Vulnerability-Lookup

RHSA-2026:27708

Vulnerability from csaf_redhat - Published: 2026-06-22 06:44 - Updated: 2026-09-16 18:29

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * [RHEL-9] Performance impact of CVE-2025-38085 [rhel-9.6.z] (JIRA:RHEL-161145) * libceph: CEPH_CRYPTO_AES256KRB5 (--key-type aes256k) support [rhel-9.6.z] (JIRA:RHEL-168926) * [ice] 3 of 4 ports "Failed to set LAN Tx queue context, error: -22" [rhel-9.6.z] (JIRA:RHEL-175439) * Kernel panic while shutting down ice driver due to use-after-free [rhel-9.6.z] (JIRA:RHEL-177524) * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.6.z] (JIRA:RHEL-183129) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-40064

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened at __pnet_find_base_ndev() when the dev is first used. This means dev had already been freed before acquiring RTNL in pnet_find_base_ndev(). While dev is going away, dst->dev could be swapped with blackhole_netdev, and the dev's refcnt by dst will be released. We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). Also, smc_pnet_find_roce_resource() has the same problem. Let's use __sk_dst_get() and dst_dev_rcu() in the two functions. [0]: BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 CPU: 1 UID: 0 PID: 18609 Comm: syz.0.3632 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 pnet_find_base_ndev net/smc/smc_pnet.c:946 [inline] smc_pnet_find_ism_by_pnetid net/smc/smc_pnet.c:1103 [inline] smc_pnet_find_ism_resource+0xef/0x390 net/smc/smc_pnet.c:1154 smc_find_ism_device net/smc/af_smc.c:1030 [inline] smc_find_proposal_devices net/smc/af_smc.c:1115 [inline] __smc_connect+0x372/0x1890 net/smc/af_smc.c:1545 smc_connect+0x877/0xd90 net/smc/af_smc.c:1715 __sys_connect_file net/socket.c:2086 [inline] __sys_connect+0x313/0x440 net/socket.c:2105 __do_sys_connect net/socket.c:2111 [inline] __se_sys_connect net/socket.c:2108 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2108 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f47cbf8eba9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f47ccdb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f47cc1d5fa0 RCX: 00007f47cbf8eba9 RDX: 0000000000000010 RSI: 0000200000000280 RDI: 000000000000000b RBP: 00007f47cc011e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f47cc1d6038 R14: 00007f47cc1d5fa0 R15: 00007ffc512f8aa8 </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036bacd00 pfn:0x36bac flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0001243d08 ffff8880b863fdc0 0000000000000000 raw: ffff888036bacd00 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 16741, tgid 16741 (syz-executor), ts 343313197788, free_ts 380670750466 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kvmalloc_node ---truncated---

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-doc-0:5.14.0-570.123.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.123.1.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-570.123.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-uki-virt-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-uki-virt-addons-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-kvm-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.123.1.el9_6.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-40168

A flaw was found in the Linux kernel’s SMC (Shared Memory Communication) module: in smc_clc_prfx_match(), the function is called from smc_listen_work() without proper RCU or RTNL protection. The code previously used sk_dst_get(sk)->dev, which can lead to a use-after-free (UAF) condition if the sk’s destination is freed concurrently.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Moderate

CVE-2026-23136

A flaw was found in the Linux kernel's libceph OSD client. When a connection fault occurs during a sparse read, the sparse-read state is not properly reset. This allows a misbehaving or compromised Ceph OSD server, or a network adversary, to disrupt traffic. As a result, the client can misinterpret new data as a continuation of previous data, leading to a persistent failure mode, repeated errors, and continuous retry loops, effectively causing a Denial of Service (DoS) for Ceph clients performing sparse reads.

7.6 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-440 - Expected Behavior Violation

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Moderate

CVE-2026-43116

A flaw was found in the `netfilter: ctnetlink` component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition, leading to a system crash and a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Moderate

CVE-2026-43158

A flaw was found in the Linux kernel's XFS filesystem. When adding extended attributes (xattrs), which are metadata associated with files, to leaf blocks, incorrect adjustments to the freemap can occur. This inconsistency allows the entries array and free space to overlap, leading to an assertion failure. A local user can exploit this to cause the filesystem to shut down, resulting in a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Moderate

CVE-2026-43303

A flaw was found in the Linux kernel's memory management subsystem. When pages are freed, the page->private field is not properly cleared. If these pages are later reallocated as high-order pages and split, the tail pages can retain stale page->private values. This can lead to a use-after-free vulnerability in the swap subsystem, where incorrect assumptions about the page->private value can cause the system to crash.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-909 - Missing Initialization of Resource

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Moderate

CVE-2026-45898

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) Internet Wide Area RDMA Protocol (iWARP) subsystem. Incorrect work submission logic in the `iwcm` component can lead to multiple queueing of work items. This allows a work item to be processed and freed while still present in the workqueue, causing list corruption. A successful exploitation of this vulnerability can result in a kernel bug and system crash, leading to a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Important

CVE-2026-46125

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When Multi-Link Operation (MLO) connection preparation fails, the system may not correctly remove the associated station. This can lead to a use-after-free or double-free vulnerability in the debugfs component, potentially causing system instability or unexpected behavior.

6.8 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Important

CVE-2026-46166

A flaw was found in the Linux kernel's mac80211 wireless subsystem. This vulnerability arises from unsafe list iteration during radar detection work, where a channel context can be freed while still being processed. This can lead to a use-after-free memory error. A successful exploit could result in system instability or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Important

CVE-2026-46243

A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation. This could allow a local attacker to impersonate other users, bypass authentication in SMB mount operations, and potentially gain unauthorized access to network file shares or escalate privileges.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Important

CVE-2026-46323

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-123 - Write-what-where Condition

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Important

CVE-2026-46331

A flaw was found in the Linux kernel's traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 305 products, the same list as for CVE-2025-40064

Threats

Impact Important

References

84 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:27708	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2406747	external
https://bugzilla.redhat.com/show_bug.cgi?id=2414482	external
https://bugzilla.redhat.com/show_bug.cgi?id=2439852	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467005	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467210	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468091	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479492	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	external
https://bugzilla.redhat.com/show_bug.cgi?id=2481486	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482031	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482608	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482645	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-40064	self
https://bugzilla.redhat.com/show_bug.cgi?id=2406747	external
https://www.cve.org/CVERecord?id=CVE-2025-40064	external
https://nvd.nist.gov/vuln/detail/CVE-2025-40064	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-40168	self
https://bugzilla.redhat.com/show_bug.cgi?id=2414482	external
https://www.cve.org/CVERecord?id=CVE-2025-40168	external
https://nvd.nist.gov/vuln/detail/CVE-2025-40168	external
https://lore.kernel.org/linux-cve-announce/202511…	external
https://access.redhat.com/security/cve/CVE-2026-23136	self
https://bugzilla.redhat.com/show_bug.cgi?id=2439852	external
https://www.cve.org/CVERecord?id=CVE-2026-23136	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23136	external
https://lore.kernel.org/linux-cve-announce/202602…	external
https://access.redhat.com/security/cve/CVE-2026-43116	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467005	external
https://www.cve.org/CVERecord?id=CVE-2026-43116	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43116	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43158	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467210	external
https://www.cve.org/CVERecord?id=CVE-2026-43158	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43158	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43303	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468091	external
https://www.cve.org/CVERecord?id=CVE-2026-43303	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43303	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-45898	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482031	external
https://www.cve.org/CVERecord?id=CVE-2026-45898	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45898	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46125	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482608	external
https://www.cve.org/CVERecord?id=CVE-2026-46125	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46125	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46166	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482645	external
https://www.cve.org/CVERecord?id=CVE-2026-46166	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46166	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46243	self
https://bugzilla.redhat.com/show_bug.cgi?id=2481486	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-46243	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46243	external
https://git.kernel.org/pub/scm/linux/kernel/git/t…	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-46323	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	external
https://www.cve.org/CVERecord?id=CVE-2026-46323	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46323	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://lore.kernel.org/netdev/4d583fc5401298453d…	external
https://lore.kernel.org/netdev/agVpIsaSherjHTYg@s…	external
https://access.redhat.com/security/cve/CVE-2026-46331	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479492	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-46331	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46331	external
https://lore.kernel.org/netdev/20260516162825.148…	external

JSON

To clipboard

Loading 1.4 MB of JSON…

CVE-2026-46243 (GCVE-0-2026-46243)

Vulnerability from cvelistv5 – Published: 2026-06-01 16:22 – Updated: 2026-09-01 12:04

Title

smb: client: reject userspace cifs.spnego descriptions

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 00:00 UTC

CWE

CWE-20 - Improper Input Validation
CWE-825 - Expired Pointer Dereference

Assigner

Linux mitre root

References

47 references

URL	Tags
https://git.kernel.org/stable/c/7713bd320ed4fc3d0…
https://git.kernel.org/stable/c/9544559e59438a4b6…
https://git.kernel.org/stable/c/cf20038657d6d4974…
https://git.kernel.org/stable/c/2035acfb17221729b…
https://git.kernel.org/stable/c/a3bbda6502a9398b8…
https://git.kernel.org/stable/c/91f89c1d83e804176…
https://git.kernel.org/stable/c/0aece6685fc80a8de…
https://git.kernel.org/stable/c/3da1fdf4efbc49004…
https://github.com/manizada/CIFSwitch	exploit
http://www.openwall.com/lists/oss-security/2026/06/01/6
https://access.redhat.com/security/cve/CVE-2026-46243	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2481486	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:23395	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33486	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27719	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27729	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34048	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40021	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28887	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28962	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36620	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47727	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34815	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34757	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34788	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25908	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23329	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26515	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27735	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27708	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24381	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33225	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23258	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33220	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26535	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26563	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33219	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33221	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33222	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33223	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23259	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26462	vendor-advisoryx_refsource_REDHAT

Impacted products

38 products

Vendor	Product	Version
Linux	Linux	Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < 7713bd320ed4fc3d08a227cd8e41242219a16981 (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < 9544559e59438a4b609b2fdfa0763d8360572824 (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < cf20038657d6d4974349556a34e08fe0490bebbc (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < 2035acfb17221729b1b8ac335e941868a04ca079 (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < a3bbda6502a9398b816fa2e71c9a3f955f58013d (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < 91f89c1d83e80417629791fcef6af8140d7d01c8 (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < 0aece6685fc80a8de492688ca2315fb86ec379c7 (git) Affected: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 , < 3da1fdf4efbc490041eb4f836bf596201203f8f2 (git)
Linux	Linux	Affected: 2.6.24 Unaffected: 0 , < 2.6.24 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	NVIDIA for RHEL 10	Unaffected: 0:6.12.0-212.9.el10nv , < * (rpm) Unaffected: 0:6.12.0-231.12.el10nv , < * (rpm) cpe:/a:redhat:enterprise_linux_nvidia:10::el10
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.20.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.79.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	Unaffected: 0:2.6.32-754.61.1.el6 , < * (rpm) cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.155.1.rt56.1307.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.153.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.129.1.rt7.470.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.129.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.194.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.194.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.196.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.196.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.147.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.147.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.13.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.176.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.176.1.rt14.461.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.132.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.123.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202606251120-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202607141229-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202606231112-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202606200237-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202607021016-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202607240132-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202606250458-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202606302000-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202607010620-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202607011303-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-46243",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T03:56:00.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/manizada/CIFSwitch"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-01T18:55:00.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/01/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "NVIDIA for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-212.9.el10nv",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-231.12.el10nv",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.20.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.79.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.32-754.61.1.el6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.155.1.rt56.1307.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.153.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.129.1.rt7.470.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.129.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.194.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.194.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.196.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.196.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.147.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.147.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.13.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.176.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.176.1.rt14.461.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.132.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.123.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202606251120-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202607141229-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202606231112-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202606200237-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202607021016-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202607240132-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202606250458-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202606302000-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202607010620-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202607011303-0",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-05-26T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A privilege escalation vulnerability was found in the Linux kernel\u0027s CIFS client implementation. This could allow a local attacker to impersonate other users, bypass authentication in SMB mount operations, and potentially gain unauthorized access to network file shares or escalate privileges."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:04:59.876Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46243"
          },
          {
            "name": "RHBZ#2481486",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481486"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46243.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23395"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33486"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27719"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27729"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34048"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40021"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28887"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28962"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36620"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47727"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34815"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34757"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34788"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25908"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23329"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26515"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27735"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27708"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24381"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33225"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23258"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33220"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26535"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26563"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33221"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33222"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33223"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23259"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26462"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:23395: NVIDIA for RHEL 10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33486: NVIDIA for RHEL 10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27719: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27729: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34048: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40021: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28962: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36620: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47727: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34815: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34757: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34788: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34764: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25908: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23329: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26515: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24381: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33225: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23258: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33220: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26570: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26563: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33219: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33221: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33222: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33223: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33224: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23259: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26462: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-26T15:07:49.955Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-26T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions",
        "workarounds": [
          {
            "lang": "en",
            "value": "See the security bulletin for a detailed mitigation procedure."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifs_spnego.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7713bd320ed4fc3d08a227cd8e41242219a16981",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "9544559e59438a4b609b2fdfa0763d8360572824",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "cf20038657d6d4974349556a34e08fe0490bebbc",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "2035acfb17221729b1b8ac335e941868a04ca079",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "a3bbda6502a9398b816fa2e71c9a3f955f58013d",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "91f89c1d83e80417629791fcef6af8140d7d01c8",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "0aece6685fc80a8de492688ca2315fb86ec379c7",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            },
            {
              "lessThan": "3da1fdf4efbc490041eb4f836bf596201203f8f2",
              "status": "affected",
              "version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifs_spnego.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.spnego descriptions\n\ncifs.spnego key descriptions contain authority-bearing fields such as\npid, uid, creduid, and upcall_target that cifs.upcall treats as\nkernel-originating inputs. However, userspace can also create keys of\nthis type through request_key(2) or add_key(2), allowing those fields to\nbe supplied without CIFS origin.\n\nOnly accept cifs.spnego descriptions while CIFS is using its private\nspnego_cred to request the key."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user\u2019s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:42.627Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981"
        },
        {
          "url": "https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf20038657d6d4974349556a34e08fe0490bebbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2"
        }
      ],
      "title": "smb: client: reject userspace cifs.spnego descriptions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46243",
    "datePublished": "2026-06-01T16:22:29.211Z",
    "dateReserved": "2026-05-13T15:03:33.107Z",
    "dateUpdated": "2026-09-01T12:04:59.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46323 (GCVE-0-2026-46323)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:11 – Updated: 2026-09-08 08:49

Title

net: gro: don't merge zcopy skbs

Summary

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-123 - Write-what-where Condition

Assigner

Linux mitre root

References

24 references

URL	Tags
https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd6…
https://git.kernel.org/stable/c/1f9c828556416fbe3…
https://git.kernel.org/stable/c/479084ae0e1d9cb79…
https://git.kernel.org/stable/c/e334cbf3388fd9334…
https://git.kernel.org/stable/c/44bea2032af0425e4…
https://git.kernel.org/stable/c/4db79a322db8c97f7…
https://access.redhat.com/security/cve/CVE-2026-46323	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:47727	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44230	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44259	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27731	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44270	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27735	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27708	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62642	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62641	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62640	vendor-advisoryx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

21 products

Vendor	Product	Version
Linux	Linux	Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 1f9c828556416fbe3f49386708ce999fc4d4da06 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 479084ae0e1d9cb7929cb4298d35623de189f80a (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < e334cbf3388fd9334503a778a82d9e9f14dd2f71 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 44bea2032af0425e4ce6d26a8af0ede79db49ec1 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 4db79a322db8c97f7b73b8a347395ef4d685eb40 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.38.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.82.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.132.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.123.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202607240132-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202607211754-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202607220857-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202607221038-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202607221317-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	cpe:/a:redhat:enterprise_linux_nvidia:
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.38.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.82.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.132.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.123.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202607240132-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202607211754-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202607220857-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202607221038-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202607221317-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux for NVIDIA 26",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-19T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-123",
                "description": "Write-what-where Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T12:04:41.019Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46323"
          },
          {
            "name": "RHBZ#2479832",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479832"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46323.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47727"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44230"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44259"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27731"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44270"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27735"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27708"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62642"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62641"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62640"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:47727: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44230: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44231: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44259: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44262: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44270: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62642: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62639: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62641: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62640: Red Hat Enterprise Linux BaseOS (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-19T11:49:44.372Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-19T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:31.031Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "1f9c828556416fbe3f49386708ce999fc4d4da06",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "479084ae0e1d9cb7929cb4298d35623de189f80a",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "e334cbf3388fd9334503a778a82d9e9f14dd2f71",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "44bea2032af0425e4ce6d26a8af0ede79db49ec1",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "4db79a322db8c97f7b73b8a347395ef4d685eb40",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:18.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06"
        },
        {
          "url": "https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71"
        },
        {
          "url": "https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40"
        }
      ],
      "title": "net: gro: don\u0027t merge zcopy skbs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46323",
    "datePublished": "2026-06-09T12:11:15.562Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-09-08T08:49:31.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46331 (GCVE-0-2026-46331)

Vulnerability from cvelistv5 – Published: 2026-06-16 06:26 – Updated: 2026-09-15 12:04

Title

net/sched: fix pedit partial COW leading to page cache corruption

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 00:00 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-190 - Integer Overflow or Wraparound

Assigner

Linux mitre root

References

44 references

URL	Tags
https://git.kernel.org/stable/c/544d857b42a1734b9…
https://git.kernel.org/stable/c/d5d01d35a5a7d36f7…
https://git.kernel.org/stable/c/a071e057518decc5e…
https://git.kernel.org/stable/c/b685d6ef6f07a3b5c…
https://git.kernel.org/stable/c/2bec122b9fb91507a…
https://git.kernel.org/stable/c/b198ed4e52580a723…
https://git.kernel.org/stable/c/3dee9d0c198faeb95…
https://git.kernel.org/stable/c/899ee91156e577840…
https://github.com/sgkdev/packet_edit_meme/tree/main	exploit
https://access.redhat.com/security/cve/CVE-2026-46331	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2479492	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:27709	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33666	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34048	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40021	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28887	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28962	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29080	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34098	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29856	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29863	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29799	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29833	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29794	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27731	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27288	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27705	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27713	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27708	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33225	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27353	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33220	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27707	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27704	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27355	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33219	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33221	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33222	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33223	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27354	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27706	vendor-advisoryx_refsource_REDHAT

Impacted products

40 products

Vendor	Product	Version
Linux	Linux	Affected: abe35bf3be51482593076d516a680d79e5fbc8e1 , < 544d857b42a1734b923040e13aa61a6fd4746cf2 (git) Affected: b773640d5bb9e2acfd91e2695717af04d47aa116 , < d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc (git) Affected: 8b796475fd7882663a870456466a4fb315cc1bd6 , < a071e057518decc5e3bec89855758f5f8786f2c5 (git) Affected: 8b796475fd7882663a870456466a4fb315cc1bd6 , < b685d6ef6f07a3b5ce814565a25f39f2157538a5 (git) Affected: 8b796475fd7882663a870456466a4fb315cc1bd6 , < 2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b (git) Affected: 8b796475fd7882663a870456466a4fb315cc1bd6 , < b198ed4e52580a7238c7c7082f03906f8b310313 (git) Affected: 8b796475fd7882663a870456466a4fb315cc1bd6 , < 3dee9d0c198faeb95d052c1b94c2958751a28512 (git) Affected: 8b796475fd7882663a870456466a4fb315cc1bd6 , < 899ee91156e57784090c5565e4f31bd7dbffbc5a (git) Affected: d0c38a914b0c4c21d553da801003d36979016726 (git) Affected: 2ec2dd7d51a9320151f275ddbb2b53260fb32ca1 (git) Affected: c19cc520b3d69904e9518d401ad0df7f4702aca0 (git) Affected: 5.10.117 , < 5.10.260 (semver) Affected: 5.15.41 , < 5.15.211 (semver) Affected: 4.19.244 , < 4.20 (semver) Affected: 5.4.195 , < 5.5 (semver) Affected: 5.17.9 , < 5.18 (semver)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	NVIDIA for RHEL 10	Unaffected: 0:6.12.0-212.11.el10nv , < * (rpm) Unaffected: 0:6.12.0-231.13.el10nv , < * (rpm) cpe:/a:redhat:enterprise_linux_nvidia:10::el10
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.26.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.82.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.rt7.477.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.136.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.195.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.195.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.197.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.197.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.148.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.148.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.17.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.177.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.177.1.rt14.462.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.134.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.123.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202606251120-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202607141229-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202606231112-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202606200237-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202606230218-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202606250942-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202606221349-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202606241344-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202606241928-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202606241859-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202606230855-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46331",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T03:55:32.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sgkdev/packet_edit_meme/tree/main"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "NVIDIA for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-212.11.el10nv",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-231.13.el10nv",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.26.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.82.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.rt7.477.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.136.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.195.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.195.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.197.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.197.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.148.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.148.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.17.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.177.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.177.1.rt14.462.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.134.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.123.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202606251120-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202607141229-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202606231112-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202606200237-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202606230218-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202606250942-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202606221349-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202606241344-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202606241928-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202606241859-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202606230855-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-18T04:04:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:26.609Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46331"
          },
          {
            "name": "RHBZ#2479492",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479492"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27709"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33666"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34048"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40021"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28887"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28962"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29080"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34098"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29856"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29863"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29799"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29833"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29794"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27731"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27288"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27705"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27713"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27708"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33225"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27353"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33220"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27707"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27704"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27355"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33221"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33222"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33223"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27354"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27706"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:27709: NVIDIA for RHEL 10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33666: NVIDIA for RHEL 10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34048: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40021: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28962: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29080: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29856: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29863: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29799: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29833: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29794: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27705: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27713: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33225: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27353: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33220: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27707: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27704: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27355: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33219: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33221: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33222: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33223: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33224: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27354: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27706: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-18T06:17:23.219Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-18T04:04:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: net/sched: act_pedit: extend the writable skb range per key",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, prevent the \u0027act_pedit\u0027 kernel module from loading. Create a file `/etc/modprobe.d/disable-act_pedit.conf` with the following content:\n\n`install act_pedit /bin/true`\n\nThen, regenerate the initramfs and reboot the system for the changes to take effect. This may impact network traffic control functionality that relies on the pedit action."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tc_act/tc_pedit.h",
            "net/sched/act_pedit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "544d857b42a1734b923040e13aa61a6fd4746cf2",
              "status": "affected",
              "version": "abe35bf3be51482593076d516a680d79e5fbc8e1",
              "versionType": "git"
            },
            {
              "lessThan": "d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc",
              "status": "affected",
              "version": "b773640d5bb9e2acfd91e2695717af04d47aa116",
              "versionType": "git"
            },
            {
              "lessThan": "a071e057518decc5e3bec89855758f5f8786f2c5",
              "status": "affected",
              "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
              "versionType": "git"
            },
            {
              "lessThan": "b685d6ef6f07a3b5ce814565a25f39f2157538a5",
              "status": "affected",
              "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
              "versionType": "git"
            },
            {
              "lessThan": "2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b",
              "status": "affected",
              "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
              "versionType": "git"
            },
            {
              "lessThan": "b198ed4e52580a7238c7c7082f03906f8b310313",
              "status": "affected",
              "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
              "versionType": "git"
            },
            {
              "lessThan": "3dee9d0c198faeb95d052c1b94c2958751a28512",
              "status": "affected",
              "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
              "versionType": "git"
            },
            {
              "lessThan": "899ee91156e57784090c5565e4f31bd7dbffbc5a",
              "status": "affected",
              "version": "8b796475fd7882663a870456466a4fb315cc1bd6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d0c38a914b0c4c21d553da801003d36979016726",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2ec2dd7d51a9320151f275ddbb2b53260fb32ca1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c19cc520b3d69904e9518d401ad0df7f4702aca0",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.260",
              "status": "affected",
              "version": "5.10.117",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.211",
              "status": "affected",
              "version": "5.15.41",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.244",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.195",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tc_act/tc_pedit.h",
            "net/sched/act_pedit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "5.10.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "5.15.41",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.244",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.195",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW\u0027d.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable pedit action is reached through local tc/rtnetlink configuration and local packet generation, not by unauthenticated network input alone. Even if remote traffic can traverse an already configured pedit rule, creating the exploitable action is a local operation.\nAC:L - There is no attacker-uncontrolled race; the attacker can choose the pedit key, header type, offset, and traffic shape. The partial COW condition is deterministic once suitable shared or page-cache-backed skbs are generated.\nPR:L - Installing the pedit action through RTM_NEWTFILTER requires CAP_NET_ADMIN in the network namespace. With unprivileged user namespaces, a basic local user can obtain namespace CAP_NET_ADMIN, so this is Low rather than High.\nUI:N - The attacker can configure the tc action and generate the triggering traffic without requiring any victim action. No user needs to open a file, mount a filesystem, or interact with crafted data.\nS:U - The vulnerability is in the kernel networking subsystem and impacts kernel-managed memory and page cache within the same security authority. It is a standard local kernel privilege-escalation/data-corruption issue, not a VM escape or separate-scope boundary bypass.\nC:H - The bug permits corruption of shared skb/page-cache memory outside the intended COW range, which is kernel memory/data corruption. Such corruption is defensibly usable for privilege escalation, after which protected information can be read.\nI:H - The vulnerable path gives attacker-influenced writes into shared page-cache-backed packet data that should have been private. This can corrupt protected data or code pages and is defensibly a high-integrity arbitrary data modification primitive.\nA:H - Repeated page cache or kernel memory corruption can crash the kernel, corrupt critical cached files, or destabilize networking and userspace execution. A kernel crash or system-wide corruption warrants High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:25.966Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512"
        },
        {
          "url": "https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a"
        }
      ],
      "title": "net/sched: fix pedit partial COW leading to page cache corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46331",
    "datePublished": "2026-06-16T06:26:21.066Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-09-15T12:04:26.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:27708

CVE-2026-46243 (GCVE-0-2026-46243)

CVE-2026-46323 (GCVE-0-2026-46323)

CVE-2026-46331 (GCVE-0-2026-46331)

Tags

Sightings

Nomenclature

Related by attack behaviour