Vulnerability-Lookup

alsa-2026:61887

Vulnerability from osv_almalinux

Published

2026-09-01 00:00

Modified

2026-09-04 20:49

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)
kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)
kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)
kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)
kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)
kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)
kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)
kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685)
kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)
kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)

Bug Fix(es) and Enhancement(s):

AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180)
qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043)
ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393)
[AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627)
AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:61887	ADVISORY
	https://access.redhat.com/security/cve/CVE-2025-21834	REPORT
	https://access.redhat.com/security/cve/CVE-2026-23003	REPORT
	https://access.redhat.com/security/cve/CVE-2026-43450	REPORT
	https://access.redhat.com/security/cve/CVE-2026-43454	REPORT
	https://access.redhat.com/security/cve/CVE-2026-45970	REPORT
	https://access.redhat.com/security/cve/CVE-2026-46120	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53026	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53053	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53153	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53185	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53189	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53196	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53391	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53392	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53397	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53399	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63800	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64018	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64136	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64189	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64276	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64277	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64298	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64304	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64320	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64384	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64418	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64438	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64490	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68086	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68166	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68480	REPORT
	https://access.redhat.com/security/cve/CVE-2026-72069	REPORT
	https://access.redhat.com/security/cve/CVE-2026-72130	REPORT
	https://bugzilla.redhat.com/2350398	REPORT
	https://bugzilla.redhat.com/2432681	REPORT
	https://bugzilla.redhat.com/2468145	REPORT
	https://bugzilla.redhat.com/2468228	REPORT
	https://bugzilla.redhat.com/2482006	REPORT
	https://bugzilla.redhat.com/2482614	REPORT
	https://bugzilla.redhat.com/2492310	REPORT
	https://bugzilla.redhat.com/2492454	REPORT
	https://bugzilla.redhat.com/2492735	REPORT
	https://bugzilla.redhat.com/2492750	REPORT
	https://bugzilla.redhat.com/2492788	REPORT
	https://bugzilla.redhat.com/2492790	REPORT
	https://bugzilla.redhat.com/2502219	REPORT
	https://bugzilla.redhat.com/2502227	REPORT
	https://bugzilla.redhat.com/2502239	REPORT
	https://bugzilla.redhat.com/2502240	REPORT
	https://bugzilla.redhat.com/2502260	REPORT
	https://bugzilla.redhat.com/2502421	REPORT
	https://bugzilla.redhat.com/2502527	REPORT
	https://bugzilla.redhat.com/2502889	REPORT
	https://bugzilla.redhat.com/2507061	REPORT
	https://bugzilla.redhat.com/2507118	REPORT
	https://bugzilla.redhat.com/2507119	REPORT
	https://bugzilla.redhat.com/2507208	REPORT
	https://bugzilla.redhat.com/2507277	REPORT
	https://bugzilla.redhat.com/2507285	REPORT
	https://bugzilla.redhat.com/2507287	REPORT
	https://bugzilla.redhat.com/2507290	REPORT
	https://bugzilla.redhat.com/2507301	REPORT
	https://bugzilla.redhat.com/2508363	REPORT
	https://bugzilla.redhat.com/2513141	REPORT
	https://bugzilla.redhat.com/2513167	REPORT
	https://bugzilla.redhat.com/2516248	REPORT
	https://bugzilla.redhat.com/2516448	REPORT
	https://errata.almalinux.org/10/ALSA-2026-61887.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-abi-stablelists"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-cross-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-doc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt-addons"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libperf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rtla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.50.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.  \n\nSecurity Fix(es):  \n\n  * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)\n  * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)\n  * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)\n  * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)\n  * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)\n  * kernel: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (CVE-2026-46120)\n  * kernel: iommu/amd: Fix clone_alias() to use the original device\u0027s devid (CVE-2026-53053)\n  * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)\n  * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)\n  * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)\n  * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)\n  * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)\n  * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)\n  * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)\n  * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)\n  * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)\n  * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)\n  * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)\n  * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)\n  * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)\n  * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)\n  * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)\n  * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)\n  * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)\n  * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)\n  * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)\n  * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)\n  * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)\n  * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)\n  * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)\n  * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)\n  * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)\n  * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)\n  * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)\n  * kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685)\n  * kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)\n  * kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180)\n  * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043)\n  * ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393)\n  * [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627)\n  * AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:61887",
  "modified": "2026-09-04T20:49:06Z",
  "published": "2026-09-01T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:61887"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21834"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-23003"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43450"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43454"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45970"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-46120"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53026"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53053"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53153"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53185"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53189"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53196"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53391"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53392"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53397"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53399"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63800"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64018"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64136"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64189"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64276"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64277"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64298"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64304"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64320"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64384"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64418"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64438"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64490"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68086"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68166"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68480"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-72069"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-72130"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2350398"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2432681"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2468145"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2468228"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482006"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482614"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492310"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492454"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492735"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492750"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492788"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502219"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502227"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502239"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502240"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502260"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502421"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502527"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502889"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507061"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507118"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507119"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507208"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507277"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507285"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507287"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507290"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507301"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2508363"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2513141"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2513167"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516248"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516448"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-61887.html"
    }
  ],
  "related": [
    "CVE-2025-21834",
    "CVE-2026-23003",
    "CVE-2026-43454",
    "CVE-2026-43450",
    "CVE-2026-45970",
    "CVE-2026-46120",
    "CVE-2026-53053",
    "CVE-2026-53026",
    "CVE-2026-53185",
    "CVE-2026-53196",
    "CVE-2026-53189",
    "CVE-2026-53153",
    "CVE-2026-63800",
    "CVE-2026-53397",
    "CVE-2026-53399",
    "CVE-2026-53392",
    "CVE-2026-53391",
    "CVE-2026-64018",
    "CVE-2026-64136",
    "CVE-2026-64189",
    "CVE-2026-64320",
    "CVE-2026-64438",
    "CVE-2026-64304",
    "CVE-2026-64298",
    "CVE-2026-64490",
    "CVE-2026-64418",
    "CVE-2026-64384",
    "CVE-2026-64277",
    "CVE-2026-64276",
    "CVE-2026-68480",
    "CVE-2026-68086",
    "CVE-2026-68166",
    "CVE-2026-72069",
    "CVE-2026-72130",
    "CVE-2024-53685",
    "CVE-2026-43419",
    "CVE-2026-43408"
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update"
}

CVE-2026-53053 (GCVE-0-2026-53053)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-08-05 12:32

Title

iommu/amd: Fix clone_alias() to use the original device's devid

Summary

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/dbd76a537d8cb814e…
https://git.kernel.org/stable/c/20b3c566e2702e5d4…
https://git.kernel.org/stable/c/dae251ff11d2d2208…
https://git.kernel.org/stable/c/faad224fe0f0857a0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < dbd76a537d8cb814e7f5b795ab21ecb7949c821d (git) Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < 20b3c566e2702e5d4d0545be8a97029a2eebcc0e (git) Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < dae251ff11d2d2208a029f98923756831cefec46 (git) Affected: 3332364e4ebc0581d133a334645a20fd13b580f1 , < faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 (git) Affected: 1f03a258f20f1699ede29bb40804074db9398a0d (git) Affected: 5.4.17 , < 5.5 (semver)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbd76a537d8cb814e7f5b795ab21ecb7949c821d",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "20b3c566e2702e5d4d0545be8a97029a2eebcc0e",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "dae251ff11d2d2208a029f98923756831cefec46",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "lessThan": "faad224fe0f0857a04ff2eb3c90f0de57f47d0f3",
              "status": "affected",
              "version": "3332364e4ebc0581d133a334645a20fd13b580f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1f03a258f20f1699ede29bb40804074db9398a0d",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix clone_alias() to use the original device\u0027s devid\n\nCurrently clone_alias() assumes first argument (pdev) is always the\noriginal device pointer. This function is called by\npci_for_each_dma_alias() which based on topology decides to send\noriginal or alias device details in first argument.\n\nThis meant that the source devid used to look up and copy the DTE\nmay be incorrect, leading to wrong or stale DTE entries being\npropagated to alias device.\n\nFix this by passing the original pdev as the opaque data argument to\nboth the direct clone_alias() call and pci_for_each_dma_alias(). Inside\nclone_alias(), retrieve the original device from data and compute devid\nfrom it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local PCI/IOMMU domain setup and updates, including VFIO/IOMMUFD or VM device-passthrough attach paths for a delegated device. It is not directly reachable by remote packets, but a local tenant or process controlling the assigned device can exercise the affected DMA alias state.\nAC:L - Once the system has an AMD IOMMU and a PCI topology/device with DMA aliases, the wrong DTE clone occurs deterministically during alias setup or domain attach. There is no race or timing condition required.\nPR:L - Exploitation requires control of, or access to, an assigned/owned PCI device or its IOMMUFD/VFIO context, but not host-root privileges in the target host kernel. In delegated passthrough deployments this is reachable by a low-privileged tenant context.\nUI:N - No victim user action is needed after the vulnerable device/topology is present and the device is attached or used. The attacker can trigger DMA behavior through the assigned device context.\nS:C - The bug can violate the IOMMU/DMA isolation boundary by applying a wrong or stale device-table entry to an alias requester ID. Per kernel guidance, IOMMU/DMA boundary bypass changes scope.\nC:H - A wrong/stale DTE can give an alias requester ID DMA access under the wrong page table or domain, enabling reads of memory outside the intended DMA isolation boundary. This supports high confidentiality impact in the most severe reasonable passthrough scenario.\nI:H - The DTE contains DMA translation and read/write permission state, so propagating the wrong entry can allow DMA writes to memory outside the intended domain. That can corrupt host or peer-domain memory and supports high integrity impact.\nA:H - Wrong DMA translations can produce repeated IOMMU faults, device failure, or memory corruption leading to kernel instability or crash. This supports high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:57.238Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d"
        },
        {
          "url": "https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dae251ff11d2d2208a029f98923756831cefec46"
        },
        {
          "url": "https://git.kernel.org/stable/c/faad224fe0f0857a04ff2eb3c90f0de57f47d0f3"
        }
      ],
      "title": "iommu/amd: Fix clone_alias() to use the original device\u0027s devid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53053",
    "datePublished": "2026-06-24T16:29:59.093Z",
    "dateReserved": "2026-06-09T07:44:35.381Z",
    "dateUpdated": "2026-08-05T12:32:57.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53153 (GCVE-0-2026-53153)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-09-02 12:04

Title

mm/list_lru: drain before clearing xarray entry on reparent

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list. If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links. Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-820 - Missing Synchronization

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/c19ff4351214f0593…
https://git.kernel.org/stable/c/2b66496d794e98f7a…
https://git.kernel.org/stable/c/98733f3f0becb1ae0…
https://access.redhat.com/security/cve/CVE-2026-53153	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492790	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:61887	vendor-advisoryx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Linux	Linux	Affected: fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af , < c19ff4351214f059349788e13e70e74325831ff6 (git) Affected: fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af , < 2b66496d794e98f7aeec7688573051f22ec40bac (git) Affected: fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af , < 98733f3f0becb1ae0701d021c1748e974e5fa55c (git)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.50.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s memory cgroup (memcg) list_lru component. A race condition occurs during the reparenting of list_lru entries when an xarray entry is cleared before its associated lists are fully reparented. This allows concurrent operations to modify list pointers under different locks, leading to memory corruption. This corruption can result in system instability or a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-820",
                "description": "Missing Synchronization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T12:04:29.912Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53153"
          },
          {
            "name": "RHBZ#2492790",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492790"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53153.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: mm/list_lru: drain before clearing xarray entry on reparent",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/list_lru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c19ff4351214f059349788e13e70e74325831ff6",
              "status": "affected",
              "version": "fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af",
              "versionType": "git"
            },
            {
              "lessThan": "2b66496d794e98f7aeec7688573051f22ec40bac",
              "status": "affected",
              "version": "fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af",
              "versionType": "git"
            },
            {
              "lessThan": "98733f3f0becb1ae0701d021c1748e974e5fa55c",
              "status": "affected",
              "version": "fb56fdf8b9a2f7397f8a83dce50189f3f0cf71af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/list_lru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/list_lru: drain before clearing xarray entry on reparent\n\nmemcg_reparent_list_lrus() clears the dying memcg\u0027s xarray entry with\nxas_store(\u0026xas, NULL) before reparenting its per-node lists into the\nparent.  This opens a window where a concurrent list_lru_del() arriving\nfor the dying memcg sees xa_load() == NULL, walks to the parent in\nlock_list_lru_of_memcg(), takes the parent\u0027s per-node lock, and calls\nlist_del_init() on an item still physically linked on the dying memcg\u0027s\nlist.\n\nIf another in-flight thread holds the dying memcg\u0027s per-node lock at the\nsame moment (another list_lru_del, or a list_lru_walk_one running an\nisolate callback), both threads modify -\u003enext/-\u003eprev pointers on the same\nphysical list under different locks.  Adjacent items can corrupt each\nother\u0027s links.\n\nFix it by reversing the order: reparent each per-node list and mark the\nchild\u0027s list lru dead and then clear the xarray entry.  Any concurrent\nlist_lru op that finds the still-set xarray entry either takes the dying\nmemcg\u0027s per-node lock (synchronizing with the drain) or sees LONG_MIN and\nwalks to the parent, where the items now live."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local cgroup filesystem operations, primarily mkdir/rmdir and process placement in a memory cgroup, combined with local filesystem or memory-pressure activity that manipulates memcg-aware list_lru entries. It is not directly reachable by unauthenticated network packets.\nAC:L - The issue is a race, but a local attacker with control of a delegated cgroup subtree can drive both sides by repeatedly offlining cgroups while concurrently creating/removing dentries, inodes, zswap entries, or triggering shrinker activity. The race is retryable and under attacker influence, so complexity is low.\nPR:L - Creating/removing the affected cgroups requires write access to a cgroup subtree, but Linux explicitly supports delegation of cgroup subtrees to less-privileged users and cgroup namespaces. No init-namespace root-only capability is inherent once such a subtree is delegated.\nUI:N - No victim user action is needed after the attacker has local access to the relevant cgroup subtree. The attacker can trigger cgroup teardown and concurrent LRU activity directly.\nS:U - The corruption occurs within the kernel memory-management and cgroup/list_lru scope and impacts the same kernel security authority. There is no VM escape, IOMMU bypass, or separate security scope crossing.\nC:H - The bug corrupts kernel list_head next/prev pointers in memcg-aware LRUs such as dentries, inodes, zswap, and workingset shadow nodes. Such kernel memory corruption can plausibly be shaped into disclosure primitives, and uncertainty is scored at the higher severity.\nI:H - Concurrent list operations under different locks can corrupt adjacent kernel object links and later list manipulation can write through attacker-influenced pointers. This is a kernel memory corruption primitive with plausible control-flow or arbitrary-write exploitation potential.\nA:H - Even without full exploitation, corrupted kernel list links can trigger list debugging splats, oopses, panics, hangs, or reclaim/list traversal failures. Kernel crash availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:32.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c19ff4351214f059349788e13e70e74325831ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b66496d794e98f7aeec7688573051f22ec40bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/98733f3f0becb1ae0701d021c1748e974e5fa55c"
        }
      ],
      "title": "mm/list_lru: drain before clearing xarray entry on reparent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53153",
    "datePublished": "2026-06-25T08:38:37.521Z",
    "dateReserved": "2026-06-09T07:44:35.388Z",
    "dateUpdated": "2026-09-02T12:04:29.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53185 (GCVE-0-2026-53185)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-09-03 12:04

Title

zram: fix use-after-free in zram_bvec_write_partial()

Summary

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-364 - Signal Handler Race Condition

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/0c2821665ff71be3f…
https://git.kernel.org/stable/c/77a602b505ce48029…
https://git.kernel.org/stable/c/c96786d6ff1acc1d5…
https://git.kernel.org/stable/c/198b5a14cca27263b…
https://git.kernel.org/stable/c/732fd9f0b9c1cdc6d…
https://access.redhat.com/security/cve/CVE-2026-53185	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492735	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:61887	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59723	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63014	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63013	vendor-advisoryx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 8e654f8fbff52ac483fb69957222853d7e2fc588 , < 0c2821665ff71be3f4b07ecece384669f2877f6a (git) Affected: 8e654f8fbff52ac483fb69957222853d7e2fc588 , < 77a602b505ce4802915853cfc435a4722fab3e64 (git) Affected: 8e654f8fbff52ac483fb69957222853d7e2fc588 , < c96786d6ff1acc1d54d9241e97767554c1dfdd5b (git) Affected: 8e654f8fbff52ac483fb69957222853d7e2fc588 , < 198b5a14cca27263b9c14b20114c8092de15dfcb (git) Affected: 8e654f8fbff52ac483fb69957222853d7e2fc588 , < 732fd9f0b9c1cdc6dfd77162ded60df005182cc0 (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.50.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.42.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.42.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the `zram_bvec_write_partial()` function allows an asynchronous read to write into a page that has already been deallocated. Such a flaw can lead to system instability, causing crashes, or in some scenarios, could be exploited by a local attacker to escalate privileges or execute arbitrary code."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-364",
                "description": "Signal Handler Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T12:04:38.314Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53185"
          },
          {
            "name": "RHBZ#2492735",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492735"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53185.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63014"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63013"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63014: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63013: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: zram: fix use-after-free in zram_bvec_write_partial()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module zram from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c2821665ff71be3f4b07ecece384669f2877f6a",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "77a602b505ce4802915853cfc435a4722fab3e64",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "c96786d6ff1acc1d54d9241e97767554c1dfdd5b",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "198b5a14cca27263b9c14b20114c8092de15dfcb",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            },
            {
              "lessThan": "732fd9f0b9c1cdc6dfd77162ded60df005182cc0",
              "status": "affected",
              "version": "8e654f8fbff52ac483fb69957222853d7e2fc588",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/zram/zram_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix use-after-free in zram_bvec_write_partial()\n\nzram_read_page() picks the sync or async backing device read path based on\nwhether the parent bio is NULL.  zram_bvec_write_partial() passes its\nparent bio down, so for ZRAM_WB slots the read is dispatched\nasynchronously and zram_read_page() returns 0 while the bio is still in\nflight.  The caller then runs memcpy_from_bvec(), zram_write_page() and\n__free_page() on the buffer, leaving the async read to write into a freed\npage.\n\nzram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d\n(\"zram: fix synchronous reads\") for the same reason; the write_partial\ncounterpart was missed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachability is through local block-device or filesystem I/O that submits writes to a zram device. There is no network, adjacent, or physical transport path into this driver code.\nAC:L - On affected non-4K-page zram writeback deployments, the attacker can create partial bio_vec writes and target ZRAM_WB slots without winning a race. The bug is a deterministic asynchronous lifetime error once that normal writeback state exists.\nPR:L - zram_submit_bio() and zram_open() add no kernel capability check; access is governed by the device node or a mounted zram-backed filesystem. A normal local user with write access to such storage can trigger the vulnerable I/O path, while admin-only setup is an environmental prerequisite.\nUI:N - No victim action is needed after the attacker has local write access to the zram-backed storage. The attacker directly submits or induces the partial write.\nS:U - The corruption occurs in kernel memory within the same host security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - This is a kernel use-after-free of a page later written by asynchronous backing-device I/O. Under the required overestimation rule, such memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The freed page can be reallocated before the asynchronous I/O completes, causing kernel memory to be overwritten. That supports high integrity impact due to potential arbitrary corruption or code execution primitives.\nA:H - The UAF can corrupt live kernel memory and readily cause an oops, panic, or hang. Repeated local triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:52.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c2821665ff71be3f4b07ecece384669f2877f6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/77a602b505ce4802915853cfc435a4722fab3e64"
        },
        {
          "url": "https://git.kernel.org/stable/c/c96786d6ff1acc1d54d9241e97767554c1dfdd5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/198b5a14cca27263b9c14b20114c8092de15dfcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/732fd9f0b9c1cdc6dfd77162ded60df005182cc0"
        }
      ],
      "title": "zram: fix use-after-free in zram_bvec_write_partial()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53185",
    "datePublished": "2026-06-25T08:38:58.853Z",
    "dateReserved": "2026-06-09T07:44:35.390Z",
    "dateUpdated": "2026-09-03T12:04:38.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53189 (GCVE-0-2026-53189)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:33

Title

mm/huge_memory: update file PMD counter before folio_put()

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/84b3212b166b446fa…
https://git.kernel.org/stable/c/108963978a681c0c4…
https://git.kernel.org/stable/c/459771c9cf30f378b…
https://git.kernel.org/stable/c/ae9d4caf6f133e884…
https://git.kernel.org/stable/c/6c29a8ba084e89499…
https://git.kernel.org/stable/c/5f5b604e1e6bde4e8…
https://git.kernel.org/stable/c/ed5b030931292c941…
https://git.kernel.org/stable/c/8d878059924f12c1b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < 84b3212b166b446faea27ebebb7161405ffceef9 (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < 108963978a681c0c468d279cac2b930c27672877 (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < 459771c9cf30f378bdbd30fc65d17f7eb931bb59 (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < ae9d4caf6f133e884cf5fcda4982c493b35e5194 (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < 6c29a8ba084e89499ca77b947e07ae817f9c16ce (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < 5f5b604e1e6bde4e889199168ee80fe8306d06ad (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < ed5b030931292c94133437ac5e5ff580e498eabd (git) Affected: fadae2953072e9005c5f1d64e1049edb043494dc , < 8d878059924f12c1bc24556a92ec56add74de3c8 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84b3212b166b446faea27ebebb7161405ffceef9",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "108963978a681c0c468d279cac2b930c27672877",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "459771c9cf30f378bdbd30fc65d17f7eb931bb59",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "ae9d4caf6f133e884cf5fcda4982c493b35e5194",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "6c29a8ba084e89499ca77b947e07ae817f9c16ce",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "5f5b604e1e6bde4e889199168ee80fe8306d06ad",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "ed5b030931292c94133437ac5e5ff580e498eabd",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            },
            {
              "lessThan": "8d878059924f12c1bc24556a92ec56add74de3c8",
              "status": "affected",
              "version": "fadae2953072e9005c5f1d64e1049edb043494dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: update file PMD counter before folio_put()\n\n__split_huge_pmd_locked() updates the file/shmem RSS counter after\ndropping the PMD mapping\u0027s folio reference.  If folio_put() drops the last\nreference, mm_counter_file() can later read freed folio state via\nfolio_test_swapbacked().\n\nMove the counter update before folio_put()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable by a local process through ordinary memory-management paths such as page fault creation of a file/shmem huge PMD followed by mprotect/munmap/mremap-style PMD splitting. No network, adjacent, or physical input path reaches this core MM helper.\nAC:L - An attacker can create suitable file/shmem THP mappings and trigger PMD splits from their own process; any last-reference/race condition can be driven with attacker-controlled local threads and file operations. Under the uncertainty rule, this is Low complexity.\nPR:L - The path requires only an unprivileged local user able to mmap and modify protections or mappings of their own file/tmpfs memory. No real root or init-namespace capability gate is required.\nUI:N - Exploitation does not require another user to take action. The local attacker can set up the mapping and trigger the split themselves.\nS:U - The vulnerable code is in the kernel MM subsystem and impacts kernel-managed resources within the same security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is a use-after-free read of folio state after the PMD mapping reference may be dropped. Following kernel UAF guidance and the higher-severity rule, this is treated as potentially enabling high confidentiality impact.\nI:H - The stale freed folio state controls which RSS counter is updated and represents UAF-driven kernel memory/accounting corruption in core MM. Following the UAF guidance and higher-severity rule, integrity impact is High.\nA:H - A UAF in the huge PMD split path can corrupt kernel MM state and can plausibly lead to warnings, oopses, or crashes when repeatedly triggered. Kernel UAF availability impact is therefore High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:56.458Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84b3212b166b446faea27ebebb7161405ffceef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/108963978a681c0c468d279cac2b930c27672877"
        },
        {
          "url": "https://git.kernel.org/stable/c/459771c9cf30f378bdbd30fc65d17f7eb931bb59"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae9d4caf6f133e884cf5fcda4982c493b35e5194"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c29a8ba084e89499ca77b947e07ae817f9c16ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f5b604e1e6bde4e889199168ee80fe8306d06ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed5b030931292c94133437ac5e5ff580e498eabd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d878059924f12c1bc24556a92ec56add74de3c8"
        }
      ],
      "title": "mm/huge_memory: update file PMD counter before folio_put()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53189",
    "datePublished": "2026-06-25T08:39:01.708Z",
    "dateReserved": "2026-06-09T07:44:35.390Z",
    "dateUpdated": "2026-08-05T12:33:56.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53196 (GCVE-0-2026-53196)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-09-02 12:04

Title

USB: serial: io_ti: fix heap overflow in get_manuf_info()

Summary

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes. The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver. valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access. Fix by rejecting descriptors with unexpected length before calling read_rom(). [ johan: amend commit message; also check for short descriptors ]

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/e168db91442b94e64…
https://git.kernel.org/stable/c/561edb021486e6723…
https://git.kernel.org/stable/c/cfd634f6dfd40c49a…
https://git.kernel.org/stable/c/d92f17af7097d10bd…
https://git.kernel.org/stable/c/b849f30d1a9e66aae…
https://git.kernel.org/stable/c/f96cf7bf9fbf15d7f…
https://git.kernel.org/stable/c/d214d2341d4f9f447…
https://git.kernel.org/stable/c/183c1076eca43bbb3…
https://access.redhat.com/security/cve/CVE-2026-53196	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492750	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:61887	vendor-advisoryx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e168db91442b94e64fa82a7dd297983d48ea5cc0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 561edb021486e6723d841926aa4b48097da06190 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cfd634f6dfd40c49a84f9bddc2867a80e2e2623a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d92f17af7097d10bdeddf26f66f34b354104b277 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b849f30d1a9e66aae6b715aaef66e427390cb081 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d214d2341d4f9f447e36a7d012cdf6a6631a55f1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 183c1076eca43bbb3e7bdf597456f91d81c73e74 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.50.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.50.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-25T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device\u0027s I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T12:04:23.279Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53196"
          },
          {
            "name": "RHBZ#2492750",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53196.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61887"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:61887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-25T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/io_ti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e168db91442b94e64fa82a7dd297983d48ea5cc0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "561edb021486e6723d841926aa4b48097da06190",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cfd634f6dfd40c49a84f9bddc2867a80e2e2623a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d92f17af7097d10bdeddf26f66f34b354104b277",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b849f30d1a9e66aae6b715aaef66e427390cb081",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d214d2341d4f9f447e36a7d012cdf6a6631a55f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "183c1076eca43bbb3e7bdf597456f91d81c73e74",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/serial/io_ti.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in get_manuf_info()\n\nget_manuf_info() reads le16_to_cpu(rom_desc-\u003eSize) bytes from the\ndevice I2C EEPROM into a buffer allocated with kmalloc_obj(), which\nis sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.\n\nThe Size field comes from the device and is only validated (in\ncheck_i2c_image()) to make sure the descriptor fits within\nTI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.\nA malicious USB device can therefore set Size to any value up to 16377,\ncausing a heap overflow of up to 16367 bytes when plugged into a host\nrunning this driver.\n\nvalid_csum() is called after read_rom() and also iterates\nbuffer[0..Size-1], compounding the out-of-bounds access.\n\nFix by rejecting descriptors with unexpected length before calling\nread_rom().\n\n[ johan: amend commit message; also check for short descriptors ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:39:06.330Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277"
        },
        {
          "url": "https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081"
        },
        {
          "url": "https://git.kernel.org/stable/c/f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74"
        }
      ],
      "title": "USB: serial: io_ti: fix heap overflow in get_manuf_info()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53196",
    "datePublished": "2026-06-25T08:39:06.330Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-09-02T12:04:23.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53391 (GCVE-0-2026-53391)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50

Title

NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only "nlen < 0" / "rlen < 0" before dereferencing the returned string. When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its "*str = NULL; return ret" tail, leaving buf NULL with a return value of 0. The "< 0" check does not catch this, and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of panicking the client.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/76b94cbd32aacf36a…
https://git.kernel.org/stable/c/c8e4e0c701d0192a2…
https://git.kernel.org/stable/c/6c344fff2feff9d4d…
https://git.kernel.org/stable/c/427ab81a811dab4bc…
https://git.kernel.org/stable/c/012d37a568bfbb2c9…
https://git.kernel.org/stable/c/30aae62e50b4e074a…
https://git.kernel.org/stable/c/41fe0f7b84f0cb822…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 76b94cbd32aacf36a641956385a852635c6802b9 (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < c8e4e0c701d0192a2efb6df059c0f9e19678c23d (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 427ab81a811dab4bca9d19f82eec5847ae42646e (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 012d37a568bfbb2c9686f03ade75560bc7139956 (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 30aae62e50b4e074a90a9a5e15246548fbdc1182 (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 41fe0f7b84f0cb822ae10ab08592996a592b2a25 (git)
Linux	Linux	Affected: 4.0 Unaffected: 0 , < 4.0 (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs_nfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "76b94cbd32aacf36a641956385a852635c6802b9",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "c8e4e0c701d0192a2efb6df059c0f9e19678c23d",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "427ab81a811dab4bca9d19f82eec5847ae42646e",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "012d37a568bfbb2c9686f03ade75560bc7139956",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "30aae62e50b4e074a90a9a5e15246548fbdc1182",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            },
            {
              "lessThan": "41fe0f7b84f0cb822ae10ab08592996a592b2a25",
              "status": "affected",
              "version": "6b7f3cf96364eaf597940cb5c68a682894829915",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs_nfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr\n\nnfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a\nnetaddr4 from a GETDEVICEINFO multipath-DS body, then immediately\ncalls strrchr(buf, \u0027.\u0027) to locate the port separator. Both decodes\nuse xdr_stream_decode_string_dup(), and the current code checks only\n\"nlen \u003c 0\" / \"rlen \u003c 0\" before dereferencing the returned string.\n\nWhen the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()\nreturns 0 and xdr_stream_decode_string_dup() falls through to its\n\"*str = NULL; return ret\" tail, leaving buf NULL with a return value\nof 0. The \"\u003c 0\" check does not catch this, and the next line is\nstrrchr(NULL, \u0027.\u0027), a kernel NULL pointer dereference reachable from\nany pNFS-flexfile client mounted against a malicious or compromised\nmetadata server.\n\nReject the zero-length cases explicitly so the decoder fails with\n-EBADMSG (treated as a malformed GETDEVICEINFO body) instead of\npanicking the client."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario\u2014a compromised enterprise/HPC metadata server or autofs-managed pNFS mount\u2014no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive\u2014only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:42.650Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e"
        },
        {
          "url": "https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956"
        },
        {
          "url": "https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182"
        },
        {
          "url": "https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25"
        }
      ],
      "title": "NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53391",
    "datePublished": "2026-07-19T12:01:55.521Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:42.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53392 (GCVE-0-2026-53392)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50

Title

NFSv4/flexfiles: reject zero filehandle version count

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9033591535c066726…
https://git.kernel.org/stable/c/18cc6d57a14fa65ab…
https://git.kernel.org/stable/c/be7829715e341b428…
https://git.kernel.org/stable/c/eeabb9020721db6bc…
https://git.kernel.org/stable/c/7779c85028a0676fb…
https://git.kernel.org/stable/c/d8c90c7cc061265d5…
https://git.kernel.org/stable/c/2131ed64b767ffa8b…
https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 9033591535c066726f5b505126ccb4068b98fa4f (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < be7829715e341b42846437dd9e721005db59f0cc (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < eeabb9020721db6bc132e68eeae380b8d4fb4b04 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 7779c85028a0676fb190cde4f0c540f4f8e97761 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < d8c90c7cc061265d5f2813a1f5c82ef2f4707e67 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 2131ed64b767ffa8bcdb3677d90f3964e39aabc8 (git) Affected: d67ae825a59d639e4d8b82413af84d854617a87e , < 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 (git)
Linux	Linux	Affected: 4.0 Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayout.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9033591535c066726f5b505126ccb4068b98fa4f",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "18cc6d57a14fa65ab2a2b52279f549041c4bc9cf",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "be7829715e341b42846437dd9e721005db59f0cc",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "eeabb9020721db6bc132e68eeae380b8d4fb4b04",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "7779c85028a0676fb190cde4f0c540f4f8e97761",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "d8c90c7cc061265d5f2813a1f5c82ef2f4707e67",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "2131ed64b767ffa8bcdb3677d90f3964e39aabc8",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayout.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info-\u003efh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n  RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n  ff_layout_encode_layoutreturn+0x683/0x970\n  nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n  Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the NFSv4 pNFS flexfiles client parsing a malicious LAYOUTGET layout blob from the server over NFS/RPC; a remote attacker who controls or MITMs the NFS server delivers the crafted fh_count=0 response over the network.\nAC:L - Once a client is using flexfiles pNFS, the attacker fully controls the layout XDR and can set fh_count=0 to deterministically store ZERO_SIZE_PTR; a later I/O, layoutstats, or LAYOUTRETURN path dereferences fh_versions[0] and panics without races or special heap layout.\nPR:N - Exploitation requires no privileges on the victim host; the attacker only needs to be the (or impersonate) the NFS server sending protocol responses after normal client connection/authentication.\nUI:N - After an NFS pNFS flexfiles mount is established (common in enterprise/HPC NAS deployments), triggering the malformed layout and subsequent kernel panic requires no further victim action beyond routine file access on the already-mounted share.\nS:U - Impact is a kernel oops/panic on the NFS client host; it does not cross a VM, container, or IOMMU security boundary to affect a different authority.\nC:N - The failure mode is a NULL-pointer dereference at ZERO_SIZE_PTR (0x10) when accessing fh_versions[0]; KASAN confirms a faulting dereference with no successful out-of-bounds read or information leak to userspace.\nI:N - There is no memory corruption or successful write primitive\u2014only an invalid-pointer dereference that crashes the kernel before any integrity-changing operation completes.\nA:H - A confirmed KASAN null-ptr-deref in ff_layout_encode_ff_layoutupdate during LAYOUTRETURN encoding causes a fatal kernel exception/panic, fully denying availability of the client system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:43.747Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04"
        },
        {
          "url": "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67"
        },
        {
          "url": "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2"
        }
      ],
      "title": "NFSv4/flexfiles: reject zero filehandle version count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53392",
    "datePublished": "2026-07-19T12:01:56.101Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:43.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53397 (GCVE-0-2026-53397)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50

Title

nfsd: fix posix_acl leak on SETACL decode failure

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFACL. Each successful call transfers ownership of a freshly allocated posix_acl into argp->acl_access or argp->acl_default. If the first call succeeds but the second fails, the decoder returns false and argp->acl_access is left dangling. ACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and ACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle. Both only call fh_put() and have no knowledge of the ACL fields on argp. The posix_acl_release() pairs sat at the out: labels inside nfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process() skips pc_func when pc_decode returns false, so that cleanup is unreachable on decode failure: svc_process_common() pc_decode() /* decode_setaclargs: false */ /* pc_func skipped */ pc_release() /* fh_put only -- ACLs leaked */ The orphaned posix_acl is leaked for the lifetime of the server. Fix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(), which release both argp->acl_access and argp->acl_default in addition to fh_put(), and wiring them as pc_release for their respective SETACL procedures. pc_release runs on every path svc_process() takes after decode, including decode failure, so the posix_acl_release() pairs are removed from the proc functions' out: labels to keep ownership in one place. This matches the existing release_getacl() pattern used by the sibling GETACL procedures.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3…
https://git.kernel.org/stable/c/b94c4be77682aab06…
https://git.kernel.org/stable/c/887f92ceccf3eacd5…
https://git.kernel.org/stable/c/1e96239fddcefacf6…
https://git.kernel.org/stable/c/bd69a825485168ef7…
https://git.kernel.org/stable/c/136b416593f1349cf…
https://git.kernel.org/stable/c/a5b42c1e4ff2befaa…
https://git.kernel.org/stable/c/0853ac544c590880d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < b2eb1ffd511d1b3c3e21122f97cbbccea411e277 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < b94c4be77682aab06d65ca7296149e3bcfb37353 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 887f92ceccf3eacd5f2402db21254d66372fae00 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 1e96239fddcefacf6afe6c498357be68eacbcabc (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < bd69a825485168ef74e815ecb286754b570fdcc7 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 136b416593f1349cf6f72c8e3d18f0f204ee8545 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < a5b42c1e4ff2befaa6b96f7cbf32174751eba083 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 0853ac544c590880d797b04daa33fcb72b6be0e1 (git)
Linux	Linux	Affected: 2.6.13 Unaffected: 0 , < 2.6.13 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs2acl.c",
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b2eb1ffd511d1b3c3e21122f97cbbccea411e277",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "b94c4be77682aab06d65ca7296149e3bcfb37353",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "887f92ceccf3eacd5f2402db21254d66372fae00",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "1e96239fddcefacf6afe6c498357be68eacbcabc",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "bd69a825485168ef74e815ecb286754b570fdcc7",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "136b416593f1349cf6f72c8e3d18f0f204ee8545",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "a5b42c1e4ff2befaa6b96f7cbf32174751eba083",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "0853ac544c590880d797b04daa33fcb72b6be0e1",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs2acl.c",
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak on SETACL decode failure\n\nnfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each\ncall nfs_stream_decode_acl() twice, first for NFS_ACL and then for\nNFS_DFACL.  Each successful call transfers ownership of a freshly\nallocated posix_acl into argp-\u003eacl_access or argp-\u003eacl_default.  If\nthe first call succeeds but the second fails, the decoder returns\nfalse and argp-\u003eacl_access is left dangling.\n\nACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and\nACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.\nBoth only call fh_put() and have no knowledge of the ACL fields on\nargp.  The posix_acl_release() pairs sat at the out: labels inside\nnfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()\nskips pc_func when pc_decode returns false, so that cleanup is\nunreachable on decode failure:\n\n    svc_process_common()\n      pc_decode()                  /* decode_setaclargs: false */\n      /* pc_func skipped */\n      pc_release()                 /* fh_put only -- ACLs leaked */\n\nThe orphaned posix_acl is leaked for the lifetime of the server.\n\nFix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),\nwhich release both argp-\u003eacl_access and argp-\u003eacl_default in addition\nto fh_put(), and wiring them as pc_release for their respective SETACL\nprocedures.  pc_release runs on every path svc_process() takes after\ndecode, including decode failure, so the posix_acl_release() pairs are\nremoved from the proc functions\u0027 out: labels to keep ownership in one\nplace.  This matches the existing release_getacl() pattern used by\nthe sibling GETACL procedures."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in nfsd\u0027s NFS ACL program (RPC program 100227), reachable over the network via the in-kernel NFS server on TCP/UDP port 2049 when NFSD ACL support is enabled.\nAC:L - Once nfsd with ACL support is running, an attacker can reliably trigger the leak by sending a SETACL RPC with mask including both NFS_ACL and NFS_DFACL, a valid first ACL, and a malformed second ACL that fails decode.\nPR:N - Exploitation requires only network access as an NFS client with RPC credentials (AUTH_UNIX is spoofable) from a source IP matching an export entry; no local shell or real root on the server is needed.\nUI:N - Triggering the leak requires only crafted NFS ACL RPC packets; no victim user action such as mounting a filesystem or opening a file is required.\nS:U - The impact is confined to kernel memory consumption within the nfsd server context and does not cross a security boundary such as a VM, container, or IOMMU isolation boundary.\nC:N - This is a kmalloc leak of attacker-supplied ACL data with no out-of-bounds read, use-after-free, or other mechanism that exposes kernel memory to the attacker.\nI:N - The bug orphans allocated posix_acl objects without modifying file data, ACLs on disk, or any other integrity-protected resources.\nA:H - Each trigger permanently leaks a posix_acl allocation (up to ~16KB with max entries) for the server\u0027s lifetime; repeated remote SETACL requests can exhaust kernel memory and deny service to the NFS server and co-hosted workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:49.240Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277"
        },
        {
          "url": "https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353"
        },
        {
          "url": "https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083"
        },
        {
          "url": "https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1"
        }
      ],
      "title": "nfsd: fix posix_acl leak on SETACL decode failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53397",
    "datePublished": "2026-07-19T12:01:58.938Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:49.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53399 (GCVE-0-2026-53399)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:50

Title

nfsd: release layout stid on setlease failure

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ nfsd4_layout_setlease() /* fails */ nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/d788ef40a7517d22c…
https://git.kernel.org/stable/c/2e0a5d6d62600b8c6…
https://git.kernel.org/stable/c/7bbb7ce74051c8be4…
https://git.kernel.org/stable/c/48a586e382e4db1db…
https://git.kernel.org/stable/c/d369e5edfaaf83a44…
https://git.kernel.org/stable/c/8dee7c278f1c2b5bb…
https://git.kernel.org/stable/c/83c2b7797742339bb…
https://git.kernel.org/stable/c/30d55c8aabb261bc3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < d788ef40a7517d22c97ab01700e4ae4c611b6f2f (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 2e0a5d6d62600b8c614d1b55e50ef94035d6adf9 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 7bbb7ce74051c8be4b69ff44ce3db370600dae61 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 48a586e382e4db1dbf958d44b63e081df5f8ed04 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < d369e5edfaaf83a448016e2f1da392b2174be801 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 83c2b7797742339bb768f83935f7ca33950db138 (git) Affected: c5c707f96fc9a6e5a57ca5baac892673270abe3d , < 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 (git)
Linux	Linux	Affected: 4.0 Unaffected: 0 , < 4.0 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d788ef40a7517d22c97ab01700e4ae4c611b6f2f",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "2e0a5d6d62600b8c614d1b55e50ef94035d6adf9",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "7bbb7ce74051c8be4b69ff44ce3db370600dae61",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "48a586e382e4db1dbf958d44b63e081df5f8ed04",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "d369e5edfaaf83a448016e2f1da392b2174be801",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "83c2b7797742339bb768f83935f7ca33950db138",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "30d55c8aabb261bc3f427d6b9aae7ef6206063f9",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n    nfsd4_alloc_layout_stateid()\n      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */\n      nfsd4_layout_setlease()     /* fails */\n        nfs4_put_stid()\n          nfsd4_free_layout_stateid()\n            delayed_work_pending(\u0026ls-\u003els_fence_work)  /* needs INIT */\n            nfsd4_close_layout()  /* nfsd_file_put(ls-\u003els_file) */\n          put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached through nfsd\u0027s NFSv4 OP_LAYOUTGET handler, which processes attacker-controlled RPC compounds over the network on TCP port 2049.\nAC:L - An authenticated NFS client can reliably trigger the fault by issuing LAYOUTGET on block/SCSI pNFS exports so that nfsd4_layout_setlease() fails (e.g., -ENOMEM or -EINVAL), and can retry, spray the slab, and race concurrent compounds to exploit the dangling IDR entry.\nPR:N - Exploitation requires only the ability to act as a remote NFSv4 client against an export with pNFS enabled, not local shell access or elevated privileges on the Linux host.\nUI:N - No end-user or administrator action on the server is required; the vulnerability is triggered entirely through malicious NFS protocol traffic from a network client.\nS:U - Impact is confined to kernel memory corruption and nfsd state within the same kernel security boundary, not a cross-boundary escape such as VM or container breakout.\nC:H - The IDR retains a pointer to freed layout stateid slab memory, creating a use-after-free that can be leveraged for arbitrary kernel memory reads after heap reuse.\nI:H - UAF on the layout stateid object enables controlled slab reuse and corruption of adjacent kernel structures, supporting arbitrary write or control-flow hijack primitives.\nA:H - Dereferencing the dangling IDR pointer during state iteration or stateid lookup can cause kernel oops/panic, and UAF exploitation can crash or hang the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:51.453Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04"
        },
        {
          "url": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138"
        },
        {
          "url": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9"
        }
      ],
      "title": "nfsd: release layout stid on setlease failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53399",
    "datePublished": "2026-07-19T12:02:00.055Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:51.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63800 (GCVE-0-2026-63800)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51

Title

pNFS: Fix use-after-free in pnfs_update_layout()

Summary

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo).

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/4ad8b9a85dbf57ca5…
https://git.kernel.org/stable/c/1f24b8302c77dcaf7…
https://git.kernel.org/stable/c/9c0fb5c09ae5bd68d…
https://git.kernel.org/stable/c/7e37e9b3e82ade881…
https://git.kernel.org/stable/c/2883ddd7542b4437a…
https://git.kernel.org/stable/c/200e7637f4d6a1342…
https://git.kernel.org/stable/c/9645aaf689aff5742…
https://git.kernel.org/stable/c/13e198a90ca4050f4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 06f58dbc49a23c99e5c0f246879ed16667f7bf8f , < 4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98 (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 1f24b8302c77dcaf79c64c073877a3b9f4dd25d2 (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 9c0fb5c09ae5bd68dc0038692af8127029cb0385 (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 7e37e9b3e82ade881e1798e2f4fcc54aff7793c1 (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 2883ddd7542b4437a2ab4908fe2773f690e20889 (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 200e7637f4d6a1342987045eea72641524f909dc (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 9645aaf689aff57427ece3b9fa47d5b5399417f4 (git) Affected: 2c8d5fc37fe2384a9bdb6965443ab9224d46f704 , < 13e198a90ca4050f4bee8a3f23680389a6563ccc (git) Affected: aa2399f55eff4ec78330bb6fe55f9df53e5cae0c (git) Affected: 5.10.9 , < 5.10.260 (semver) Affected: 5.4.91 , < 5.5 (semver)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98",
              "status": "affected",
              "version": "06f58dbc49a23c99e5c0f246879ed16667f7bf8f",
              "versionType": "git"
            },
            {
              "lessThan": "1f24b8302c77dcaf79c64c073877a3b9f4dd25d2",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "9c0fb5c09ae5bd68dc0038692af8127029cb0385",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "7e37e9b3e82ade881e1798e2f4fcc54aff7793c1",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "2883ddd7542b4437a2ab4908fe2773f690e20889",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "200e7637f4d6a1342987045eea72641524f909dc",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "9645aaf689aff57427ece3b9fa47d5b5399417f4",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "lessThan": "13e198a90ca4050f4bee8a3f23680389a6563ccc",
              "status": "affected",
              "version": "2c8d5fc37fe2384a9bdb6965443ab9224d46f704",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aa2399f55eff4ec78330bb6fe55f9df53e5cae0c",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.260",
              "status": "affected",
              "version": "5.10.9",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.91",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "5.10.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.91",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix use-after-free in pnfs_update_layout()\n\nWhen hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(),\nthe code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds,\npnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(),\nwhich still references \u0027lo\u0027. This results in a use-after-free when the\ntracepoint accesses lo\u0027s fields.\n\nFix this by moving the tracepoint call before pnfs_put_layout_hdr(lo)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A compromised or malicious pNFS NFSv4.1+ metadata server can send CB_LAYOUTRECALL callbacks over the NFSv4 backchannel to force NFS_LAYOUT_RETURN while client file I/O reaches pnfs_update_layout(), exploiting the client from the network in typical enterprise/HPC pNFS deployments.\nAC:L - The attacker controls both sides of the race by issuing layout recalls from the server and driving or waiting for concurrent read/write I/O on the mounted pNFS share; no conditions beyond attacker influence are required once a pNFS session exists.\nPR:N - Exploitation requires no local privileges on the victim client\u2014a remote NFS server with an established pNFS session can trigger the layoutreturn/retry path while any client process performs permitted file I/O on the mount.\nUI:N - No interactive victim action is needed during exploitation; automated workloads, daemons, or batch jobs performing routine I/O on an existing pNFS mount are sufficient to hit the vulnerable code path.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain and does not cross a VM, container, or IOMMU boundary on its own.\nC:H - The tracepoint reads freed pnfs_layout_hdr fields (plh_stateid seqid and hash) after pnfs_put_layout_hdr() drops the final reference, giving an attacker-controlled use-after-free read primitive over kernel heap memory.\nI:H - Use-after-free on a refcounted kernel layout object enables heap grooming and further memory corruption for arbitrary kernel writes or control-flow hijacking, not merely a bounded fault.\nA:H - Dereferencing a freed pnfs_layout_hdr in kernel context can cause an oops or panic, and use-after-free corruption reliably threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:05.578Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c0fb5c09ae5bd68dc0038692af8127029cb0385"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889"
        },
        {
          "url": "https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563ccc"
        }
      ],
      "title": "pNFS: Fix use-after-free in pnfs_update_layout()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63800",
    "datePublished": "2026-07-19T12:02:06.897Z",
    "dateReserved": "2026-07-19T07:54:57.013Z",
    "dateUpdated": "2026-08-17T04:51:05.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

alsa-2026:61887

Vulnerability from osv_almalinux

CVE-2026-53053 (GCVE-0-2026-53053)

CVE-2026-53153 (GCVE-0-2026-53153)

CVE-2026-53185 (GCVE-0-2026-53185)

CVE-2026-53189 (GCVE-0-2026-53189)

CVE-2026-53196 (GCVE-0-2026-53196)

CVE-2026-53391 (GCVE-0-2026-53391)

CVE-2026-53392 (GCVE-0-2026-53392)

CVE-2026-53397 (GCVE-0-2026-53397)

CVE-2026-53399 (GCVE-0-2026-53399)

CVE-2026-63800 (GCVE-0-2026-63800)

Tags

Sightings

Nomenclature