d4f8809f271488e5babe75e202 (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < ac39fd4a757584d78ed062d4f6fd913f83bd98b5 (git) Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 141d34391abbb315d68556b7c67ad97885407547 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.4.294 , ≤ 5.4.* (semver) Unaffected: 5.10.238 , ≤ 5.10.* (semver) Unaffected: 5.15.182 , ≤ 5.15.* (semver) Unaffected: 6.1.138 , ≤ 6.1.* (semver) Unaffected: 6.6.90 , ≤ 6.6.* (semver) Unaffected: 6.12.28 , ≤ 6.12.* (semver) Unaffected: 6.14.6 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:57:02.260Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-37890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:08.844756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:19.853Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "273bbcfa53541cde38b2003ad88a59b770306421",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "8df7d37d626430035b413b97cee18396b3450bef",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "6082a87af4c52f58150d40dec1716011d871ac21",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "141d34391abbb315d68556b7c67ad97885407547",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl-\u003eqdisc-\u003eq.qlen == 0 guarantees that it hasn\u0027t inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon\u0027t insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires configuring an hfsc qdisc with a netem child (duplicate enabled) via RTNETLINK/tc and then transmitting packets locally, so the attacker must have local access to the system. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The reentrancy is deterministic \u2014 netem\u0027s duplicate path re-enters hfsc_enqueue() synchronously on the same CPU before the child qdisc\u0027s qlen is incremented, so a single packet with duplicate=100% reliably double-activates the class. No race or uncontrolled memory-layout condition is involved.\nPR:L - Qdisc/class creation requires CAP_NET_ADMIN, but only ns_capable() over the netns owner user namespace (netlink_net_capable in rtnetlink_rcv_msg), which any unprivileged user obtains with `unshare -Urn` on default distro configs. Triggering enqueue only needs sending a packet over the local device.\nUI:N - The attacker performs every step \u2014 qdisc/class setup, packet transmission, and class deletion \u2014 with no action from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own memory and scheduling structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed hfsc_class remains linked in the parent\u0027s vt_tree/cf_tree and the eligible rbtree, so subsequent rbtree traversals read attacker-groomed heap contents; a UAF of a slab object with reclaimed contents yields a kernel information-disclosure primitive.\nI:H - Stale rb_node links cause rb_insert_color()/rb_erase()/vttree_update() to write into freed memory that the attacker can reclaim with a controlled object, giving a write primitive suitable for control-flow hijacking and privilege escalation. The doubly-inserted el_node additionally corrupts the eligible rbtree structure itself.\nA:H - Even without weaponization, the use-after-free and corrupted rbtree produce oopses, hangs on cyclic tree traversal, or a kernel panic, taking the whole system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:05.817Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"
        },
        {
          "url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"
        }
      ],
      "title": "net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37890",
    "datePublished": "2025-05-16T13:01:12.798Z",
    "dateReserved": "2025-04-16T04:51:23.963Z",
    "dateUpdated": "2026-08-05T11:58:05.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38052 (GCVE-0-2025-38052)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:33 – Updated: 2026-10-15 21:52

Title

net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done

Summary

In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG: KASAN: slab-use-after-free in tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840 Read of size 8 at addr ffff88807a733000 by task kworker/1:0/25 Call Trace: kasan_report+0xd9/0x110 mm/kasan/report.c:601 tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840 crypto_request_complete include/crypto/algapi.h:266 aead_request_complete include/crypto/internal/aead.h:85 cryptd_aead_crypt+0x3b8/0x750 crypto/cryptd.c:772 crypto_request_complete include/crypto/algapi.h:266 cryptd_queue_worker+0x131/0x200 crypto/cryptd.c:181 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 Allocated by task 8355: kzalloc_noprof include/linux/slab.h:778 tipc_crypto_start+0xcc/0x9e0 net/tipc/crypto.c:1466 tipc_init_net+0x2dd/0x430 net/tipc/core.c:72 ops_init+0xb9/0x650 net/core/net_namespace.c:139 setup_net+0x435/0xb40 net/core/net_namespace.c:343 copy_net_ns+0x2f0/0x670 net/core/net_namespace.c:508 create_new_namespaces+0x3ea/0xb10 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228 ksys_unshare+0x419/0x970 kernel/fork.c:3323 __do_sys_unshare kernel/fork.c:3394 Freed by task 63: kfree+0x12a/0x3b0 mm/slub.c:4557 tipc_crypto_stop+0x23c/0x500 net/tipc/crypto.c:1539 tipc_exit_net+0x8c/0x110 net/tipc/core.c:119 ops_exit_list+0xb0/0x180 net/core/net_namespace.c:173 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 After freed the tipc_crypto tx by delete namespace, tipc_aead_encrypt_done may still visit it in cryptd_queue_worker workqueue. I reproduce this issue by: ip netns add ns1 ip link add veth1 type veth peer name veth2 ip link set veth1 netns ns1 ip netns exec ns1 tipc bearer enable media eth dev veth1 ip netns exec ns1 tipc node set key this_is_a_master_key master ip netns exec ns1 tipc bearer disable media eth dev veth1 ip netns del ns1 The key of reproduction is that, simd_aead_encrypt is interrupted, leading to crypto_simd_usable() return false. Thus, the cryptd_queue_worker is triggered, and the tipc_crypto tx will be visited. tipc_disc_timeout tipc_bearer_xmit_skb tipc_crypto_xmit tipc_aead_encrypt crypto_aead_encrypt // encrypt() simd_aead_encrypt // crypto_simd_usable() is false child = &ctx->cryptd_tfm->base; simd_aead_encrypt crypto_aead_encrypt // encrypt() cryptd_aead_encrypt_enqueue cryptd_aead_enqueue cryptd_enqueue_request // trigger cryptd_queue_worker queue_work_on(smp_processor_id(), cryptd_wq, &cpu_queue->work) Fix this by holding net reference count before encrypt.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:46 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/d42ed4de6aba232d9…
https://git.kernel.org/stable/c/f5c2c4eaaa5a8e7e0…
https://git.kernel.org/stable/c/b8fcae6d2e93c54ca…
https://git.kernel.org/stable/c/b19fc1d0be3c3397e…
https://git.kernel.org/stable/c/689a205cd968a1572…
https://git.kernel.org/stable/c/4a0fddc2c0d5c28ae…
https://git.kernel.org/stable/c/e279024617134c94f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < d42ed4de6aba232d946d20653a70f79158a6535b (git) Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < f5c2c4eaaa5a8e7e0685ec031d480e588e263e59 (git) Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < b8fcae6d2e93c54cacb8f579a77d827c1c643eb5 (git) Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < b19fc1d0be3c3397e5968fe2627f22e7f84673b1 (git) Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 689a205cd968a1572ab561b0c4c2d50a10e9d3b0 (git) Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 4a0fddc2c0d5c28aec8c262ad4603be0bef1938c (git) Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < e279024617134c94fd3e37470156534d5f2b3472 (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.238 , ≤ 5.10.* (semver) Unaffected: 5.15.185 , ≤ 5.15.* (semver) Unaffected: 6.1.141 , ≤ 6.1.* (semver) Unaffected: 6.6.93 , ≤ 6.6.* (semver) Unaffected: 6.12.31 , ≤ 6.12.* (semver) Unaffected: 6.14.9 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:33:25.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:46:53.294313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:52:06.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d42ed4de6aba232d946d20653a70f79158a6535b",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "f5c2c4eaaa5a8e7e0685ec031d480e588e263e59",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "b8fcae6d2e93c54cacb8f579a77d827c1c643eb5",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "b19fc1d0be3c3397e5968fe2627f22e7f84673b1",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "689a205cd968a1572ab561b0c4c2d50a10e9d3b0",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "4a0fddc2c0d5c28aec8c262ad4603be0bef1938c",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "e279024617134c94fd3e37470156534d5f2b3472",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.185",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.141",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done\n\nSyzbot reported a slab-use-after-free with the following call trace:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840\n  Read of size 8 at addr ffff88807a733000 by task kworker/1:0/25\n\n  Call Trace:\n   kasan_report+0xd9/0x110 mm/kasan/report.c:601\n   tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840\n   crypto_request_complete include/crypto/algapi.h:266\n   aead_request_complete include/crypto/internal/aead.h:85\n   cryptd_aead_crypt+0x3b8/0x750 crypto/cryptd.c:772\n   crypto_request_complete include/crypto/algapi.h:266\n   cryptd_queue_worker+0x131/0x200 crypto/cryptd.c:181\n   process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n\n  Allocated by task 8355:\n   kzalloc_noprof include/linux/slab.h:778\n   tipc_crypto_start+0xcc/0x9e0 net/tipc/crypto.c:1466\n   tipc_init_net+0x2dd/0x430 net/tipc/core.c:72\n   ops_init+0xb9/0x650 net/core/net_namespace.c:139\n   setup_net+0x435/0xb40 net/core/net_namespace.c:343\n   copy_net_ns+0x2f0/0x670 net/core/net_namespace.c:508\n   create_new_namespaces+0x3ea/0xb10 kernel/nsproxy.c:110\n   unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228\n   ksys_unshare+0x419/0x970 kernel/fork.c:3323\n   __do_sys_unshare kernel/fork.c:3394\n\n  Freed by task 63:\n   kfree+0x12a/0x3b0 mm/slub.c:4557\n   tipc_crypto_stop+0x23c/0x500 net/tipc/crypto.c:1539\n   tipc_exit_net+0x8c/0x110 net/tipc/core.c:119\n   ops_exit_list+0xb0/0x180 net/core/net_namespace.c:173\n   cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640\n   process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n\nAfter freed the tipc_crypto tx by delete namespace, tipc_aead_encrypt_done\nmay still visit it in cryptd_queue_worker workqueue.\n\nI reproduce this issue by:\n  ip netns add ns1\n  ip link add veth1 type veth peer name veth2\n  ip link set veth1 netns ns1\n  ip netns exec ns1 tipc bearer enable media eth dev veth1\n  ip netns exec ns1 tipc node set key this_is_a_master_key master\n  ip netns exec ns1 tipc bearer disable media eth dev veth1\n  ip netns del ns1\n\nThe key of reproduction is that, simd_aead_encrypt is interrupted, leading\nto crypto_simd_usable() return false. Thus, the cryptd_queue_worker is\ntriggered, and the tipc_crypto tx will be visited.\n\n  tipc_disc_timeout\n    tipc_bearer_xmit_skb\n      tipc_crypto_xmit\n        tipc_aead_encrypt\n          crypto_aead_encrypt\n            // encrypt()\n            simd_aead_encrypt\n              // crypto_simd_usable() is false\n              child = \u0026ctx-\u003ecryptd_tfm-\u003ebase;\n\n  simd_aead_encrypt\n    crypto_aead_encrypt\n      // encrypt()\n      cryptd_aead_encrypt_enqueue\n        cryptd_aead_enqueue\n          cryptd_enqueue_request\n            // trigger cryptd_queue_worker\n            queue_work_on(smp_processor_id(), cryptd_wq, \u0026cpu_queue-\u003ework)\n\nFix this by holding net reference count before encrypt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable encrypt path is bound to the TIPC network stack and is driven by remote peer traffic \u2014 an inbound DSC_REQ_MSG forces an encrypted DSC_RESP_MSG through tipc_crypto_xmit()/tipc_aead_encrypt() before any node is established, and TIPC bearers include IP/UDP media (CONFIG_TIPC_MEDIA_UDP default y), which is routable across the internet.\nAC:L - The attacker controls both sides of the race \u2014 flooding discovery/link-protocol traffic keeps many async cryptd encryptions in flight while the namespace teardown that frees tipc_crypto is issued on demand, and the sequence can be retried without limit; on platforms with asynchronous AEAD accelerators the -EINPROGRESS callback path is taken unconditionally rather than being a race at all.\nPR:L - No real root is needed: the TIPC v2 generic-netlink ops carry no GENL_ADMIN_PERM (the only capability check in net/tipc is the legacy compat path), and `unshare -Urn` grants CAP_NET_ADMIN inside a fresh netns for veth/bearer/key setup, with namespace exit performing the free \u2014 matching the syzbot trace via ksys_unshare \u2192 copy_net_ns \u2192 tipc_crypto_start.\nUI:N - The entire sequence (bearer enable, key set, packet flood, namespace teardown) is performed by the attacker; no victim action or cooperation is required.\nS:U - The use-after-free corrupts kernel heap memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The callback reads 8 bytes of freed slab memory (tx-\u003enet at crypto.c:840) and then uses tx-\u003estats and that stale struct net pointer; once the ~320-byte kmalloc object is reclaimed with attacker-chosen data, the resulting pointer dereferences give a path to disclose arbitrary kernel memory.\nI:H - A reclaimed tipc_crypto yields a fully attacker-controlled tx-\u003estats, so this_cpu_inc(tx-\u003estats-\u003estat[STAT_ASYNC_OK]) becomes a repeatable arbitrary-address increment, and the controlled struct net * is passed into b-\u003emedia-\u003esend_msg() \u2014 both are standard building blocks for kernel privilege escalation.\nA:H - Dereferencing the freed per-netns tipc_crypto from the cryptd worker reliably oopses or panics the kernel, and the trigger can be repeated to keep the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:06.330Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d42ed4de6aba232d946d20653a70f79158a6535b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5c2c4eaaa5a8e7e0685ec031d480e588e263e59"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8fcae6d2e93c54cacb8f579a77d827c1c643eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19fc1d0be3c3397e5968fe2627f22e7f84673b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/689a205cd968a1572ab561b0c4c2d50a10e9d3b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a0fddc2c0d5c28aec8c262ad4603be0bef1938c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e279024617134c94fd3e37470156534d5f2b3472"
        }
      ],
      "title": "net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38052",
    "datePublished": "2025-06-18T09:33:33.427Z",
    "dateReserved": "2025-04-16T04:51:23.979Z",
    "dateUpdated": "2026-10-15T21:52:06.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:12746

BDU:2026-03966 (CVE-2022-49788)

CVE-2022-49788 (GCVE-0-2022-49788)

CVE-2025-21726 (GCVE-0-2025-21726)

CVE-2025-21727 (GCVE-0-2025-21727)

CVE-2025-21928 (GCVE-0-2025-21928)

CVE-2025-21929 (GCVE-0-2025-21929)

CVE-2025-21962 (GCVE-0-2025-21962)

CVE-2025-22020 (GCVE-0-2025-22020)

CVE-2025-37890 (GCVE-0-2025-37890)

CVE-2025-38052 (GCVE-0-2025-38052)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour