Vulnerability-Lookup

ALSA-2026:76738

Vulnerability from osv_almalinux – Published: 2026-10-06 00:00 – Updated: 2026-10-13 09:28 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
kernel: packet: use consistent hard_header_len in non-ring send paths ()
kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

Bug Fix(es) and Enhancement(s):

wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:76738	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-45856	REPORT
	https://access.redhat.com/security/cve/CVE-2026-45860	REPORT
	https://access.redhat.com/security/cve/CVE-2026-46275	REPORT
	https://access.redhat.com/security/cve/CVE-2026-52972	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53270	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53357	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63794	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63829	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63918	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63920	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63922	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63924	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63984	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63992	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63994	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64024	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64078	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64132	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64557	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68432	REPORT
	https://access.redhat.com/security/cve/CVE-2026-72052	REPORT
	https://access.redhat.com/security/cve/CVE-2026-72255	REPORT
	https://access.redhat.com/security/cve/CVE-2026-72320	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74516	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74582	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74669	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74746	REPORT
	https://access.redhat.com/security/cve/CVE-2026-80775	REPORT
	https://access.redhat.com/security/cve/CVE-2026-80792	REPORT
	https://access.redhat.com/security/cve/CVE-2026-80921	REPORT
	https://access.redhat.com/security/cve/CVE-2026-89972	REPORT
	https://access.redhat.com/security/cve/CVE-2026-90227	REPORT
	https://access.redhat.com/security/cve/CVE-2026-93288	REPORT
	https://access.redhat.com/security/cve/CVE-2026-97417	REPORT
	https://bugzilla.redhat.com/2482115	REPORT
	https://bugzilla.redhat.com/2482129	REPORT
	https://bugzilla.redhat.com/2486398	REPORT
	https://bugzilla.redhat.com/2492364	REPORT
	https://bugzilla.redhat.com/2492853	REPORT
	https://bugzilla.redhat.com/2496574	REPORT
	https://bugzilla.redhat.com/2502230	REPORT
	https://bugzilla.redhat.com/2502241	REPORT
	https://bugzilla.redhat.com/2502326	REPORT
	https://bugzilla.redhat.com/2502327	REPORT
	https://bugzilla.redhat.com/2502330	REPORT
	https://bugzilla.redhat.com/2502333	REPORT
	https://bugzilla.redhat.com/2502384	REPORT
	https://bugzilla.redhat.com/2502395	REPORT
	https://bugzilla.redhat.com/2502431	REPORT
	https://bugzilla.redhat.com/2502444	REPORT
	https://bugzilla.redhat.com/2502554	REPORT
	https://bugzilla.redhat.com/2502619	REPORT
	https://bugzilla.redhat.com/2508320	REPORT
	https://bugzilla.redhat.com/2514441	REPORT
	https://bugzilla.redhat.com/2516306	REPORT
	https://bugzilla.redhat.com/2516606	REPORT
	https://bugzilla.redhat.com/2516717	REPORT
	https://bugzilla.redhat.com/2516998	REPORT
	https://bugzilla.redhat.com/2519475	REPORT
	https://bugzilla.redhat.com/2521057	REPORT
	https://bugzilla.redhat.com/2521375	REPORT
	https://bugzilla.redhat.com/2524483	REPORT
	https://bugzilla.redhat.com/2528542	REPORT
	https://bugzilla.redhat.com/2528550	REPORT
	https://bugzilla.redhat.com/2531066	REPORT
	https://bugzilla.redhat.com/2535140	REPORT
	https://bugzilla.redhat.com/2536346	REPORT
	https://bugzilla.redhat.com/2540479	REPORT
	https://bugzilla.redhat.com/2540500	REPORT
	https://errata.almalinux.org/10/ALSA-2026-76738.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-abi-stablelists"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-cross-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-doc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt-addons"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libperf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rtla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.63.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.  \n\nSecurity Fix(es):  \n\n  * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)\n  * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)\n  * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)\n  * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)\n  * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)\n  * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)\n  * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)\n  * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)\n  * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)\n  * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)\n  * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)\n  * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)\n  * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)\n  * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)\n  * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)\n  * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)\n  * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)\n  * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)\n  * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)\n  * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)\n  * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)\n  * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)\n  * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)\n  * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)\n  * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)\n  * kernel: packet: use consistent hard_header_len in non-ring send paths ()\n  * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)\n  * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)\n  * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)\n  * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)\n  * kernel: futex: Fix race on the initial mm-\u003efutex.phash.ref allocation (CVE-2026-80775)\n  * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)\n  * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)\n  * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)\n  * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)\n  * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * wifi card breaks using FIPS (JIRA:AlmaLinux-257457)\n  * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:76738",
  "modified": "2026-10-13T09:28:28Z",
  "published": "2026-10-06T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:76738"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45856"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45860"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-46275"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-52972"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53270"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53357"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63794"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63829"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63918"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63920"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63922"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63924"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63984"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63992"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63994"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64024"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64078"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64132"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64557"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68432"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-72052"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-72255"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-72320"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74516"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74582"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74669"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74746"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-80775"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-80792"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-80921"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-89972"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-90227"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-93288"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-97417"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482115"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2482129"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2486398"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492364"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492853"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2496574"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502230"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502241"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502326"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502327"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502330"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502333"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502384"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502395"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502431"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502444"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502554"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502619"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2508320"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2514441"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516306"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516606"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516717"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516998"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519475"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2521057"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2521375"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2524483"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528542"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528550"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2531066"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2535140"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2536346"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2540479"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2540500"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-76738.html"
    }
  ],
  "related": [
    "CVE-2026-45860",
    "CVE-2026-45856",
    "CVE-2026-46275",
    "CVE-2026-52972",
    "CVE-2026-53270",
    "CVE-2026-53357",
    "CVE-2026-63829",
    "CVE-2026-63794",
    "CVE-2026-63924",
    "CVE-2026-63922",
    "CVE-2026-63920",
    "CVE-2026-64024",
    "CVE-2026-63918",
    "CVE-2026-63984",
    "CVE-2026-63992",
    "CVE-2026-63994",
    "CVE-2026-64078",
    "CVE-2026-64132",
    "CVE-2026-64557",
    "CVE-2026-68432",
    "CVE-2026-68476",
    "CVE-2026-72052",
    "CVE-2026-72320",
    "CVE-2026-72255",
    "CVE-2026-74516",
    "CVE-2026-74582",
    "CVE-2026-74669",
    "CVE-2026-74746",
    "CVE-2026-80792",
    "CVE-2026-80775",
    "CVE-2026-80921",
    "CVE-2026-89972",
    "CVE-2026-90227",
    "CVE-2026-97417",
    "CVE-2026-93288"
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update"
}

CVE-2026-45856 (GCVE-0-2026-45856)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:15 – Updated: 2026-08-05 12:28

Title

RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6…
https://git.kernel.org/stable/c/9b5ac1c15334d46c0…
https://git.kernel.org/stable/c/01c9b152647dc70dc…
https://git.kernel.org/stable/c/bf1feed1a7886af94…
https://git.kernel.org/stable/c/d533425ac1f2925b4…
https://git.kernel.org/stable/c/bf4454da8b1e71271…
https://git.kernel.org/stable/c/bef70ff9841990658…
https://git.kernel.org/stable/c/1956f0a74ccf5dc9c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c3bea3d2dc5358e05541527283279102383b0231 , < 9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7 (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < 9b5ac1c15334d46c0dbd49d64a2257b929500163 (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < 01c9b152647dc70dc06a4a2eff86ebb3b3c76075 (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < bf1feed1a7886af945f92890493aefd2b5c9928a (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < d533425ac1f2925b4fc3e4ed9b9d72362cb23475 (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < bf4454da8b1e712714628c0a0d6e7845bb40790a (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < bef70ff9841990658610512b4a18e4a88c9b4df6 (git) Affected: c3bea3d2dc5358e05541527283279102383b0231 , < 1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0 (git)
Linux	Linux	Affected: 5.0 Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/uverbs_cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "9b5ac1c15334d46c0dbd49d64a2257b929500163",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "01c9b152647dc70dc06a4a2eff86ebb3b3c76075",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "bf1feed1a7886af945f92890493aefd2b5c9928a",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "d533425ac1f2925b4fc3e4ed9b9d72362cb23475",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "bf4454da8b1e712714628c0a0d6e7845bb40790a",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "bef70ff9841990658610512b4a18e4a88c9b4df6",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/uverbs_cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send\n\nib_uverbs_post_send() uses cmd.wqe_size from userspace without any\nvalidation before passing it to kmalloc() and using the allocated\nbuffer as struct ib_uverbs_send_wr.\n\nIf a user provides a small wqe_size value (e.g., 1), kmalloc() will\nsucceed, but subsequent accesses to user_wr-\u003eopcode, user_wr-\u003enum_sge,\nand other fields will read beyond the allocated buffer, resulting in\nan out-of-bounds read from kernel heap memory. This could potentially\nleak sensitive kernel information to userspace.\n\nAdditionally, providing an excessively large wqe_size can trigger a\nWARNING in the memory allocation path, as reported by syzkaller.\n\nThis is inconsistent with ib_uverbs_unmarshall_recv() which properly\nvalidates that wqe_size \u003e= sizeof(struct ib_uverbs_recv_wr) before\nproceeding.\n\nAdd the same validation for ib_uverbs_post_send() to ensure wqe_size\nis at least sizeof(struct ib_uverbs_send_wr)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached via write() on the local RDMA uverbs character device (/dev/infiniband/uverbs*) dispatched through UAPI_DEF_WRITE_IO; it is not reachable over any network.\nAC:L - The attacker fully controls cmd.wqe_size and can reliably trigger the OOB read by simply setting wqe_size=1 (or the WARN with a huge value); no uncontrolled conditions are involved.\nPR:L - An unprivileged local user with access to the RDMA uverbs device (the normal case on RDMA-enabled systems, and obtainable via Soft-RoCE) can open a context, create a QP, and issue POST_SEND; no real-root privilege is required.\nUI:N - The command is issued directly by the attacker via a syscall; no action by any other user is needed.\nS:U - The OOB read and resulting impact remain within the kernel\u0027s own security authority; no crossing of a security boundary (VM/IOMMU/sandbox) occurs.\nC:H - The bug reads ~48 bytes of kernel heap memory beyond the undersized allocation, and the leaked values (e.g. wr_id) are returned to userspace via completion polling, giving a repeatable kernel-heap information disclosure.\nI:N - The defect is purely an out-of-bounds read; num_sge is bounded by the sge_count check, so no kernel memory is modified and there is no write primitive.\nA:H - An excessively large wqe_size triggers a WARNING in the allocator (syzkaller-reported), which becomes a kernel panic under the common panic_on_warn hardening, causing denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:29.851Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163"
        },
        {
          "url": "https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d533425ac1f2925b4fc3e4ed9b9d72362cb23475"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0"
        }
      ],
      "title": "RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45856",
    "datePublished": "2026-05-27T12:15:33.209Z",
    "dateReserved": "2026-05-13T15:03:33.079Z",
    "dateUpdated": "2026-08-05T12:28:29.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45860 (GCVE-0-2026-45860)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:15 – Updated: 2026-08-05 12:28

Title

netfilter: nf_conncount: increase the connection clean up limit to 64

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are tracked per jiffy the list won't be cleaned up fast enough possibly reaching the limit wrongly. In order to prevent this issue, only skip the GC if it was already triggered during the same jiffy and the increment is lower than the clean up limit. In addition, increase the clean up limit to 64 connections to avoid triggering GC too often and do more effective GCs. This has been tested using a HTTP server and several performance tools while having nft_connlimit/xt_connlimit or OVS limit configured. Output of slowhttptest + OVS limit at 52000 connections: slow HTTP test status on 340th second: initializing: 0 pending: 432 connected: 51998 error: 0 closed: 0 service available: YES

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a5c9e14e0e8923218…
https://git.kernel.org/stable/c/13eede458fdf231f1…
https://git.kernel.org/stable/c/fa85432d58c8e74b3…
https://git.kernel.org/stable/c/0792ad077d776c2dc…
https://git.kernel.org/stable/c/3d0994ed0aa1fc0a2…
https://git.kernel.org/stable/c/6e5fa7add3e76da06…
https://git.kernel.org/stable/c/0af0812baf2d36317…
https://git.kernel.org/stable/c/21d033e472735ecec…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f106694733c66a48740c25bc4e212e9b2ea364ce , < a5c9e14e0e8923218ae881d5e78c990c07694966 (git) Affected: be69850b461e7b491d87a22e33ab76fdd04b725e , < 13eede458fdf231f1bf96a398feea4ad1553f14c (git) Affected: d265929930e2ffafc744c0ae05fb70acd53be1ee , < fa85432d58c8e74b39333edbf8d28df2985dfc79 (git) Affected: d265929930e2ffafc744c0ae05fb70acd53be1ee , < 0792ad077d776c2dcf20f0484e2461ded1b77a24 (git) Affected: d265929930e2ffafc744c0ae05fb70acd53be1ee , < 3d0994ed0aa1fc0a2c5e620b765e8defdd021bff (git) Affected: d265929930e2ffafc744c0ae05fb70acd53be1ee , < 6e5fa7add3e76da068a478d905be64be8fa4e80a (git) Affected: d265929930e2ffafc744c0ae05fb70acd53be1ee , < 0af0812baf2d363176c9b76fc07e33f13aede8db (git) Affected: d265929930e2ffafc744c0ae05fb70acd53be1ee , < 21d033e472735ecec677f1ae46d6740b5e47a4f3 (git) Affected: 5.10.248 , < 5.10.252 (semver) Affected: 5.15.198 , < 5.15.202 (semver)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.14 , ≤ 6.18.* (semver) Unaffected: 6.19.4 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_count.h",
            "net/netfilter/nf_conncount.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a5c9e14e0e8923218ae881d5e78c990c07694966",
              "status": "affected",
              "version": "f106694733c66a48740c25bc4e212e9b2ea364ce",
              "versionType": "git"
            },
            {
              "lessThan": "13eede458fdf231f1bf96a398feea4ad1553f14c",
              "status": "affected",
              "version": "be69850b461e7b491d87a22e33ab76fdd04b725e",
              "versionType": "git"
            },
            {
              "lessThan": "fa85432d58c8e74b39333edbf8d28df2985dfc79",
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "versionType": "git"
            },
            {
              "lessThan": "0792ad077d776c2dcf20f0484e2461ded1b77a24",
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "versionType": "git"
            },
            {
              "lessThan": "3d0994ed0aa1fc0a2c5e620b765e8defdd021bff",
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "versionType": "git"
            },
            {
              "lessThan": "6e5fa7add3e76da068a478d905be64be8fa4e80a",
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "versionType": "git"
            },
            {
              "lessThan": "0af0812baf2d363176c9b76fc07e33f13aede8db",
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "versionType": "git"
            },
            {
              "lessThan": "21d033e472735ecec677f1ae46d6740b5e47a4f3",
              "status": "affected",
              "version": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.252",
              "status": "affected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.202",
              "status": "affected",
              "version": "5.15.198",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_count.h",
            "net/netfilter/nf_conncount.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.10.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.15.198",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: increase the connection clean up limit to 64\n\nAfter the optimization to only perform one GC per jiffy, a new problem\nwas introduced. If more than 8 new connections are tracked per jiffy the\nlist won\u0027t be cleaned up fast enough possibly reaching the limit\nwrongly.\n\nIn order to prevent this issue, only skip the GC if it was already\ntriggered during the same jiffy and the increment is lower than the\nclean up limit. In addition, increase the clean up limit to 64\nconnections to avoid triggering GC too often and do more effective GCs.\n\nThis has been tested using a HTTP server and several\nperformance tools while having nft_connlimit/xt_connlimit or OVS limit\nconfigured.\n\nOutput of slowhttptest + OVS limit at 52000 connections:\n\n slow HTTP test status on 340th second:\n initializing:        0\n pending:             432\n connected:           51998\n error:               0\n closed:              0\n service available:   YES"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The code runs in a netfilter packet-processing hook (nft_connlimit/xt_connlimit/OVS limit); it is driven by connection packets from a remote peer, so the vulnerability is reachable over the network.\nAC:L - The attacker fully controls the trigger condition (generating more than 8 new connections per jiffy), which is trivially achievable with ordinary connection flooding and requires no conditions outside the attacker\u0027s control.\nPR:N - A remote attacker merely opening connections to a connlimit-protected service needs no authentication or privileges on the target system.\nUI:N - Exploitation requires only sending connection traffic; no victim interaction is needed.\nS:U - The faulty accounting and its effect stay within the kernel\u0027s network stack and the protected service; no security boundary is crossed.\nC:N - The bug is a connection-count accounting error with no memory disclosure or information leak of any kind.\nI:N - No attacker-controlled data is modified and there is no memory corruption; only the internal connection counter is transiently inaccurate.\nA:H - The inflated count causes the connlimit to reach its threshold prematurely, so legitimate new connections to the protected service are rejected; an attacker can sustain this to deny service (total loss of new-connection availability under a global/zone limit)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:31.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a5c9e14e0e8923218ae881d5e78c990c07694966"
        },
        {
          "url": "https://git.kernel.org/stable/c/13eede458fdf231f1bf96a398feea4ad1553f14c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa85432d58c8e74b39333edbf8d28df2985dfc79"
        },
        {
          "url": "https://git.kernel.org/stable/c/0792ad077d776c2dcf20f0484e2461ded1b77a24"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d0994ed0aa1fc0a2c5e620b765e8defdd021bff"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e5fa7add3e76da068a478d905be64be8fa4e80a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0af0812baf2d363176c9b76fc07e33f13aede8db"
        },
        {
          "url": "https://git.kernel.org/stable/c/21d033e472735ecec677f1ae46d6740b5e47a4f3"
        }
      ],
      "title": "netfilter: nf_conncount: increase the connection clean up limit to 64",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45860",
    "datePublished": "2026-05-27T12:15:40.080Z",
    "dateReserved": "2026-05-13T15:03:33.080Z",
    "dateUpdated": "2026-08-05T12:28:31.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46275 (GCVE-0-2026-46275)

Vulnerability from cvelistv5 – Published: 2026-06-08 14:30 – Updated: 2026-08-05 12:30

Title

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/78aad93e938f013d9…
https://git.kernel.org/stable/c/e2d19969c8d9198ec…
https://git.kernel.org/stable/c/c85cff648a2bc9232…
https://git.kernel.org/stable/c/9d20d48be2c4a071f…
https://git.kernel.org/stable/c/81c7a3c22a0f2808c…
https://git.kernel.org/stable/c/192cb0f1ca706d9a1…
https://git.kernel.org/stable/c/7338031946bd06f6d…
https://git.kernel.org/stable/c/c1bb9336ae6b54a5f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 78aad93e938f013d9272fe0ee168f27883afa95c (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < e2d19969c8d9198ecc3090bcd5312ecd503a3339 (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < c85cff648a2bc92322912db5f1727ad05afae7b6 (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 9d20d48be2c4a071fb015eb09bda2cecd25daf34 (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 81c7a3c22a0f2808cf4ae0b4908f59763b23606d (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 7338031946bd06f6dff149e67b60c4cd083bfea8 (git) Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b (git) Affected: cd27019bc149f20f12ebec943c2b4c775745a5a0 (git) Affected: aea63181b6fcb6b9ccde1ada9ea51be19c4015af (git) Affected: 0d234d1135dcd8876de0576dac68efd0a87eef87 (git) Affected: 3fe978892ab46efc2f3830d9abc015eff72caaf9 (git) Affected: 0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f (git) Affected: 4.14.203 , < 4.15 (semver) Affected: 4.19.153 , < 4.20 (semver) Affected: 5.4.73 , < 5.5 (semver) Affected: 5.8.17 , < 5.9 (semver) Affected: 5.9.2 , < 5.10 (semver)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78aad93e938f013d9272fe0ee168f27883afa95c",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "e2d19969c8d9198ecc3090bcd5312ecd503a3339",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "c85cff648a2bc92322912db5f1727ad05afae7b6",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "9d20d48be2c4a071fb015eb09bda2cecd25daf34",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "7338031946bd06f6dff149e67b60c4cd083bfea8",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cd27019bc149f20f12ebec943c2b4c775745a5a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d234d1135dcd8876de0576dac68efd0a87eef87",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fe978892ab46efc2f3830d9abc015eff72caaf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.153",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.73",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.153",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.73",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n   disabling write_work causes a race condition where both can concurrently\n   double-free hu-\u003etx_skb. This happens because protocol timers can\n   concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu-\u003eproto-\u003eclose(hu) causes a UAF\n   when vendor specific protocol close callbacks dereference hu-\u003ehdev.\n3. In the initialization error paths, failing to take the proto_lock\n   write lock before clearing PROTO_READY leads to races with active\n   readers. Additionally, hci_uart_tty_receive() accesses hu-\u003ehdev\n   outside the read lock, leading to UAFs if the initialization error\n   path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n   followed immediately by a cancel_work_sync(\u0026hu-\u003ewrite_work). Clearing\n   the flag locks out concurrent protocol timers from successfully invoking\n   hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n   and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n   hu-\u003eproto-\u003eflush(). This is perfectly safe in the tty_close path\n   because hu-\u003eproto-\u003eclose() executes shortly after, which intrinsically\n   purges all protocol SKB queues and tears down the state.\n3. Relocating hu-\u003eproto-\u003eclose(hu) strictly prior to hci_free_dev(hdev)\n   across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev-\u003estat.byte_rx increment in hci_uart_tty_receive()\n   inside the proto_lock read-side critical section to safely synchronize\n   with device unregistration.\n5. Adding cancel_work_sync(\u0026hu-\u003ewrite_work) to hci_uart_close() to safely\n   flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n   all paths to prevent permanently breaking user-space retry capabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local TTY control (TIOCSETD to N_HCI, HCIUARTSETPROTO ioctl, hangup/close) gated by CAP_NET_ADMIN at hci_uart_tty_open(); the bugs are in driver lifecycle teardown, not in processing of remote Bluetooth over-the-air packets.\nAC:L - The attacker controls both sides of every race by concurrently opening/closing the TTY line discipline, issuing HCIUART ioctls, and timing hangup against in-flight workqueues and protocol timers; UAF conditions are reliably winnable without luck-dependent memory layout.\nPR:L - hci_uart_tty_open() explicitly requires CAP_NET_ADMIN, and adapter teardown paths are similarly admin-gated; CAP_NET_ADMIN is obtainable by an unprivileged user inside a user namespace, satisfying the Low privileges threshold rather than High.\nUI:N - Once the attacker has the required local TTY/HCI access, triggering the UAF or double-free races requires no action from a separate victim user.\nS:U - The vulnerability corrupts kernel heap memory within the kernel\u0027s own security boundary; successful exploitation yields kernel privilege escalation, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - Multiple use-after-free conditions on the hci_uart and hci_dev structures allow dereferencing attacker-influenced freed memory, providing a standard kernel info-leak primitive consistent with UAF severity guidance.\nI:H - The UAF and hu-\u003etx_skb double-free races enable control of freed slab objects and heap grooming, providing a path to arbitrary kernel memory corruption and potential code execution in kernel context.\nA:H - Use-after-free and double-free in kernel workqueue and teardown paths reliably cause kernel oops or panic, and can be triggered repeatedly to deny availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:58.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339"
        },
        {
          "url": "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34"
        },
        {
          "url": "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d"
        },
        {
          "url": "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"
        },
        {
          "url": "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"
        }
      ],
      "title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46275",
    "datePublished": "2026-06-08T14:30:54.232Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:58.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52972 (GCVE-0-2026-52972)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:28 – Updated: 2026-08-17 04:50

Title

crypto: af_alg - Cap AEAD AD length to 0x80000000

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

12 references

URL	Tags
https://git.kernel.org/stable/c/f8a5203596797f394…
https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a…
https://git.kernel.org/stable/c/a4fe4eb580bbc7439…
https://git.kernel.org/stable/c/e4c4a5074532eaaa1…
https://git.kernel.org/stable/c/265ac26d1c5e17b34…
https://git.kernel.org/stable/c/a1c5672faf8e93e38…
https://git.kernel.org/stable/c/97948906dc8e0ea84…
https://git.kernel.org/stable/c/0b3a57d218618cb1c…
https://git.kernel.org/stable/c/e4c06479d7059888a…
https://access.redhat.com/security/cve/CVE-2026-52972	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492364	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

7 products

Vendor	Product	Version
Linux	Linux	Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < f8a5203596797f394ff3f9aa4005597a92249802 (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < a4fe4eb580bbc7439f649a496d4cf38415a4021c (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < e4c4a5074532eaaa14951994a3aad0d479aa7431 (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < 265ac26d1c5e17b34d497cbda1f754a1ec8552bc (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < a1c5672faf8e93e38c2deac3979cc767ca5cf918 (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < 97948906dc8e0ea84775e03e35b60a2063c70193 (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < 0b3a57d218618cb1cc78ddc9ba02c07de84b46f4 (git) Affected: 400c40cf78da00c16e561a3a253ca272455c42ef , < e4c06479d7059888adf2f22bc1ebcf053bf691a2 (git)
Linux	Linux	Affected: 4.1 Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.141 , ≤ 6.6.* (semver) Unaffected: 6.12.91 , ≤ 6.12.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.10 , ≤ 7.0.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T02:46:50.271Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52972"
          },
          {
            "name": "RHBZ#2492364",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492364"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52972.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f8a5203596797f394ff3f9aa4005597a92249802",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "a4fe4eb580bbc7439f649a496d4cf38415a4021c",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "e4c4a5074532eaaa14951994a3aad0d479aa7431",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "265ac26d1c5e17b34d497cbda1f754a1ec8552bc",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "a1c5672faf8e93e38c2deac3979cc767ca5cf918",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "97948906dc8e0ea84775e03e35b60a2063c70193",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "0b3a57d218618cb1cc78ddc9ba02c07de84b46f4",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            },
            {
              "lessThan": "e4c06479d7059888adf2f22bc1ebcf053bf691a2",
              "status": "affected",
              "version": "400c40cf78da00c16e561a3a253ca272455c42ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:24.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4fe4eb580bbc7439f649a496d4cf38415a4021c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4c4a5074532eaaa14951994a3aad0d479aa7431"
        },
        {
          "url": "https://git.kernel.org/stable/c/265ac26d1c5e17b34d497cbda1f754a1ec8552bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1c5672faf8e93e38c2deac3979cc767ca5cf918"
        },
        {
          "url": "https://git.kernel.org/stable/c/97948906dc8e0ea84775e03e35b60a2063c70193"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b3a57d218618cb1cc78ddc9ba02c07de84b46f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4c06479d7059888adf2f22bc1ebcf053bf691a2"
        }
      ],
      "title": "crypto: af_alg - Cap AEAD AD length to 0x80000000",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52972",
    "datePublished": "2026-06-24T16:28:50.425Z",
    "dateReserved": "2026-06-09T07:44:35.375Z",
    "dateUpdated": "2026-08-17T04:50:24.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53270 (GCVE-0-2026-53270)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34

Title

ipvs: clear the svc scheduler ptr early on edit

Summary

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks. Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/d10730a1f2caf0808…
https://git.kernel.org/stable/c/e4feec3174036ba77…
https://git.kernel.org/stable/c/7d4f5004511757e39…
https://git.kernel.org/stable/c/c6376b9b1b4d2bad6…
https://git.kernel.org/stable/c/14e4689c113b4c06a…
https://git.kernel.org/stable/c/25918720ba97f974a…
https://git.kernel.org/stable/c/19a9493faa4bf3c7b…
https://git.kernel.org/stable/c/193989cc6d80dd8e0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < d10730a1f2caf08088e0db1b19b242f3e6fa5f06 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < e4feec3174036ba772006be74beee0efa09a9eb8 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < 7d4f5004511757e3984901ffb412fcf858d80ed5 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < c6376b9b1b4d2bad638256b1b3588e073344ae69 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < 14e4689c113b4c06af1069364ade24fdd7055f33 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < 25918720ba97f974a4f8d433b5a0132c5b43f6f3 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < 19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03 (git) Affected: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 , < 193989cc6d80dd8e0460fb3992e69fa03bf0ff9b (git) Affected: c803fddd2a95a70873c68dbff42d4c59fd2e674e (git) Affected: 4ec8fb23158797affae7993c15beba080488482f (git) Affected: 3.18.23 , < 3.19 (semver) Affected: 4.1.11 , < 4.2 (semver)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_ctl.c",
            "net/netfilter/ipvs/ip_vs_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d10730a1f2caf08088e0db1b19b242f3e6fa5f06",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "e4feec3174036ba772006be74beee0efa09a9eb8",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "7d4f5004511757e3984901ffb412fcf858d80ed5",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "c6376b9b1b4d2bad638256b1b3588e073344ae69",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "14e4689c113b4c06af1069364ade24fdd7055f33",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "25918720ba97f974a4f8d433b5a0132c5b43f6f3",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "lessThan": "193989cc6d80dd8e0460fb3992e69fa03bf0ff9b",
              "status": "affected",
              "version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c803fddd2a95a70873c68dbff42d4c59fd2e674e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4ec8fb23158797affae7993c15beba080488482f",
              "versionType": "git"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.23",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_ctl.c",
            "net/netfilter/ipvs/ip_vs_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear the svc scheduler ptr early on edit\n\nip_vs_edit_service() while unbinding the old scheduler clears\nthe svc-\u003escheduler ptr after the scheduler module initiates\nRCU callbacks. This can cause packets to use the old\nscheduler at the time when svc-\u003esched_data is already freed\nafter RCU grace period.\n\nFix it by clearing the ptr early in ip_vs_unbind_scheduler(),\nbefore the done_service method schedules any RCU callbacks.\n\nAlso, if the new scheduler fails to initialize when replacing\nthe old scheduler, try to restore the old scheduler while still\nreturning the error code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable transition is reached through local IPVS service-edit control paths such as `setsockopt(IP_VS_SO_SET_EDIT)` or IPVS generic netlink; packets exercise the stale scheduler afterward, but the attacker must initiate the local service edit.\nAC:L - The attacker can control both sides of the condition by changing the scheduler and generating new TCP/UDP/SCTP traffic to the service, so this is not dependent on an uncontrollable race.\nPR:L - The legacy setsockopt path checks `CAP_NET_ADMIN` in the socket network namespace, which is reachable by an unprivileged local user via user and network namespaces in plausible deployments.\nUI:N - No victim interaction is needed once the attacker has local access and namespace privileges; the attacker can create/edit the IPVS service and send triggering traffic.\nS:U - The impact is kernel memory corruption within the same host security authority, not a VM, IOMMU, or separate security-scope escape.\nC:H - This is an RCU use-after-free of scheduler-private `svc-\u003esched_data`, and freed scheduler state can be reused and dereferenced by packet scheduling, making high confidentiality impact defensible.\nI:H - Several affected schedulers write through the stale `sched_data` pointer, so the UAF can plausibly become arbitrary kernel memory corruption or control-flow compromise.\nA:H - At minimum the stale scheduler pointer can dereference freed scheduler state during packet processing and crash or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:46.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69"
        },
        {
          "url": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33"
        },
        {
          "url": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03"
        },
        {
          "url": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b"
        }
      ],
      "title": "ipvs: clear the svc scheduler ptr early on edit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53270",
    "datePublished": "2026-06-25T08:39:55.830Z",
    "dateReserved": "2026-06-09T07:44:35.395Z",
    "dateUpdated": "2026-08-05T12:34:46.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53357 (GCVE-0-2026-53357)

Vulnerability from cvelistv5 – Published: 2026-07-02 13:43 – Updated: 2026-08-05 12:35

Title

Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning, so the returned sk has no caller reference and is unlocked. l2cap_sock_cleanup_listen() walks these children on listening-socket close. A concurrent HCI disconnect drives hci_rx_work -> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and frees the child sk and its l2cap_chan; cleanup_listen() then uses both: BUG: KASAN: slab-use-after-free in l2cap_sock_kill l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill This is distinct from the two fixes already in this area: commit e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the accept_q list/poll and takes temporary refs inside bt_accept_dequeue(), and CVE-2025-39860 serialises the userspace close()/accept() race by calling cleanup_listen() under lock_sock() in l2cap_sock_release(). Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF still reproduces on current bluetooth/master. Take the reference at the source: bt_accept_dequeue() does sock_hold() while sk is still locked, before release_sock(); callers sock_put(). cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on SOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under the parent sk lock and that would invert conn->lock -> chan->lock -> sk_lock (lockdep). KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced 12 use-after-free reports per run before this change; 0, and no lockdep report, over 1600+ raced iterations after it on bluetooth/master.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/751de6ec671fe75ad…
https://git.kernel.org/stable/c/407217734835d21d4…
https://git.kernel.org/stable/c/7eebd4c2c86f573af…
https://git.kernel.org/stable/c/5d86d2f1b4d9a508c…
https://git.kernel.org/stable/c/87c543e2f78d0871f…
https://git.kernel.org/stable/c/added121339507147…
https://git.kernel.org/stable/c/a5ca86a6097a8b030…
https://git.kernel.org/stable/c/ab1513597c6cf17cd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 751de6ec671fe75ad9cf65a0638d2a06b6a5984d (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 407217734835d21d4e0105ebf347860dc1806f88 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 7eebd4c2c86f573af87ff165d08a83432eb0b919 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 5d86d2f1b4d9a508c441d3e45277ae1a73cfed57 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < 87c543e2f78d0871f271df92dab98901bbd5b6f5 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < added1213395071470a900cc845a042fb51882a6 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < a5ca86a6097a8b030ca3226cd300b17ed330f966 (git) Affected: 15f02b91056253e8cdc592888f431da0731337b8 , < ab1513597c6cf17cd1ad2a21e3b045421b48e022 (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c",
            "net/bluetooth/iso.c",
            "net/bluetooth/l2cap_sock.c",
            "net/bluetooth/rfcomm/sock.c",
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "407217734835d21d4e0105ebf347860dc1806f88",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "added1213395071470a900cc845a042fb51882a6",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            },
            {
              "lessThan": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
              "status": "affected",
              "version": "15f02b91056253e8cdc592888f431da0731337b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c",
            "net/bluetooth/iso.c",
            "net/bluetooth/l2cap_sock.c",
            "net/bluetooth/rfcomm/sock.c",
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\n\nbt_accept_dequeue() unlinks a not-yet-accepted child from the parent\naccept queue and release_sock()s it before returning, so the returned\nsk has no caller reference and is unlocked.\n\nl2cap_sock_cleanup_listen() walks these children on listening-socket\nclose.  A concurrent HCI disconnect drives hci_rx_work -\u003e\nl2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and\nfrees the child sk and its l2cap_chan; cleanup_listen() then uses both:\n\n  BUG: KASAN: slab-use-after-free in l2cap_sock_kill\n    l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close\n  Freed by: l2cap_conn_del -\u003e l2cap_sock_close_cb -\u003e l2cap_sock_kill\n\nThis is distinct from the two fixes already in this area: commit\ne83f5e24da741 (\"Bluetooth: serialize accept_q access\") serialises the\naccept_q list/poll and takes temporary refs inside bt_accept_dequeue(),\nand CVE-2025-39860 serialises the userspace close()/accept() race by\ncalling cleanup_listen() under lock_sock() in l2cap_sock_release().\nNeither covers l2cap_conn_del() running from hci_rx_work, so this UAF\nstill reproduces on current bluetooth/master.\n\nTake the reference at the source: bt_accept_dequeue() does sock_hold()\nwhile sk is still locked, before release_sock(); callers sock_put().\ncleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under\na brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops\nit before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on\nSOCK_DEAD.  conn-\u003elock is not taken here: cleanup_listen() runs under\nthe parent sk lock and that would invert\nconn-\u003elock -\u003e chan-\u003elock -\u003e sk_lock (lockdep).\n\nKASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced\n12 use-after-free reports per run before this change; 0, and no lockdep\nreport, over 1600+ raced iterations after it on bluetooth/master."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The race is driven through Bluetooth L2CAP/HCI connection and disconnect handling from a nearby peer, so it is limited to Bluetooth-adjacent reachability rather than routable network access. The local listener/close side is accounted for in PR.\nAC:L - This is a race, but the attacker can reasonably control the listener close timing and the Bluetooth peer disconnect timing. The commit reports reliable unprivileged raced iterations, so no uncontrollable condition is required.\nPR:L - Creating, binding to a dynamic PSM, listening on, and closing non-raw L2CAP sockets does not require capabilities; only raw sockets or reserved PSMs need privileges. A basic unprivileged local user on the target can set up the vulnerable listener.\nUI:N - No victim user action is required once the attacker can run the unprivileged local setup and control the Bluetooth peer. The trigger is socket close racing HCI disconnect processing.\nS:U - The corruption is within the Linux kernel Bluetooth/socket subsystem and impacts the same kernel security authority. It is not a VM escape or cross-scope boundary bypass.\nC:H - The bug is a use-after-free of both the child sock and its l2cap_chan, and freed kernel heap objects can be reclaimed and used for disclosure primitives. Per kernel CVSS guidance, UAF memory corruption supports high confidentiality impact.\nI:H - The stale sock/channel pointers are used after l2cap_conn_del frees them, including through cleanup and kill paths, making heap grooming and control-flow or write-primitive exploitation plausible. Per guidance, UAF memory corruption supports high integrity impact.\nA:H - The observed failure is a KASAN slab-use-after-free in kernel Bluetooth cleanup, which can crash or oops the kernel. Repeated triggering can deny availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:35:06.665Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/751de6ec671fe75ad9cf65a0638d2a06b6a5984d"
        },
        {
          "url": "https://git.kernel.org/stable/c/407217734835d21d4e0105ebf347860dc1806f88"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eebd4c2c86f573af87ff165d08a83432eb0b919"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d86d2f1b4d9a508c441d3e45277ae1a73cfed57"
        },
        {
          "url": "https://git.kernel.org/stable/c/87c543e2f78d0871f271df92dab98901bbd5b6f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/added1213395071470a900cc845a042fb51882a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5ca86a6097a8b030ca3226cd300b17ed330f966"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab1513597c6cf17cd1ad2a21e3b045421b48e022"
        }
      ],
      "title": "Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53357",
    "datePublished": "2026-07-02T13:43:17.077Z",
    "dateReserved": "2026-06-09T07:44:35.400Z",
    "dateUpdated": "2026-08-05T12:35:06.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63794 (GCVE-0-2026-63794)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:50

Title

KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage): 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP writes beyond the end of the 4096-byte dst_tpage allocation. 2. The subsequent memcpy()/copy_from_user() into page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows by up to 15 bytes under the same condition. Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - the PSP is instructed to write round_up(4097, 16) = 4112 bytes to a 4096-byte buffer. Fix by also bounding len by (PAGE_SIZE - d_off), the same check that sev_send_update_data() already performs for its single-page guest region. ================================================================== BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 print_report+0xbc/0x260 kasan_report+0xa2/0xd0 kasan_check_range+0x25f/0x2c0 __asan_memcpy+0x40/0x70 sev_dbg_crypt+0x993/0xd10 [kvm_amd] sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] kvm_vm_ioctl+0x65d/0x6d0 [kvm] __se_sys_ioctl+0xb2/0x100 do_syscall_64+0xe8/0x870 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb memcg:ff11000112827d82 flags: 0x1400000000000000(node=1|zone=1) raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 page dumped because: kasan: bad access detected Memory state around the buggy address: ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint [sean: add sample KASAN splat, Fixes, and stable@]

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/f701ae476cb92a3a3…
https://git.kernel.org/stable/c/64f2449841ffc7d20…
https://git.kernel.org/stable/c/9349b50f4b11f135f…
https://git.kernel.org/stable/c/889c2a9c59897ca91…
https://git.kernel.org/stable/c/e1a0fe288dee07b7d…
https://git.kernel.org/stable/c/720949ed666f34ff2…
https://git.kernel.org/stable/c/2753a097d1fe24c43…
https://git.kernel.org/stable/c/78ee2d50185a037b3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < f701ae476cb92a3a3d8844bb39bb63b4512684c8 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 64f2449841ffc7d203183aa4c748c9c77951ecc5 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 9349b50f4b11f135fe73b56cb2c2c872d8bc71d7 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 889c2a9c59897ca912bf39df5bb92555a0a13df4 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < e1a0fe288dee07b7da25a71e007c1ecd1080315b (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 720949ed666f34ff28ffdfe1471a5861d1e41fdf (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 2753a097d1fe24c4351c608048612c74108aa89f (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 78ee2d50185a037b3d2452a97f3dad69c3f7f389 (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f701ae476cb92a3a3d8844bb39bb63b4512684c8",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "64f2449841ffc7d203183aa4c748c9c77951ecc5",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "9349b50f4b11f135fe73b56cb2c2c872d8bc71d7",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "889c2a9c59897ca912bf39df5bb92555a0a13df4",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "e1a0fe288dee07b7da25a71e007c1ecd1080315b",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "720949ed666f34ff28ffdfe1471a5861d1e41fdf",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "2753a097d1fe24c4351c608048612c74108aa89f",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            },
            {
              "lessThan": "78ee2d50185a037b3d2452a97f3dad69c3f7f389",
              "status": "affected",
              "version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path\n\nIn sev_dbg_crypt(), the per-iteration transfer length is bounded by\nthe source page offset (PAGE_SIZE - s_off) but not by the destination\npage offset (PAGE_SIZE - d_off).  When d_off \u003e s_off, the encrypt\npath (__sev_dbg_encrypt_user) performs a read-modify-write using a\nsingle-page intermediate buffer (dst_tpage):\n\n  1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off \u0026 15), 16)\n     before issuing the PSP command.  If len + (d_off \u0026 15) \u003e PAGE_SIZE,\n     the PSP writes beyond the end of the 4096-byte dst_tpage allocation.\n\n  2. The subsequent memcpy()/copy_from_user() into\n     page_address(dst_tpage) + (d_off \u0026 15) of \u0027len\u0027 bytes overflows\n     by up to 15 bytes under the same condition.\n\nTrigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -\nthe PSP is instructed to write round_up(4097, 16) = 4112 bytes to\na 4096-byte buffer.\n\nFix by also bounding len by (PAGE_SIZE - d_off), the same check that\nsev_send_update_data() already performs for its single-page guest\nregion.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214\n\n CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G     U  W           7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY\n Tainted: [U]=USER, [W]=WARN\n Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x54/0x70\n  print_report+0xbc/0x260\n  kasan_report+0xa2/0xd0\n  kasan_check_range+0x25f/0x2c0\n  __asan_memcpy+0x40/0x70\n  sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n  sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd]\n  kvm_vm_ioctl+0x65d/0x6d0 [kvm]\n  __se_sys_ioctl+0xb2/0x100\n  do_syscall_64+0xe8/0x870\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  \u003c/TASK\u003e\n\n The buggy address belongs to the physical page:\n page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb\n memcg:ff11000112827d82\n flags: 0x1400000000000000(node=1|zone=1)\n raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003eff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n                    ^\n  ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n  ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ==================================================================\n Disabling lock debugging due to kernel taint\n\n[sean: add sample KASAN splat, Fixes, and stable@]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:58.924Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/64f2449841ffc7d203183aa4c748c9c77951ecc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/9349b50f4b11f135fe73b56cb2c2c872d8bc71d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/889c2a9c59897ca912bf39df5bb92555a0a13df4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1a0fe288dee07b7da25a71e007c1ecd1080315b"
        },
        {
          "url": "https://git.kernel.org/stable/c/720949ed666f34ff28ffdfe1471a5861d1e41fdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/2753a097d1fe24c4351c608048612c74108aa89f"
        },
        {
          "url": "https://git.kernel.org/stable/c/78ee2d50185a037b3d2452a97f3dad69c3f7f389"
        }
      ],
      "title": "KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63794",
    "datePublished": "2026-07-19T12:02:03.488Z",
    "dateReserved": "2026-07-19T07:54:57.012Z",
    "dateUpdated": "2026-08-17T04:50:58.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63829 (GCVE-0-2026-63829)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51

Title

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

Summary

In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper. Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs. Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/19275943d8fe903eb…
https://git.kernel.org/stable/c/866b0f5ae599490bd…
https://git.kernel.org/stable/c/92b766fc55156e0da…
https://git.kernel.org/stable/c/e54c05ed3d9c28733…
https://git.kernel.org/stable/c/9831bc9ecb4029578…
https://git.kernel.org/stable/c/1697957eb0971d420…
https://git.kernel.org/stable/c/47b5d3d506609b08b…
https://git.kernel.org/stable/c/8165f7ff57d9667d2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b57708add31494175be741ed3fd24023b50c3423 , < 19275943d8fe903eb7b9aa53e380e41efd042ada (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < 866b0f5ae599490bd496fd84581c68ac8b94e6af (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < 92b766fc55156e0da2ecd0c2302c971118f8a229 (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < e54c05ed3d9c28733fb9e5837219aca3691defa3 (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < 9831bc9ecb402957810c2045c663fbfe9b09e296 (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < 1697957eb0971d420dde42862b88eb43506a1105 (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < 47b5d3d506609b08b2e1f7c14f0b681a1953d572 (git) Affected: b57708add31494175be741ed3fd24023b50c3423 , < 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 (git)
Linux	Linux	Affected: 3.16 Unaffected: 0 , < 3.16 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/rtnetlink.h",
            "net/core/rtnetlink.c",
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19275943d8fe903eb7b9aa53e380e41efd042ada",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "866b0f5ae599490bd496fd84581c68ac8b94e6af",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "92b766fc55156e0da2ecd0c2302c971118f8a229",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "e54c05ed3d9c28733fb9e5837219aca3691defa3",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "9831bc9ecb402957810c2045c663fbfe9b09e296",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "1697957eb0971d420dde42862b88eb43506a1105",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "47b5d3d506609b08b2e1f7c14f0b681a1953d572",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "8165f7ff57d9667d2bb477ef6af83ede7fed4ad7",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/rtnetlink.h",
            "net/core/rtnetlink.c",
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t-\u003enet. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t-\u003ecollect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller\u0027s netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t-\u003enet while authorization is checked only against dev_net(dev), crossing from the attacker\u0027s net/user namespace into another tenant\u0027s or the host\u0027s network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:37.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af"
        },
        {
          "url": "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229"
        },
        {
          "url": "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296"
        },
        {
          "url": "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572"
        },
        {
          "url": "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7"
        }
      ],
      "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63829",
    "datePublished": "2026-07-19T12:02:23.191Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-17T04:51:37.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63918 (GCVE-0-2026-63918)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname

Summary

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount_inc(), but every other session getter in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the corresponding _get_next variants) uses refcount_inc_not_zero() because the IDR/RCU lookup can race with refcount_dec_and_test() -> l2tp_session_free() -> kfree_rcu(). The ifname getter is the only outlier; the inconsistency was raised on-list after 979c017803c4 ("l2tp: use list_del_rcu in l2tp_session_unhash"). A reader inside rcu_read_lock_bh() that matches session->ifname can be preempted between the strcmp() and the refcount_inc(). If the last reference drops on another CPU in that window, the reader's refcount_inc() runs on a counter that has reached zero. refcount_t catches the addition-on-zero, prints "refcount_t: addition on 0; use-after-free", saturates the counter, and returns the saturated pointer to the caller. Session memory is held live by the in-flight RCU read section, but the kfree_rcu() callback queued from l2tp_session_free() will free it once the grace period closes; a caller that dereferences the returned session past that point hits a slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU sleeping lock and the preemption window is real; on stock PREEMPT kernels local_bh_disable() is a preempt_count increment that closes the cross-CPU race in practice (see below). Use refcount_inc_not_zero() and continue the list walk on failure, matching the other session getters in the file. The ifname getter is the only session getter in net/l2tp/ that still uses the bare refcount_inc() pattern; this change restores file-internal consistency. The success path is unchanged.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/ee80455feffb9cb62…
https://git.kernel.org/stable/c/947013fd7c8c35dd5…
https://git.kernel.org/stable/c/782d60a6596aee9b2…
https://git.kernel.org/stable/c/05f95729ca844704d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: abe7a1a7d0b69e63b1bca5f9531023a52336784f , < ee80455feffb9cb62b5b58715cabeff495e666b2 (git) Affected: abe7a1a7d0b69e63b1bca5f9531023a52336784f , < 947013fd7c8c35dd5856557b215840098a3f67f8 (git) Affected: abe7a1a7d0b69e63b1bca5f9531023a52336784f , < 782d60a6596aee9b29c2eecfa70033899278bf65 (git) Affected: abe7a1a7d0b69e63b1bca5f9531023a52336784f , < 05f95729ca844704d15e49ce14868af4b403b32b (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/l2tp/l2tp_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee80455feffb9cb62b5b58715cabeff495e666b2",
              "status": "affected",
              "version": "abe7a1a7d0b69e63b1bca5f9531023a52336784f",
              "versionType": "git"
            },
            {
              "lessThan": "947013fd7c8c35dd5856557b215840098a3f67f8",
              "status": "affected",
              "version": "abe7a1a7d0b69e63b1bca5f9531023a52336784f",
              "versionType": "git"
            },
            {
              "lessThan": "782d60a6596aee9b29c2eecfa70033899278bf65",
              "status": "affected",
              "version": "abe7a1a7d0b69e63b1bca5f9531023a52336784f",
              "versionType": "git"
            },
            {
              "lessThan": "05f95729ca844704d15e49ce14868af4b403b32b",
              "status": "affected",
              "version": "abe7a1a7d0b69e63b1bca5f9531023a52336784f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/l2tp/l2tp_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname\n\nA reader in l2tp_session_get_by_ifname() can return a pointer to a\nsession whose refcount has reached zero. The getter takes its\nreference with plain refcount_inc(), but every other session getter\nin the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the\ncorresponding _get_next variants) uses refcount_inc_not_zero()\nbecause the IDR/RCU lookup can race with refcount_dec_and_test() -\u003e\nl2tp_session_free() -\u003e kfree_rcu(). The ifname getter is the only\noutlier; the inconsistency was raised on-list after 979c017803c4\n(\"l2tp: use list_del_rcu in l2tp_session_unhash\").\n\nA reader inside rcu_read_lock_bh() that matches session-\u003eifname can\nbe preempted between the strcmp() and the refcount_inc(). If the\nlast reference drops on another CPU in that window, the reader\u0027s\nrefcount_inc() runs on a counter that has reached zero. refcount_t\ncatches the addition-on-zero, prints \"refcount_t: addition on 0;\nuse-after-free\", saturates the counter, and returns the saturated\npointer to the caller. Session memory is held live by the in-flight\nRCU read section, but the kfree_rcu() callback queued from\nl2tp_session_free() will free it once the grace period closes; a\ncaller that dereferences the returned session past that point hits\na slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU\nsleeping lock and the preemption window is real; on stock PREEMPT\nkernels local_bh_disable() is a preempt_count increment that closes\nthe cross-CPU race in practice (see below).\n\nUse refcount_inc_not_zero() and continue the list walk on failure,\nmatching the other session getters in the file. The ifname getter\nis the only session getter in net/l2tp/ that still uses the bare\nrefcount_inc() pattern; this change restores file-internal\nconsistency. The success path is unchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reached via the L2TP genetlink management API (netlink syscall), not from the L2TP data-plane packet receive path. Attackers must issue local netlink commands such as SESSION_GET, SESSION_DELETE, or SESSION_MODIFY with L2TP_ATTR_IFNAME.\nAC:L - Exploitation requires racing session lookup-by-ifname against concurrent session deletion, and an attacker with CAP_NET_ADMIN can control both sides by issuing parallel netlink operations. On PREEMPT_RT kernels the preemption window between strcmp() and refcount_inc() is real and reliably winnable.\nPR:L - All affected genetlink commands are gated by GENL_UNS_ADMIN_PERM, requiring CAP_NET_ADMIN in the network namespace. That capability is obtainable by unprivileged users via user/network namespaces (unshare -Urn), not only by init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the race directly through netlink management commands without needing another user to mount, open, or configure anything.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain. This is not a VM escape, sandbox boundary cross, or IOMMU bypass.\nC:H - The bug is a slab use-after-free on struct l2tp_session; returning and later dereferencing a session whose refcount reached zero enables reading freed kernel heap memory and leaking kernel pointers or other sensitive data.\nI:H - UAF on struct l2tp_session corrupts a heap object that contains function pointers (recv_skb, session_close) and is subsequently used by session_delete/modify/notify handlers, enabling arbitrary kernel write or code execution via heap grooming.\nA:H - Dereferencing the freed l2tp_session after the RCU grace period causes kernel oops or panic. Even failed exploitation attempts trigger refcount_t \"addition on 0; use-after-free\" warnings and can crash the system under load."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:12.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee80455feffb9cb62b5b58715cabeff495e666b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/947013fd7c8c35dd5856557b215840098a3f67f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/782d60a6596aee9b29c2eecfa70033899278bf65"
        },
        {
          "url": "https://git.kernel.org/stable/c/05f95729ca844704d15e49ce14868af4b403b32b"
        }
      ],
      "title": "l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63918",
    "datePublished": "2026-07-19T14:55:21.414Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:12.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63920 (GCVE-0-2026-63920)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

ipv6: validate extension header length before copying to cmsg

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), etc.). An nftables payload-write expression can rewrite hdrlen after parsing and before the skb reaches recvmsg; the write itself is in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040 bytes from an 8-byte header. nftables is reachable from an unprivileged user namespace, so this is an unprivileged slab-out-of-bounds read: BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540 put_cmsg+0x3ac/0x540 udpv6_recvmsg+0xca0/0x1250 sock_recvmsg+0xdf/0x190 ____sys_recvmsg+0x1b1/0x620 Add ipv6_get_exthdr_len() which validates that at least two bytes are accessible before reading the hdrlen field, then checks the computed length against skb_tail_pointer(skb), returning 0 on failure. Extension headers are kept in the linear skb area by pskb_may_pull() during input, so skb_tail_pointer() is the correct bound. Use ipv6_get_exthdr_len() at all non-AH call sites: the five standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR) and the three standard cases in the extension-header walk loop (DSTOPTS, ROUTING, default). AH retains an inline bounds check because its length formula differs ((ptr[1]+2)<<2). The walk loop also gets a pre-read bounds check at the top to validate ptr before any case accesses ptr[0] or ptr[1]. When the walk loop detects a corrupted header, return from the function instead of continuing to process later socket options.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/81394827dfb72772c…
https://git.kernel.org/stable/c/931b4a1f13408c250…
https://git.kernel.org/stable/c/08464413e628803bd…
https://git.kernel.org/stable/c/a29768d56eb3798c0…
https://git.kernel.org/stable/c/0d330eff318c0f44d…
https://git.kernel.org/stable/c/a35daeabb43368623…
https://git.kernel.org/stable/c/eb18a1b1644e4cad9…
https://git.kernel.org/stable/c/dd433671fef381fda…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 81394827dfb72772c50d0ae3bdfa094428a5d76d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 931b4a1f13408c2507719890f78f7227c34a0282 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 08464413e628803bd10cb1df68d0138665f2f885 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a29768d56eb3798c052ad3281b05596e695a17af (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0d330eff318c0f44d4fb0ad2c2aef38f87f24c90 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a35daeabb433686234b010ebf7b53778dbd6c9b8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < eb18a1b1644e4cad978df2131e2bb9a2e6886992 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dd433671fef381fdaf7b530c631e6b782d66e224 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/datagram.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81394827dfb72772c50d0ae3bdfa094428a5d76d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "931b4a1f13408c2507719890f78f7227c34a0282",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "08464413e628803bd10cb1df68d0138665f2f885",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a29768d56eb3798c052ad3281b05596e695a17af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0d330eff318c0f44d4fb0ad2c2aef38f87f24c90",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a35daeabb433686234b010ebf7b53778dbd6c9b8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "eb18a1b1644e4cad978df2131e2bb9a2e6886992",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "dd433671fef381fdaf7b530c631e6b782d66e224",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/datagram.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.).  An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) \u003c\u003c 3) = 2040\nbytes from an 8-byte header.  nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n  BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n   put_cmsg+0x3ac/0x540\n   udpv6_recvmsg+0xca0/0x1250\n   sock_recvmsg+0xdf/0x190\n   ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure.  Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default).  AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)\u003c\u003c2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:14.814Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d"
        },
        {
          "url": "https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282"
        },
        {
          "url": "https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90"
        },
        {
          "url": "https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224"
        }
      ],
      "title": "ipv6: validate extension header length before copying to cmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63920",
    "datePublished": "2026-07-19T14:55:22.813Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:14.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:76738

CVE-2026-45856 (GCVE-0-2026-45856)

CVE-2026-45860 (GCVE-0-2026-45860)

CVE-2026-46275 (GCVE-0-2026-46275)

CVE-2026-52972 (GCVE-0-2026-52972)

CVE-2026-53270 (GCVE-0-2026-53270)

CVE-2026-53357 (GCVE-0-2026-53357)

CVE-2026-63794 (GCVE-0-2026-63794)

CVE-2026-63829 (GCVE-0-2026-63829)

CVE-2026-63918 (GCVE-0-2026-63918)

CVE-2026-63920 (GCVE-0-2026-63920)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour