Vulnerability-Lookup

RHSA-2026:23224

Vulnerability from csaf_redhat - Published: 2026-06-04 13:04 - Updated: 2026-08-31 17:15

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-38653

In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-doc-0:5.14.0-570.119.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.119.1.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-570.119.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-uki-virt-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-uki-virt-addons-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-kvm-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.119.1.el9_6.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-39766

In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-390 - Detection of Error Condition Without Action

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2025-68366

In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 nbd_start_device // config_refs=2 set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 recv_work done // config_refs=2 NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0 refcount_inc -> uaf ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790 The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect(): mutex_unlock(&nbd->config_lock); if (!ret) { set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); + printk("before sleep\n"); + mdelay(5 * 1000); + printk("after sleep\n"); refcount_inc(&nbd->config_refs); nbd_connect_reply(info, nbd->index); }

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-23210

A flaw was found in the Linux kernel's ice network driver. A local attacker could exploit a race condition during the Virtual Station Interface (VSI) rebuild process. This flaw occurs when the Precision Time Protocol (PTP) periodic work attempts to access uninitialized memory, leading to a NULL pointer dereference. Successful exploitation results in a system crash, causing a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-23270

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control `act_ct` path when it is incorrectly configured with non-ingress egress qdiscs (queueing disciplines). This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial of service. In some cases, this vulnerability may also be exploited for privilege escalation.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-23392

A flaw was found in the Linux kernel's netfilter component, specifically within the nf_tables subsystem. An error in releasing a flowtable after an RCU (Read-Copy-Update) grace period could lead to a use-after-free vulnerability. This issue could expose the flowtable to the packet path and nfnetlink_hook control plane, potentially allowing a local attacker to cause a system crash (Denial of Service) or achieve arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-31419

A flaw was found in the Linux kernel's bonding driver. A local attacker with low privileges could exploit a use-after-free vulnerability in the `bond_xmit_broadcast()` function. This occurs due to a race condition during concurrent slave enslave/release operations, which can lead to the original socket buffer (skb) being double-freed. Successful exploitation of this flaw can result in a system crash, leading to a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-31607

A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-31685

A flaw was found in the Linux kernel's netfilter component. This vulnerability occurs because the `eui64_mt6()` function, which processes IPv6 packets, does not properly validate the MAC header for all packets. Specifically, packets with a zero fragment offset could bypass an existing guard, allowing the system to attempt to access an invalid MAC header. A remote attacker could exploit this by sending specially crafted IPv6 packets, potentially causing a system crash and leading to a Denial of Service (DoS).

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

CVE-2026-31709

A flaw was found in the Linux kernel's Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1288 - Improper Validation of Consistency within Input

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-43037

A flaw was found in the Linux kernel's IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel's IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash (denial of service) or potentially allow arbitrary code execution with kernel privileges.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Critical

CVE-2026-43038

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option (CIPSO) IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 ICMP error, potentially causing an out-of-bounds memory access. This memory corruption could result in information disclosure or a denial of service.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Important

CVE-2026-43163

A flaw was found in the Linux kernel's md/bitmap component. This vulnerability involves a use-after-free race condition that occurs during array resize operations. When the `bitmap_daemon_work()` and `__bitmap_resize()` functions execute concurrently, they can access memory pages that have already been freed. This can lead to a General Protection Fault (GPF), which causes the system to crash, resulting in a denial of service.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-38653

Threats

Impact Moderate

References

82 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:23224	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2390372	external
https://bugzilla.redhat.com/show_bug.cgi?id=2394648	external
https://bugzilla.redhat.com/show_bug.cgi?id=2424881	external
https://bugzilla.redhat.com/show_bug.cgi?id=2439895	external
https://bugzilla.redhat.com/show_bug.cgi?id=2448745	external
https://bugzilla.redhat.com/show_bug.cgi?id=2451218	external
https://bugzilla.redhat.com/show_bug.cgi?id=2457829	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461521	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461759	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464351	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464397	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464476	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467059	external
https://issues.redhat.com/browse/RHEL-174822	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-38653	self
https://bugzilla.redhat.com/show_bug.cgi?id=2390372	external
https://www.cve.org/CVERecord?id=CVE-2025-38653	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38653	external
https://lore.kernel.org/linux-cve-announce/202508…	external
https://access.redhat.com/security/cve/CVE-2025-39766	self
https://bugzilla.redhat.com/show_bug.cgi?id=2394648	external
https://www.cve.org/CVERecord?id=CVE-2025-39766	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39766	external
https://lore.kernel.org/linux-cve-announce/202509…	external
https://access.redhat.com/security/cve/CVE-2025-68366	self
https://bugzilla.redhat.com/show_bug.cgi?id=2424881	external
https://www.cve.org/CVERecord?id=CVE-2025-68366	external
https://nvd.nist.gov/vuln/detail/CVE-2025-68366	external
https://lore.kernel.org/linux-cve-announce/202512…	external
https://access.redhat.com/security/cve/CVE-2026-23210	self
https://bugzilla.redhat.com/show_bug.cgi?id=2439895	external
https://www.cve.org/CVERecord?id=CVE-2026-23210	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23210	external
https://lore.kernel.org/linux-cve-announce/202602…	external
https://access.redhat.com/security/cve/CVE-2026-23270	self
https://bugzilla.redhat.com/show_bug.cgi?id=2448745	external
https://www.cve.org/CVERecord?id=CVE-2026-23270	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23270	external
https://lore.kernel.org/linux-cve-announce/202603…	external
https://access.redhat.com/security/cve/CVE-2026-23392	self
https://bugzilla.redhat.com/show_bug.cgi?id=2451218	external
https://www.cve.org/CVERecord?id=CVE-2026-23392	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23392	external
https://lore.kernel.org/linux-cve-announce/202603…	external
https://access.redhat.com/security/cve/CVE-2026-31419	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457829	external
https://www.cve.org/CVERecord?id=CVE-2026-31419	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31419	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31607	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461521	external
https://www.cve.org/CVERecord?id=CVE-2026-31607	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31607	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31685	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461759	external
https://www.cve.org/CVERecord?id=CVE-2026-31685	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31685	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31709	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464476	external
https://www.cve.org/CVERecord?id=CVE-2026-31709	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31709	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43037	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464351	external
https://www.cve.org/CVERecord?id=CVE-2026-43037	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43037	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43038	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464397	external
https://www.cve.org/CVERecord?id=CVE-2026-43038	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43038	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43163	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467059	external
https://www.cve.org/CVERecord?id=CVE-2026-43163	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43163	external
https://lore.kernel.org/linux-cve-announce/202605…	external

JSON

To clipboard

Loading 1.4 MB of JSON…

BDU:2026-12288 (CVE-2026-23270)

Vulnerability from fstec – Published: 2026-08-25 – Updated: 2026-09-07 – View on bdu.fstec.ru Fixed

Title

Уязвимость функций tcf_ct_init() модуля net/sched/act_ct.c ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции tcf_ct_init() модуля net/sched/act_ct.c ядра операционной системы Linux связана с повторным использованием ранее освобожденной памяти. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-416 - Использование после освобождения

Aliases

CVE-2026-23270, DSA-6238-1, DSA-6243-1, RHSA-2026:13565, RHSA-2026:13566, RHSA-2026:19568, RHSA-2026:19569, RHSA-2026:21209, RHSA-2026:21706, RHSA-2026:21745, RHSA-2026:22900, RHSA-2026:22940, RHSA-2026:23224, RHSA-2026:24343, RHSA-2026:35863, 4561-1

References

8 references

URL
https://www.cve.org/CVERecord?id=CVE-2026-23270
https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e
https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6
https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4
https://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189
https://security-tracker.debian.org/tracker/CVE-2026-23270
https://access.redhat.com/security/cve/CVE-2026-23270
https://altsp.su/obnovleniya-bezopasnosti/

Impacted products

5 products from 5 vendors

Vendors

Red Hat, Inc., Canonical Ltd., Сообщество свободного программного обеспечения, АО «ИВК»

Products

Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, АЛЬТ СП 10, Linux

Versions

8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), - (АЛЬТ СП 10), 9.2 Extended Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 9.4 Extended Update Support (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 10.0 Extended Update Support (Red Hat Enterprise Linux), от 5.15.148 до 5.16 (Linux), от 6.1.75 до 6.2 (Linux), от 6.6.14 до 6.7 (Linux), от 6.7.2 до 6.12.76 включительно (Linux), от 6.13 до 6.18.17 включительно (Linux), от 6.19 до 6.19.7 включительно (Linux)

Product types

Operating system

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 8, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Сообщество свободного программного обеспечения Debian GNU/Linux 12, Canonical Ltd. Ubuntu 22.04 LTS, Inc. Red Hat Enterprise Linux 9, АО «ИВК» АЛЬТ СП 10 -, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support, Canonical Ltd. Ubuntu 24.04 LTS, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support, Inc. Red Hat Enterprise Linux 10, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Сообщество свободного программного обеспечения Debian GNU/Linux 13, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support, Сообщество свободного программного обеспечения Linux от 5.15.148 до 5.16, Сообщество свободного программного обеспечения Linux от 6.1.75 до 6.2, Сообщество свободного программного обеспечения Linux от 6.6.14 до 6.7, Сообщество свободного программного обеспечения Linux от 6.7.2 до 6.12.76 включительно, Сообщество свободного программного обеспечения Linux от 6.13 до 6.18.17 включительно, Сообщество свободного программного обеспечения Linux от 6.19 до 6.19.7 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4 https://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189 Для Debian GNU/Linux: https://security-tracker.debian.org/tracker/CVE-2026-23270 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/CVE-2026-23270 Для Ubuntu: https://access.redhat.com/security/cve/CVE-2026-23270 Для ОС АЛЬТ СП 10: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), 9.2 Extended Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 9.4 Extended Update Support (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 8.8 Telecommunications Update Service (Red Hat Enterprise Linux), 8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux), 9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 13 (Debian GNU/Linux), 10.0 Extended Update Support (Red Hat Enterprise Linux), \u043e\u0442 5.15.148 \u0434\u043e 5.16 (Linux), \u043e\u0442 6.1.75 \u0434\u043e 6.2 (Linux), \u043e\u0442 6.6.14 \u0434\u043e 6.7 (Linux), \u043e\u0442 6.7.2 \u0434\u043e 6.12.76 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 6.13 \u0434\u043e 6.18.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 6.19 \u0434\u043e 6.19.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\n\u0414\u043b\u044f Linux:\n\nhttps://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e\nhttps://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6\nhttps://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4\nhttps://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189\n\n\n\n\u0414\u043b\u044f Debian GNU/Linux:\n\nhttps://security-tracker.debian.org/tracker/CVE-2026-23270\n\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\n\nhttps://access.redhat.com/security/cve/CVE-2026-23270\n\n\n\u0414\u043b\u044f Ubuntu:\n\nhttps://access.redhat.com/security/cve/CVE-2026-23270\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u041b\u042c\u0422 \u0421\u041f 10: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430: https://altsp.su/obnovleniya-bezopasnosti/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "27.02.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "07.09.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "25.08.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-12288",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-23270, DSA-6238-1, DSA-6243-1, RHSA-2026:13565, RHSA-2026:13566, RHSA-2026:19568, RHSA-2026:19569, RHSA-2026:21209, RHSA-2026:21706, RHSA-2026:21745, RHSA-2026:22900, RHSA-2026:22940, RHSA-2026:23224, RHSA-2026:24343, RHSA-2026:35863, 4561-1",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Ubuntu, Debian GNU/Linux, \u0410\u041b\u042c\u0422 \u0421\u041f 10, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 8 , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support , Red Hat, Inc. Red Hat Enterprise Linux 10 , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 13 , Red Hat, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.15.148 \u0434\u043e 5.16 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.1.75 \u0434\u043e 6.2 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.6.14 \u0434\u043e 6.7 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7.2 \u0434\u043e 6.12.76 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.13 \u0434\u043e 6.18.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.19 \u0434\u043e 6.19.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 tcf_ct_init() \u043c\u043e\u0434\u0443\u043b\u044f net/sched/act_ct.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 tcf_ct_init() \u043c\u043e\u0434\u0443\u043b\u044f net/sched/act_ct.c \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u044b\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u043d\u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cve.org/CVERecord?id=CVE-2026-23270\n\nhttps://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e\nhttps://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6\nhttps://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4\nhttps://git.kernel.org/linus/11cb63b0d1a0685e0831ae3c77223e002ef18189\n\nhttps://security-tracker.debian.org/tracker/CVE-2026-23270\n\nhttps://access.redhat.com/security/cve/CVE-2026-23270\nhttps://altsp.su/obnovleniya-bezopasnosti/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2025-38653 (GCVE-0-2025-38653)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:00 – Updated: 2026-08-05 12:03

Title

proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/c35b0feb80b48720d…
https://git.kernel.org/stable/c/33c778ea0bd0fa62f…
https://git.kernel.org/stable/c/fc1072d934f687e12…
https://git.kernel.org/stable/c/d136502e04d8853a9…
https://git.kernel.org/stable/c/1fccbfbae1dd36198…
https://git.kernel.org/stable/c/ff7ec8dc1b646296f…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < c35b0feb80b48720dfbbf4e33759c7be3faaebb6 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < 33c778ea0bd0fa62ff590497e72562ff90f82b13 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < fc1072d934f687e1221d685cf1a49a5068318f34 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < d136502e04d8853a9aecb335d07bbefd7a1519a8 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < 1fccbfbae1dd36198dc47feac696563244ad81d3 (git) Affected: 3f61631d47f115b83c935d0039f95cb68b0c8ab7 , < ff7ec8dc1b646296f8d94c39339e8d3833d16c05 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.148 , ≤ 6.1.* (semver) Unaffected: 6.6.102 , ≤ 6.6.* (semver) Unaffected: 6.12.42 , ≤ 6.12.* (semver) Unaffected: 6.15.10 , ≤ 6.15.* (semver) Unaffected: 6.16.1 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:46.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/generic.c",
            "fs/proc/inode.c",
            "fs/proc/internal.h",
            "include/linux/proc_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c35b0feb80b48720dfbbf4e33759c7be3faaebb6",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "33c778ea0bd0fa62ff590497e72562ff90f82b13",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "fc1072d934f687e1221d685cf1a49a5068318f34",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "d136502e04d8853a9aecb335d07bbefd7a1519a8",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "1fccbfbae1dd36198dc47feac696563244ad81d3",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "ff7ec8dc1b646296f8d94c39339e8d3833d16c05",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/generic.c",
            "fs/proc/inode.c",
            "fs/proc/internal.h",
            "include/linux/proc_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al\n\nCheck pde-\u003eproc_ops-\u003eproc_lseek directly may cause UAF in rmmod scenario. \nIt\u0027s a gap in proc_reg_open() after commit 654b33ada4ab(\"proc: fix UAF in\nproc_get_inode()\").  Followed by AI Viro\u0027s suggestion, fix it in same\nmanner."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the open(2) syscall on a procfs entry, requiring local access to the system. There is no network-facing path to proc_reg_open().\nAC:L - The attacker fully controls their side of the race and can spin unbounded threads on open(), while widening the lookup-to-open window with memory pressure since proc_get_inode() allocates GFP_KERNEL; on Android/embedded targets the module-teardown side is also reachable by toggling user-facing device state (WiFi/BT/camera), so the race can be provoked at will.\nPR:L - Any unprivileged local user can open a world-readable module-created /proc entry (e.g. /proc/net/*, /proc/scsi/*, /proc/driver/*); the unguarded dereference happens before any capability or use_pde() gate.\nUI:N - The attacker\u0027s own open() performs the faulty dereference; no victim needs to open a file, mount a filesystem, or otherwise interact.\nS:U - The use-after-free occurs in kernel memory and its impact stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of freed module memory through a dangling pde-\u003eproc_ops pointer, and freed-region contents that an attacker can groom (by triggering module loads that recycle the region) are consumed by the kernel and leak back through the resulting FMODE_LSEEK state.\nI:H - Use-after-free of a function-pointer table entry means kernel control-flow-relevant data is read from memory whose contents an attacker may influence via heap/module-region grooming, and such UAF conditions are treated as exploitable for corruption of kernel state.\nA:H - The dereference targets vmalloc-backed module memory that is unmapped on free, producing the same kernel page-fault oops documented in the companion fix 654b33ada4ab; the crash can be retriggered on every module unload."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:41.738Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34"
        },
        {
          "url": "https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05"
        }
      ],
      "title": "proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38653",
    "datePublished": "2025-08-22T16:00:57.413Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-08-05T12:03:41.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39766 (GCVE-0-2025-39766)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-06-11 18:44

Title

net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/7689ab22de36f8db1…
https://git.kernel.org/stable/c/de04ddd2980b48caa…
https://git.kernel.org/stable/c/0dacfc5372e314d12…
https://git.kernel.org/stable/c/710866fc0a64eafcb…
https://git.kernel.org/stable/c/aa12ee1c1bd260943…
https://git.kernel.org/stable/c/ff57186b2cc397666…
https://git.kernel.org/stable/c/62d591dde4defb133…
https://git.kernel.org/stable/c/15de71d06a400f7fd…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 7689ab22de36f8db19095f6bdf11f28cfde92f5c (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < de04ddd2980b48caa8d7e24a7db2742917a8b280 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 0dacfc5372e314d1219f03e64dde3ab495a5a25e (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 710866fc0a64eafcb8bacd91bcb1329eb7e5035f (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < aa12ee1c1bd260943fd6ab556d8635811c332eeb (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < ff57186b2cc39766672c4c0332323933e5faaa88 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 62d591dde4defb1333d202410609c4ddeae060b3 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 15de71d06a400f7fdc15bf377a2552b0ec437cf5 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.149 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:11.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:51.305Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:58.138217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:07.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7689ab22de36f8db19095f6bdf11f28cfde92f5c",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "de04ddd2980b48caa8d7e24a7db2742917a8b280",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "0dacfc5372e314d1219f03e64dde3ab495a5a25e",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "710866fc0a64eafcb8bacd91bcb1329eb7e5035f",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "aa12ee1c1bd260943fd6ab556d8635811c332eeb",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "ff57186b2cc39766672c4c0332323933e5faaa88",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "62d591dde4defb1333d202410609c4ddeae060b3",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "15de71d06a400f7fdc15bf377a2552b0ec437cf5",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit\n\nThe following setup can trigger a WARNING in htb_activate due to\nthe condition: !cl-\u003eleaf.q-\u003eq.qlen\n\ntc qdisc del dev lo root\ntc qdisc add dev lo root handle 1: htb default 1\ntc class add dev lo parent 1: classid 1:1 \\\n       htb rate 64bit\ntc qdisc add dev lo parent 1:1 handle f: \\\n       cake memlimit 1b\nping -I lo -f -c1 -s64 -W0.001 127.0.0.1\n\nThis is because the low memlimit leads to a low buffer_limit, which\ncauses packet dropping. However, cake_enqueue still returns\nNET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an\nempty child qdisc. We should return NET_XMIT_CN when packets are\ndropped from the same tin and flow.\n\nI do not believe return value of NET_XMIT_CN is necessary for packet\ndrops in the case of ack filtering, as that is meant to optimize\nperformance, not to signal congestion."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:50.638Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7689ab22de36f8db19095f6bdf11f28cfde92f5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/de04ddd2980b48caa8d7e24a7db2742917a8b280"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dacfc5372e314d1219f03e64dde3ab495a5a25e"
        },
        {
          "url": "https://git.kernel.org/stable/c/710866fc0a64eafcb8bacd91bcb1329eb7e5035f"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa12ee1c1bd260943fd6ab556d8635811c332eeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff57186b2cc39766672c4c0332323933e5faaa88"
        },
        {
          "url": "https://git.kernel.org/stable/c/62d591dde4defb1333d202410609c4ddeae060b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/15de71d06a400f7fdc15bf377a2552b0ec437cf5"
        }
      ],
      "title": "net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39766",
    "datePublished": "2025-09-11T16:56:21.514Z",
    "dateReserved": "2025-04-16T07:20:57.126Z",
    "dateUpdated": "2026-06-11T18:44:07.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68366 (GCVE-0-2025-68366)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:32 – Updated: 2026-06-16 19:12

Title

nbd: defer config unlock in nbd_genl_connect

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 19:12 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/330d688a5ca538578…
https://git.kernel.org/stable/c/cd93db1b1b4460e6e…
https://git.kernel.org/stable/c/ae3e7bc1f4b393ae2…
https://git.kernel.org/stable/c/2e5e0665a594f076e…
https://git.kernel.org/stable/c/c9b99c948b4fb0148…
https://git.kernel.org/stable/c/9a38306643874566d…
https://git.kernel.org/stable/c/c9e805f6a35d1dd18…
https://git.kernel.org/stable/c/1649714b930f9ea62…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < 330d688a5ca53857828081a3cf31b92ad1b0b3ed (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < cd93db1b1b4460e6ee77564024ea461e5940f69c (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < ae3e7bc1f4b393ae20e5c85583eb2c6977374716 (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < 2e5e0665a594f076ef2b9439447bae8be293d09d (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < c9b99c948b4fb014812afe7b5ccf2db121d22e46 (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < 9a38306643874566d20f7aba7dff9e6f657b51a9 (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < c9e805f6a35d1dd189a9345595a5c20e87611942 (git) Affected: e46c7287b1c27683a8e30ca825fb98e2b97f1099 , < 1649714b930f9ea6233ce0810ba885999da3b5d4 (git)
Linux	Linux	Affected: 4.12 Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.63 , ≤ 6.12.* (semver) Unaffected: 6.17.13 , ≤ 6.17.* (semver) Unaffected: 6.18.2 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68366",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T19:12:23.169488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T19:12:35.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "330d688a5ca53857828081a3cf31b92ad1b0b3ed",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "cd93db1b1b4460e6ee77564024ea461e5940f69c",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "ae3e7bc1f4b393ae20e5c85583eb2c6977374716",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "2e5e0665a594f076ef2b9439447bae8be293d09d",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "c9b99c948b4fb014812afe7b5ccf2db121d22e46",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "9a38306643874566d20f7aba7dff9e6f657b51a9",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "c9e805f6a35d1dd189a9345595a5c20e87611942",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            },
            {
              "lessThan": "1649714b930f9ea6233ce0810ba885999da3b5d4",
              "status": "affected",
              "version": "e46c7287b1c27683a8e30ca825fb98e2b97f1099",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config unlock in nbd_genl_connect\n\nThere is one use-after-free warning when running NBD_CMD_CONNECT and\nNBD_CLEAR_SOCK:\n\nnbd_genl_connect\n  nbd_alloc_and_init_config // config_refs=1\n  nbd_start_device // config_refs=2\n  set NBD_RT_HAS_CONFIG_REF\t\t\topen nbd // config_refs=3\n  recv_work done // config_refs=2\n\t\t\t\t\t\tNBD_CLEAR_SOCK // config_refs=1\n\t\t\t\t\t\tclose nbd // config_refs=0\n  refcount_inc -\u003e uaf\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290\n nbd_genl_connect+0x16d0/0x1ab0\n genl_family_rcv_msg_doit+0x1f3/0x310\n genl_rcv_msg+0x44a/0x790\n\nThe issue can be easily reproduced by adding a small delay before\nrefcount_inc(\u0026nbd-\u003econfig_refs) in nbd_genl_connect():\n\n        mutex_unlock(\u0026nbd-\u003econfig_lock);\n        if (!ret) {\n                set_bit(NBD_RT_HAS_CONFIG_REF, \u0026config-\u003eruntime_flags);\n+               printk(\"before sleep\\n\");\n+               mdelay(5 * 1000);\n+               printk(\"after sleep\\n\");\n                refcount_inc(\u0026nbd-\u003econfig_refs);\n                nbd_connect_reply(info, nbd-\u003eindex);\n        }"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:51:48.993Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/330d688a5ca53857828081a3cf31b92ad1b0b3ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd93db1b1b4460e6ee77564024ea461e5940f69c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae3e7bc1f4b393ae20e5c85583eb2c6977374716"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e5e0665a594f076ef2b9439447bae8be293d09d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9b99c948b4fb014812afe7b5ccf2db121d22e46"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a38306643874566d20f7aba7dff9e6f657b51a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9e805f6a35d1dd189a9345595a5c20e87611942"
        },
        {
          "url": "https://git.kernel.org/stable/c/1649714b930f9ea6233ce0810ba885999da3b5d4"
        }
      ],
      "title": "nbd: defer config unlock in nbd_genl_connect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68366",
    "datePublished": "2025-12-24T10:32:53.399Z",
    "dateReserved": "2025-12-16T14:48:05.308Z",
    "dateUpdated": "2026-06-16T19:12:35.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23210 (GCVE-0-2026-23210)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-06-11 18:44

Title

ice: Fix PTP NULL pointer dereference during VSI rebuild

Summary

In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:41 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/ba0c7fff6616025a7…
https://git.kernel.org/stable/c/7565d4df66b6619b5…
https://git.kernel.org/stable/c/fc6f36eaaedcf4b81…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 803bef817807d2d36c930dada20c96fffae0dd19 , < ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9 (git) Affected: 803bef817807d2d36c930dada20c96fffae0dd19 , < 7565d4df66b6619b50dc36618d8b8f1787d77e19 (git) Affected: 803bef817807d2d36c930dada20c96fffae0dd19 , < fc6f36eaaedcf4b81af6fe1a568f018ffd530660 (git)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.10 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23210",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:52.270125Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:17.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9",
              "status": "affected",
              "version": "803bef817807d2d36c930dada20c96fffae0dd19",
              "versionType": "git"
            },
            {
              "lessThan": "7565d4df66b6619b50dc36618d8b8f1787d77e19",
              "status": "affected",
              "version": "803bef817807d2d36c930dada20c96fffae0dd19",
              "versionType": "git"
            },
            {
              "lessThan": "fc6f36eaaedcf4b81af6fe1a568f018ffd530660",
              "status": "affected",
              "version": "803bef817807d2d36c930dada20c96fffae0dd19",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix PTP NULL pointer dereference during VSI rebuild\n\nFix race condition where PTP periodic work runs while VSI is being\nrebuilt, accessing NULL vsi-\u003erx_rings.\n\nThe sequence was:\n1. ice_ptp_prepare_for_reset() cancels PTP work\n2. ice_ptp_rebuild() immediately queues PTP work\n3. VSI rebuild happens AFTER ice_ptp_rebuild()\n4. PTP work runs and accesses NULL vsi-\u003erx_rings\n\nFix: Keep PTP work cancelled during rebuild, only queue it after\nVSI rebuild completes in ice_rebuild().\n\nAdded ice_ptp_queue_work() helper function to encapsulate the logic\nfor queuing PTP work, ensuring it\u0027s only queued when PTP is supported\nand the state is ICE_PTP_READY.\n\nError log:\n[  121.392544] ice 0000:60:00.1: PTP reset successful\n[  121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[  121.392712] #PF: supervisor read access in kernel mode\n[  121.392720] #PF: error_code(0x0000) - not-present page\n[  121.392727] PGD 0\n[  121.392734] Oops: Oops: 0000 [#1] SMP NOPTI\n[  121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S                  6.19.0-rc6+ #4 PREEMPT(voluntary)\n[  121.392761] Tainted: [S]=CPU_OUT_OF_SPEC\n[  121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice]\n[  121.393042] Call Trace:\n[  121.393047]  \u003cTASK\u003e\n[  121.393055]  ice_ptp_periodic_work+0x69/0x180 [ice]\n[  121.393202]  kthread_worker_fn+0xa2/0x260\n[  121.393216]  ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice]\n[  121.393359]  ? __pfx_kthread_worker_fn+0x10/0x10\n[  121.393371]  kthread+0x10d/0x230\n[  121.393382]  ? __pfx_kthread+0x10/0x10\n[  121.393393]  ret_from_fork+0x273/0x2b0\n[  121.393407]  ? __pfx_kthread+0x10/0x10\n[  121.393417]  ret_from_fork_asm+0x1a/0x30\n[  121.393432]  \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:02:27.163Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7565d4df66b6619b50dc36618d8b8f1787d77e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc6f36eaaedcf4b81af6fe1a568f018ffd530660"
        }
      ],
      "title": "ice: Fix PTP NULL pointer dereference during VSI rebuild",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23210",
    "datePublished": "2026-02-14T16:27:31.892Z",
    "dateReserved": "2026-01-13T15:37:45.986Z",
    "dateUpdated": "2026-06-11T18:44:17.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23270 (GCVE-0-2026-23270)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:54 – Updated: 2026-09-08 08:45

Title

net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/bc4e5bb529823a09f…
https://git.kernel.org/stable/c/fb3c380a54e33d1fd…
https://git.kernel.org/stable/c/5a110ddcc99bda77a…
https://git.kernel.org/stable/c/524ce8b4ea8f64900…
https://git.kernel.org/stable/c/380ad8b7c65ea7aa1…
https://git.kernel.org/stable/c/9deda0fcda5c1f388…
https://git.kernel.org/stable/c/11cb63b0d1a0685e0…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 172ba7d46c202e679f3ccb10264c67416aaeb1c4 , < bc4e5bb529823a09f02dbe96169de679a9db26e0 (git) Affected: 0b5b831122fc3789fff75be433ba3e4dd7b779d4 , < fb3c380a54e33d1fd272cc342faa906d787d7ef1 (git) Affected: 73f7da5fd124f2cda9161e2e46114915e6e82e97 , < 5a110ddcc99bda77a28598b3555fe009eaab3828 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 524ce8b4ea8f64900b6c52b6a28df74f6bc0801e (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 9deda0fcda5c1f388c5e279541850b71a2ccfcf4 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 11cb63b0d1a0685e0831ae3c77223e002ef18189 (git) Affected: f5346df0591d10bc948761ca854b1fae6d2ef441 (git) Affected: 5.15.148 , < 5.15.203 (semver) Affected: 6.1.75 , < 6.1.167 (semver) Affected: 6.6.14 , < 6.6.130 (semver) Affected: 6.7.2 , < 6.8 (semver)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:45:13.038Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc4e5bb529823a09f02dbe96169de679a9db26e0",
              "status": "affected",
              "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
              "versionType": "git"
            },
            {
              "lessThan": "fb3c380a54e33d1fd272cc342faa906d787d7ef1",
              "status": "affected",
              "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
              "versionType": "git"
            },
            {
              "lessThan": "5a110ddcc99bda77a28598b3555fe009eaab3828",
              "status": "affected",
              "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
              "versionType": "git"
            },
            {
              "lessThan": "524ce8b4ea8f64900b6c52b6a28df74f6bc0801e",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "9deda0fcda5c1f388c5e279541850b71a2ccfcf4",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "11cb63b0d1a0685e0831ae3c77223e002ef18189",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.130",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\nAs Paolo said earlier [1]:\n\n\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\nthe current skb being held by the defragmentation engine. As reported by\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\nlater on tries to tuch again such packet.\"\n\nact_ct was never meant to be used in the egress path, however some users\nare attaching it to egress today [2]. Attempting to reach a middle\nground, we noticed that, while most qdiscs are not handling\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\naddress the issue by only allowing act_ct to bind to clsact/ingress\nqdiscs and shared blocks. That way it\u0027s still possible to attach act_ct to\negress (albeit only with clsact).\n\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploiting this requires local access to configure tc qdiscs/filters via netlink (RTM_NEWTFILTER), which is a local operation requiring CAP_NET_ADMIN. The UaF is then triggered by sending packets through the misconfigured egress path.\nAC:L - The attacker fully controls the setup: creating the namespace, configuring the qdisc with act_ct, and sending fragmented packets to trigger defragmentation. The UaF is reliably triggered without needing to win any external race.\nPR:L - CAP_NET_ADMIN is required for tc filter creation, but this capability is obtainable by any unprivileged local user via user namespaces (unshare -Urn), making this reachable with low privileges.\nUI:N - No user interaction is needed. The attacker sets up the tc configuration and sends packets entirely on their own.\nS:U - This is a standard kernel memory corruption vulnerability. The impact stays within the kernel\u0027s security authority with no cross-boundary escape (no VM escape or sandbox escape).\nC:H - The use-after-free allows an attacker to control freed object contents via heap spraying, enabling arbitrary kernel memory reads and information disclosure.\nI:H - The use-after-free provides arbitrary write primitives through heap spraying of the freed skb, enabling code execution and full kernel compromise.\nA:H - The use-after-free causes kernel crashes (oops/panic) when the qdisc accesses the freed skb, as demonstrated in the original crash trace in the blamed commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:00.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828"
        },
        {
          "url": "https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e"
        },
        {
          "url": "https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189"
        }
      ],
      "title": "net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23270",
    "datePublished": "2026-03-18T17:54:43.803Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-09-08T08:45:13.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23392 (GCVE-0-2026-23392)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:33 – Updated: 2026-09-08 08:45

Title

netfilter: nf_tables: release flowtable after rcu grace period on error

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane. This error path is rare, it should only happen by reaching the maximum number hooks or by failing to set up to hardware offload, just call synchronize_rcu(). There is a check for already used device hooks by different flowtable that could result in EEXIST at this late stage. The hook parser can be updated to perform this check earlier to this error path really becomes rarely exercised. Uncovered by KASAN reported as use-after-free from nfnetlink_hook path when dumping hooks.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/d2632de96ccb066e0…
https://git.kernel.org/stable/c/adee3436ccd29f1e5…
https://git.kernel.org/stable/c/7e3955b282eae20d6…
https://git.kernel.org/stable/c/c8092edb9a11f20f9…
https://git.kernel.org/stable/c/e78a2dcc7cfb87b64…
https://git.kernel.org/stable/c/d73f4b53aaaea4c95…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < d2632de96ccb066e0131ad1494241b9c281c60b8 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < adee3436ccd29f1e514c028899e400cbc6d84065 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < 7e3955b282eae20d61c75e499c75eade51c20060 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < c8092edb9a11f20f95ccceeb9422b7dd0df337bd (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < e78a2dcc7cfb87b64a631441ca7681492b347ef6 (git) Affected: 3b49e2e94e6ebb8b23d0955d9e898254455734f8 , < d73f4b53aaaea4c95f245e491aa5eeb8a21874ce (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.18.20 , ≤ 6.18.* (semver) Unaffected: 6.19.10 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:45:56.367Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2632de96ccb066e0131ad1494241b9c281c60b8",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "adee3436ccd29f1e514c028899e400cbc6d84065",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "7e3955b282eae20d61c75e499c75eade51c20060",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "c8092edb9a11f20f95ccceeb9422b7dd0df337bd",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "e78a2dcc7cfb87b64a631441ca7681492b347ef6",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            },
            {
              "lessThan": "d73f4b53aaaea4c95f245e491aa5eeb8a21874ce",
              "status": "affected",
              "version": "3b49e2e94e6ebb8b23d0955d9e898254455734f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: release flowtable after rcu grace period on error\n\nCall synchronize_rcu() after unregistering the hooks from error path,\nsince a hook that already refers to this flowtable can be already\nregistered, exposing this flowtable to packet path and nfnetlink_hook\ncontrol plane.\n\nThis error path is rare, it should only happen by reaching the maximum\nnumber hooks or by failing to set up to hardware offload, just call\nsynchronize_rcu().\n\nThere is a check for already used device hooks by different flowtable\nthat could result in EEXIST at this late stage. The hook parser can be\nupdated to perform this check earlier to this error path really becomes\nrarely exercised.\n\nUncovered by KASAN reported as use-after-free from nfnetlink_hook path\nwhen dumping hooks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - nftables is accessed via netlink sockets (NFNL_SUBSYS_NFTABLES), requiring local system access through the netlink interface.\nAC:L - The attacker controls both sides of the race: they trigger the flowtable creation error path (via duplicate hooks causing EEXIST) and concurrently perform nfnetlink_hook dumps. Since the attacker controls both racing operations, complexity is Low.\nPR:L - nftables is reachable from unprivileged user namespaces (unshare -Urn), so only basic unprivileged user access is required.\nUI:N - No user interaction is needed; the attacker can trigger the flowtable creation and concurrent hook dump entirely on their own.\nS:U - This is a standard kernel use-after-free vulnerability within the same security authority (kernel space); it does not cross a security boundary like a VM escape.\nC:H - Use-after-free of the nft_flowtable heap object allows an attacker to control freed object contents via heap spraying, enabling arbitrary kernel memory reads.\nI:H - Use-after-free enables heap spraying to place attacker-controlled data in the freed flowtable object, providing arbitrary write primitives and potential control flow hijacking.\nA:H - Use-after-free reliably causes kernel crashes (oops/panic) when the freed flowtable memory is accessed by RCU readers on the packet path or nfnetlink_hook dump."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:21:23.296Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2632de96ccb066e0131ad1494241b9c281c60b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/adee3436ccd29f1e514c028899e400cbc6d84065"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e3955b282eae20d61c75e499c75eade51c20060"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8092edb9a11f20f95ccceeb9422b7dd0df337bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e78a2dcc7cfb87b64a631441ca7681492b347ef6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d73f4b53aaaea4c95f245e491aa5eeb8a21874ce"
        }
      ],
      "title": "netfilter: nf_tables: release flowtable after rcu grace period on error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23392",
    "datePublished": "2026-03-25T10:33:16.647Z",
    "dateReserved": "2026-01-13T15:37:46.011Z",
    "dateUpdated": "2026-09-08T08:45:56.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31419 (GCVE-0-2026-31419)

Vulnerability from cvelistv5 – Published: 2026-04-13 13:40 – Updated: 2026-08-23 12:45

Title

net: bonding: fix use-after-free in bond_xmit_broadcast()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

27 references

URL	Tags
https://git.kernel.org/stable/c/00752893f96b344f2…
https://git.kernel.org/stable/c/2de5c8eea0a9db99d…
https://git.kernel.org/stable/c/a0f661918edc79d7a…
https://git.kernel.org/stable/c/d4cc7e4c80b1634c7…
https://git.kernel.org/stable/c/f5b94654a4a19891a…
https://git.kernel.org/stable/c/2884bf72fb8f03409…
https://access.redhat.com/security/cve/CVE-2026-31419	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2457829	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:22334	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13566	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25191	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22940	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21209	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35870	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27353	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36530	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36532	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36533	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36172	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27354	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22900	vendor-advisoryx_refsource_REDHAT

Impacted products

22 products

Vendor	Product	Version
Linux	Linux	Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < 00752893f96b344f258c9c6de18b33171ac4872c (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04 (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < a0f661918edc79d7a75e468128af8d41e2a1a83a (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < d4cc7e4c80b1634c7b1497574a2fdb18df6c026c (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < f5b94654a4a19891a8108d66ef166de6c028c6cd (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < 2884bf72fb8f03409e423397319205de48adca16 (git) Affected: 20949c3816463e97c6f8fe84c0280c7e5ae83a8d (git) Affected: f1d206181f19b00b275b258fea1418718a2f4173 (git) Affected: c1f1691ef84fa6d38fa5e5148eca073145e97ffa (git) Affected: 5.10.94 , < 5.11 (semver) Affected: 5.15.17 , < 5.16 (semver) Affected: 5.16.3 , < 5.17 (semver)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-124.55.1.el10_1 , < * (rpm) Unaffected: 0:6.12.0-211.22.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.76.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.rt7.477.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.143.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.143.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.15.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.174.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.174.1.rt14.459.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:5.14.0-427.127.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.119.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1",
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-124.55.1.el10_1",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.22.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.76.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.rt7.477.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.143.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.143.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.15.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.174.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.174.1.rt14.459.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.127.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.119.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-13T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s bonding driver. A local attacker with low privileges could exploit a use-after-free vulnerability in the `bond_xmit_broadcast()` function. This occurs due to a race condition during concurrent slave enslave/release operations, which can lead to the original socket buffer (skb) being double-freed. Successful exploitation of this flaw can result in a system crash, leading to a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:09:22.472Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31419"
          },
          {
            "name": "RHBZ#2457829",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457829"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31419.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22334"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13566"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25191"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22940"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21209"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25217"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35870"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27353"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36530"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36532"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36533"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36534"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36172"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27354"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22900"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:22334: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13566: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25191: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22940: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21209: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35870: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27353: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36530: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19521: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36531: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36532: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36533: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36534: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36172: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27354: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-13T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-13T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00752893f96b344f258c9c6de18b33171ac4872c",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "2de5c8eea0a9db99dae7c36f4b541b74b41d3a04",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "a0f661918edc79d7a75e468128af8d41e2a1a83a",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "d4cc7e4c80b1634c7b1497574a2fdb18df6c026c",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "f5b94654a4a19891a8108d66ef166de6c028c6cd",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "2884bf72fb8f03409e423397319205de48adca16",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20949c3816463e97c6f8fe84c0280c7e5ae83a8d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1d206181f19b00b275b258fea1418718a2f4173",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c1f1691ef84fa6d38fa5e5148eca073145e97ffa",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.94",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop.  This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n                                                    ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n=================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in the packet transmit path triggered by the sendto() syscall; the race requires concurrent local slave management (enslave/release) via netlink, which a remote attacker cannot perform.\nAC:L - The attacker controls both sides of the race \u2014 one thread sends packets through the bond interface while another concurrently adds/removes slaves \u2014 making the race reliably triggerable.\nPR:L - Requires CAP_NET_ADMIN for bonding device creation and slave management, but this capability is obtainable by any unprivileged user via user namespaces (unshare -Urn).\nUI:N - No user interaction is required; the attacker sets up the bonding interface, sends packets, and triggers the race entirely autonomously.\nS:U - This is a standard kernel vulnerability that does not cross any security boundary such as a VM or sandbox.\nC:H - The use-after-free on a 224-byte sk_buff slab object can be leveraged via heap spraying to achieve arbitrary kernel memory reads.\nI:H - The use-after-free on sk_buff allows heap spray reclamation with attacker-controlled data, enabling arbitrary write primitives and potential code execution.\nA:H - The KASAN report in the commit demonstrates a kernel crash (slab-use-after-free), and any UAF reliably causes kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:30.305Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00752893f96b344f258c9c6de18b33171ac4872c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2de5c8eea0a9db99dae7c36f4b541b74b41d3a04"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0f661918edc79d7a75e468128af8d41e2a1a83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16"
        }
      ],
      "title": "net: bonding: fix use-after-free in bond_xmit_broadcast()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31419",
    "datePublished": "2026-04-13T13:40:23.279Z",
    "dateReserved": "2026-03-09T15:48:24.088Z",
    "dateUpdated": "2026-08-23T12:45:30.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31607 (GCVE-0-2026-31607)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:42 – Updated: 2026-08-21 12:13

Title

usbip: validate number_of_packets in usbip_pack_ret_submit()

Summary

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region. KASAN confirmed this with kernel 7.0.0-rc5: BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 The buggy address is located 0 bytes to the right of allocated 320-byte region [ffff888106351c00, ffff888106351d40) The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original number_of_packets. This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size. Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbip_recv_iso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit. Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE

CWE-805 - Buffer Access with Incorrect Length Value

Assigner

Linux mitre root

References

18 references

URL	Tags
https://git.kernel.org/stable/c/324262c38438255bf…
https://git.kernel.org/stable/c/973f2c250289f5bf6…
https://git.kernel.org/stable/c/ce744264b06b97069…
https://git.kernel.org/stable/c/885c8591784da6314…
https://git.kernel.org/stable/c/8d155e2d1c4102f74…
https://git.kernel.org/stable/c/906f16a836de13fe6…
https://git.kernel.org/stable/c/ef8ebb1c637b4cfb6…
https://git.kernel.org/stable/c/5e1c4ece08ccdc197…
https://git.kernel.org/stable/c/2ab833a16a825373a…
https://access.redhat.com/security/cve/CVE-2026-31607	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2461521	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:25095	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24343	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19569	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19568	vendor-advisoryx_refsource_REDHAT

Impacted products

11 products

Vendor	Product	Version
Linux	Linux	Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 324262c38438255bf6bdbf6342ca47c0badaab76 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 973f2c250289f5bf6cc146b98aa6fdde11fe50d6 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < ce744264b06b97069b3722511ab355738311fee0 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 885c8591784da6314f9aa82fa460ac69f9f79e5f (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 8d155e2d1c4102f74f82a2bf9c016164bb0f7384 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 906f16a836de13fe61f49cdce2f66f2dbd14caf4 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < ef8ebb1c637b4cfb61a9dd2e013376774ee2033b (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 5e1c4ece08ccdc197177631f111845a2c68eede3 (git) Affected: 1325f85fa49f57df034869de430f7c302ae23109 , < 2ab833a16a825373aad2ba7d54b572b277e95b71 (git) Affected: d9638d9236eed035a575feddec61d036dacc2676 (git) Affected: ca7d3501b7a287c18b5b470e871d3029b0f4842a (git) Affected: 1ce528277e1a66856ed3f7526c1e3458c0ed4a70 (git) Affected: db898d0c5c493ce4177d5e1d3a953e079a56a24b (git) Affected: 5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a (git) Affected: 2.6.32.37 , < 2.6.33 (semver) Affected: 2.6.33.10 , < 2.6.34 (semver) Affected: 2.6.34.11 , < 2.6.35 (semver) Affected: 2.6.35.13 , < 2.6.36 (semver) Affected: 2.6.38.3 , < 2.6.39 (semver)
Linux	Linux	Affected: 2.6.39 Unaffected: 0 , < 2.6.39 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0.1 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.16.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.77.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.155.1.rt56.1307.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.151.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.10.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.119.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.16.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.77.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.155.1.rt56.1307.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.151.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.10.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.119.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-805",
                "description": "Buffer Access with Incorrect Length Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T12:13:01.495Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31607"
          },
          {
            "name": "RHBZ#2461521",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461521"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25095"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24343"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19569"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:19568"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:25095: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, prevent the `usbip` kernel module from loading by blacklisting it. Create a file named `/etc/modprobe.d/blacklist-usbip.conf` with the following content:\n\n```\nblacklist usbip\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on USB/IP."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/usbip_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "324262c38438255bf6bdbf6342ca47c0badaab76",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "973f2c250289f5bf6cc146b98aa6fdde11fe50d6",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "ce744264b06b97069b3722511ab355738311fee0",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "885c8591784da6314f9aa82fa460ac69f9f79e5f",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "8d155e2d1c4102f74f82a2bf9c016164bb0f7384",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "906f16a836de13fe61f49cdce2f66f2dbd14caf4",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "ef8ebb1c637b4cfb61a9dd2e013376774ee2033b",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "5e1c4ece08ccdc197177631f111845a2c68eede3",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "lessThan": "2ab833a16a825373aad2ba7d54b572b277e95b71",
              "status": "affected",
              "version": "1325f85fa49f57df034869de430f7c302ae23109",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9638d9236eed035a575feddec61d036dacc2676",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca7d3501b7a287c18b5b470e871d3029b0f4842a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1ce528277e1a66856ed3f7526c1e3458c0ed4a70",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db898d0c5c493ce4177d5e1d3a953e079a56a24b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.33",
              "status": "affected",
              "version": "2.6.32.37",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.34",
              "status": "affected",
              "version": "2.6.33.10",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.35",
              "status": "affected",
              "version": "2.6.34.11",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.36",
              "status": "affected",
              "version": "2.6.35.13",
              "versionType": "semver"
            },
            {
              "lessThan": "2.6.39",
              "status": "affected",
              "version": "2.6.38.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/usbip_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.32.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.33.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.34.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.35.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.38.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb-\u003enumber_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb-\u003eiso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb-\u003eiso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n  BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n  Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n  The buggy address is located 0 bytes to the right of\n   allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo\u0027s series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu-\u003enumber_of_packets against\nurb-\u003enumber_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable client-side VHCI path processes USB/IP RET_SUBMIT responses received over a TCP socket from a remote USB/IP server. A malicious or compromised server can send the crafted network PDU; physical USB access is not required.\nAC:L - No race or hard-to-control condition is required; the server sees the client CMD_SUBMIT sequence number and can reply with an oversized number_of_packets. The attacker can reasonably present or service an isochronous USB device to reach the iso descriptor path.\nPR:N - The attacker needs no privileges on the vulnerable client system and USB/IP has no authentication gate in this kernel receive path. Once acting as the remote peer, the server-controlled RET_SUBMIT fields are accepted by vhci_rx.\nUI:N - In a reasonable high-impact deployment, the USB/IP client connection may already be established or automatically managed. Exploitation is then triggered solely by the remote server\u2019s response packet without further victim action.\nS:U - The corruption occurs in the client kernel and impacts resources governed by the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is heap memory corruption caused by attacker-controlled iso descriptors being written past the allocated urb-\u003eiso_frame_desc array. Such kernel memory corruption can be leveraged for information disclosure primitives, so confidentiality impact is high.\nI:H - usbip_recv_iso writes attacker-controlled descriptor fields out of bounds into adjacent kernel heap memory. This is a controlled kernel heap overwrite with plausible code execution or privilege escalation impact.\nA:H - KASAN confirmed a slab out-of-bounds write in the vhci_rx kernel thread. Even without full exploitation, a malicious server can crash or destabilize the kernel, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:45.870Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"
        },
        {
          "url": "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"
        },
        {
          "url": "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"
        },
        {
          "url": "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"
        }
      ],
      "title": "usbip: validate number_of_packets in usbip_pack_ret_submit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31607",
    "datePublished": "2026-04-24T14:42:29.468Z",
    "dateReserved": "2026-03-09T15:48:24.122Z",
    "dateUpdated": "2026-08-21T12:13:01.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31685 (GCVE-0-2026-31685)

Vulnerability from cvelistv5 – Published: 2026-04-25 08:47 – Updated: 2026-08-05 12:24

Title

netfilter: ip6t_eui64: reject invalid MAC header for all packets

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address. The existing guard only rejects an invalid MAC header when `par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` can still reach `eth_hdr(skb)` even when the MAC header is not valid. Fix this by removing the `par->fragoff != 0` condition so that packets with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/4d75bc2cd093bf580…
https://git.kernel.org/stable/c/7d6a57411caf54df0…
https://git.kernel.org/stable/c/d5603591373441fec…
https://git.kernel.org/stable/c/288138418bef956f8…
https://git.kernel.org/stable/c/9eda5478746ef7dc0…
https://git.kernel.org/stable/c/807d6ee15804df6f0…
https://git.kernel.org/stable/c/309ae3e9a51a69699…
https://git.kernel.org/stable/c/fdce0b3590f724540…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4d75bc2cd093bf5803edf512c099bfb220fd6459 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7d6a57411caf54df025860c9b1a82cd42d57a562 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d5603591373441fecf9951833d6d873e09320f08 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 288138418bef956f8b295751a4536c60f0e89f4a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9eda5478746ef7dc0e4e537b5a5e4b0ca1027091 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 807d6ee15804df6f01a35c910f09612e858739a6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 309ae3e9a51a69699ca94eac5fac5688fa562d55 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fdce0b3590f724540795b874b4c8850c90e6b0a8 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/netfilter/ip6t_eui64.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d75bc2cd093bf5803edf512c099bfb220fd6459",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7d6a57411caf54df025860c9b1a82cd42d57a562",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d5603591373441fecf9951833d6d873e09320f08",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "288138418bef956f8b295751a4536c60f0e89f4a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9eda5478746ef7dc0e4e537b5a5e4b0ca1027091",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "807d6ee15804df6f01a35c910f09612e858739a6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "309ae3e9a51a69699ca94eac5fac5688fa562d55",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fdce0b3590f724540795b874b4c8850c90e6b0a8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/netfilter/ip6t_eui64.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par-\u003efragoff != 0`. For packets with `par-\u003efragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par-\u003efragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable match runs from IPv6 netfilter PREROUTING/LOCAL_IN/FORWARD packet hooks, so a remote peer can reach it by sending IPv6 traffic to or through a host/router with an active eui64 xtables rule on a path with an invalid or absent Ethernet MAC header.\nAC:L - There is no race or timing requirement; the attacker can send first-fragment or non-fragment IPv6 packets with controlled header fields, and the active rule/interface combination is a deployment precondition.\nPR:N - Although installing the rule requires CAP_NET_ADMIN, in the highest-severity reasonable deployment the eui64 rule is already active and unauthenticated packets trigger the vulnerable packet path without attacker privileges.\nUI:N - No victim action is needed after the affected netfilter rule is present; packet delivery alone invokes the match.\nS:U - The impact remains within the kernel/networking security authority of the affected system and does not cross a VM, IOMMU, or similar boundary.\nC:H - With an unset or invalid MAC header, eth_hdr() can read outside the valid Ethernet header area and those bytes can influence observable netfilter behavior; following the required conservative rule for out-of-bounds reads, confidentiality is High.\nI:L - The bug can cause invalid-L2 packets to satisfy an eui64 match and bypass filtering decisions based on Ethernet-source-to-IPv6-source binding, but it does not provide a direct kernel write primitive.\nA:H - Invalid eth_hdr() access on packets with no valid MAC header can produce kernel warnings/oopses or KASAN-detected out-of-bounds accesses, and an attacker can repeat packet delivery to sustain denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:29.973Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d75bc2cd093bf5803edf512c099bfb220fd6459"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d6a57411caf54df025860c9b1a82cd42d57a562"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5603591373441fecf9951833d6d873e09320f08"
        },
        {
          "url": "https://git.kernel.org/stable/c/288138418bef956f8b295751a4536c60f0e89f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9eda5478746ef7dc0e4e537b5a5e4b0ca1027091"
        },
        {
          "url": "https://git.kernel.org/stable/c/807d6ee15804df6f01a35c910f09612e858739a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/309ae3e9a51a69699ca94eac5fac5688fa562d55"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdce0b3590f724540795b874b4c8850c90e6b0a8"
        }
      ],
      "title": "netfilter: ip6t_eui64: reject invalid MAC header for all packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31685",
    "datePublished": "2026-04-25T08:47:02.857Z",
    "dateReserved": "2026-03-09T15:48:24.131Z",
    "dateUpdated": "2026-08-05T12:24:29.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:23224

BDU:2026-12288 (CVE-2026-23270)

CVE-2025-38653 (GCVE-0-2025-38653)

CVE-2025-39766 (GCVE-0-2025-39766)

CVE-2025-68366 (GCVE-0-2025-68366)

CVE-2026-23210 (GCVE-0-2026-23210)

CVE-2026-23270 (GCVE-0-2026-23270)

CVE-2026-23392 (GCVE-0-2026-23392)

CVE-2026-31419 (GCVE-0-2026-31419)

CVE-2026-31607 (GCVE-0-2026-31607)

CVE-2026-31685 (GCVE-0-2026-31685)

Tags

Sightings

Nomenclature

Related by attack behaviour