Vulnerability-Lookup

ALSA-2026:91565 (CVE-2026-53236)

Vulnerability from osv_almalinux – Published: 2026-10-28 00:00 – Updated: 2026-10-28 13:39 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)
kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)
kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)
kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)
kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)
kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)
kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)
kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)
kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631)
kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

x86/microcode: Add platform mask to Intel microcode "old" list [AlmaLinux-10] [almalinux-10.2.z] (JIRA:AlmaLinux-212778)
net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [almalinux-10.2.z] (JIRA:AlmaLinux-245489)
backport fixes for lockdep issues reported with rt-debug [almalinux-10.2.z] (JIRA:AlmaLinux-259937)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:91565	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-53236	REPORT
	https://access.redhat.com/security/cve/CVE-2026-53388	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63978	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63979	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64027	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64109	REPORT
	https://access.redhat.com/security/cve/CVE-2026-64523	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68136	REPORT
	https://access.redhat.com/security/cve/CVE-2026-68338	REPORT
	https://access.redhat.com/security/cve/CVE-2026-72083	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74515	REPORT
	https://access.redhat.com/security/cve/CVE-2026-74631	REPORT
	https://access.redhat.com/security/cve/CVE-2026-80824	REPORT
	https://access.redhat.com/security/cve/CVE-2026-89638	REPORT
	https://access.redhat.com/security/cve/CVE-2026-89777	REPORT
	https://access.redhat.com/security/cve/CVE-2026-93262	REPORT
	https://bugzilla.redhat.com/2492709	REPORT
	https://bugzilla.redhat.com/2502255	REPORT
	https://bugzilla.redhat.com/2502341	REPORT
	https://bugzilla.redhat.com/2502376	REPORT
	https://bugzilla.redhat.com/2502382	REPORT
	https://bugzilla.redhat.com/2502615	REPORT
	https://bugzilla.redhat.com/2507122	REPORT
	https://bugzilla.redhat.com/2513163	REPORT
	https://bugzilla.redhat.com/2513264	REPORT
	https://bugzilla.redhat.com/2516579	REPORT
	https://bugzilla.redhat.com/2517006	REPORT
	https://bugzilla.redhat.com/2521413	REPORT
	https://bugzilla.redhat.com/2528642	REPORT
	https://bugzilla.redhat.com/2532122	REPORT
	https://bugzilla.redhat.com/2535066	REPORT
	https://bugzilla.redhat.com/2540323	REPORT
	https://errata.almalinux.org/10/ALSA-2026-91565.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-abi-stablelists"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-cross-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-doc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt-addons"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libperf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rtla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.69.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.  \n\nSecurity Fix(es):  \n\n  * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)\n  * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)\n  * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)\n  * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)\n  * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)\n  * kernel: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() (CVE-2026-64109)\n  * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)\n  * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)\n  * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)\n  * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)\n  * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)\n  * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631)\n  * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)\n  * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)\n  * kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure (CVE-2026-89777)\n  * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * x86/microcode: Add platform mask to Intel microcode \"old\" list [AlmaLinux-10] [almalinux-10.2.z] (JIRA:AlmaLinux-212778)\n  * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [almalinux-10.2.z] (JIRA:AlmaLinux-245489)\n  * backport fixes for lockdep issues reported with rt-debug [almalinux-10.2.z] (JIRA:AlmaLinux-259937)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:91565",
  "modified": "2026-10-28T13:39:37Z",
  "published": "2026-10-28T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:91565"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53236"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-53388"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63978"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63979"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64027"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64109"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-64523"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68136"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-68338"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-72083"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74515"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-74631"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-80824"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-89638"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-89777"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-93262"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2492709"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502255"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502341"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502376"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502382"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2502615"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2507122"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2513163"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2513264"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2516579"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2517006"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2521413"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2528642"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2532122"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2535066"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2540323"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-91565.html"
    }
  ],
  "related": [
    "CVE-2026-53236",
    "CVE-2026-53388",
    "CVE-2026-63978",
    "CVE-2026-63979",
    "CVE-2026-64027",
    "CVE-2026-64109",
    "CVE-2026-64523",
    "CVE-2026-68136",
    "CVE-2026-68338",
    "CVE-2026-72083",
    "CVE-2026-74515",
    "CVE-2026-74631",
    "CVE-2026-80824",
    "CVE-2026-89638",
    "CVE-2026-89777",
    "CVE-2026-93262"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-53236",
    "CVE-2026-53388",
    "CVE-2026-63978",
    "CVE-2026-63979",
    "CVE-2026-64027",
    "CVE-2026-64109",
    "CVE-2026-64523",
    "CVE-2026-68136",
    "CVE-2026-68338",
    "CVE-2026-72083",
    "CVE-2026-74515",
    "CVE-2026-74631",
    "CVE-2026-80824",
    "CVE-2026-89638",
    "CVE-2026-89777",
    "CVE-2026-93262"
  ]
}

CVE-2026-53236 (GCVE-0-2026-53236)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-10-15 01:22

Title

tcp: restrict SO_ATTACH_FILTER to priv users

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel attack where an unprivileged application attaches a filter to leak TCP sequence/acknowledgment numbers.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/3747de241a66ef2c7…
https://git.kernel.org/stable/c/ecfe9171b26ae3eed…
https://git.kernel.org/stable/c/82b3e7ce10c53fc12…
https://git.kernel.org/stable/c/ede69b8f6670600e5…
https://git.kernel.org/stable/c/c68517a3e18e20997…
https://git.kernel.org/stable/c/5d39580f68e6ddeed…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3747de241a66ef2c7032d2cc2b826a47c5fa0f6a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 82b3e7ce10c53fc12aab8904745603efc74f8c07 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ede69b8f6670600e534591664584f810d7c385f9 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c68517a3e18e20997808821c5559d0cba4d776c1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5d39580f68e6ddeedd15e587282207489dfb3da2 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.7 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.7 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.7",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:22:53.447Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3747de241a66ef2c7032d2cc2b826a47c5fa0f6a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "82b3e7ce10c53fc12aab8904745603efc74f8c07",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ede69b8f6670600e534591664584f810d7c385f9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c68517a3e18e20997808821c5559d0cba4d776c1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5d39580f68e6ddeedd15e587282207489dfb3da2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: restrict SO_ATTACH_FILTER to priv users\n\nThis patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets\nto users with CAP_NET_ADMIN capability.\n\nThis blocks potential side-channel attack where an unprivileged application\nattaches a filter to leak TCP sequence/acknowledgment numbers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:39:33.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3747de241a66ef2c7032d2cc2b826a47c5fa0f6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecfe9171b26ae3eed0cd8bab7a943e9e2c9e51ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/82b3e7ce10c53fc12aab8904745603efc74f8c07"
        },
        {
          "url": "https://git.kernel.org/stable/c/ede69b8f6670600e534591664584f810d7c385f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c68517a3e18e20997808821c5559d0cba4d776c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d39580f68e6ddeedd15e587282207489dfb3da2"
        }
      ],
      "title": "tcp: restrict SO_ATTACH_FILTER to priv users",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53236",
    "datePublished": "2026-06-25T08:39:33.170Z",
    "dateReserved": "2026-06-09T07:44:35.393Z",
    "dateUpdated": "2026-10-15T01:22:53.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53388 (GCVE-0-2026-53388)

Vulnerability from cvelistv5 – Published: 2026-07-19 11:59 – Updated: 2026-10-19 20:07

Title

fuse: re-lock request before replacing page cache folio

Summary

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses the fuse_io_args, leading to use-after-free issues. Fix this by calling lock_request() before replace_page_cache_folio(). This ensures the request is locked on the success path which will prevent the fuse_io_args from being freed while the later copying logic runs, and also ensures that the ap->folios[i]->mapping is never null since ap->folios[i] will always point to the newfolio after replace_page_cache_folio().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:30 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7c18691e0cfda2967…
https://git.kernel.org/stable/c/5927b43a4f8d89e86…
https://git.kernel.org/stable/c/030fe3e9d8abdee30…
https://git.kernel.org/stable/c/46473ddccdc506503…
https://git.kernel.org/stable/c/af2892249d982a1c0…
https://git.kernel.org/stable/c/0223f452532d9cd8a…
https://git.kernel.org/stable/c/e28db6ac4792d065a…
https://git.kernel.org/stable/c/a078484921052d0ba…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 7c18691e0cfda29672f79bafde8abdb7710674f6 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 5927b43a4f8d89e86930f524bf63e9c7e66f61b4 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 030fe3e9d8abdee303dd7e9e42f45082d382a407 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 46473ddccdc5065033e397d6e62c280dbcd3d9c2 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < af2892249d982a1c036ca456cc135374e68b6677 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 0223f452532d9cd8a5e87c45de828fd93c99bd25 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < e28db6ac4792d065ab32565fd9f0a2361c3d4666 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < a078484921052d0badd827fcc2770b5cfc1d4120 (git)
Linux	Linux	Affected: 2.6.35 Unaffected: 0 , < 2.6.35 (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:30:00.282945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:07:45.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c18691e0cfda29672f79bafde8abdb7710674f6",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "5927b43a4f8d89e86930f524bf63e9c7e66f61b4",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "030fe3e9d8abdee303dd7e9e42f45082d382a407",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "46473ddccdc5065033e397d6e62c280dbcd3d9c2",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "af2892249d982a1c036ca456cc135374e68b6677",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "0223f452532d9cd8a5e87c45de828fd93c99bd25",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "e28db6ac4792d065ab32565fd9f0a2361c3d4666",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            },
            {
              "lessThan": "a078484921052d0badd827fcc2770b5cfc1d4120",
              "status": "affected",
              "version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.37",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.14",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before replacing page cache folio\n\nfuse_try_move_folio() unlocks the request on entry but does not\nre-lock it on the success path. This means fuse_chan_abort() can end the\nrequest and free the fuse_io_args (eg fuse_readpages_end()) while the\nsubsequent copy chain logic after fuse_try_move_folio() accesses the\nfuse_io_args, leading to use-after-free issues.\n\nFix this by calling lock_request() before replace_page_cache_folio().\nThis ensures the request is locked on the success path which will\nprevent the fuse_io_args from being freed while the later copying logic\nruns, and also ensures that the ap-\u003efolios[i]-\u003emapping is never null\nsince ap-\u003efolios[i] will always point to the newfolio after\nreplace_page_cache_folio()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker\u0027s own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:39.284Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407"
        },
        {
          "url": "https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677"
        },
        {
          "url": "https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666"
        },
        {
          "url": "https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120"
        }
      ],
      "title": "fuse: re-lock request before replacing page cache folio",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53388",
    "datePublished": "2026-07-19T11:59:34.456Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-10-19T20:07:45.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63978 (GCVE-0-2026-63978)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-10-21 12:42

Title

net/handshake: Drain pending requests at net namespace exit

Summary

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_init() in handshake_net_exit() are reversed. The call moves the local empty "requests" list onto hn->hn_requests, leaving the local list empty, so the subsequent drain loop runs zero iterations. Pending handshake requests that had not yet been accepted are not torn down when the net namespace is destroyed; each one keeps a reference on a socket file and on the handshake_req allocation. Pass the source and destination in the documented order (list_splice_init(list, head) moves list onto head) so the pending list is transferred to the local scratch list and drained through handshake_complete(). Fixing the splice direction exposes a list-corruption race. After the splice each req->hr_list still has non-empty link pointers, threading the stack-local scratch list rather than hn_requests. A concurrent handshake_req_cancel() -- for example, from sunrpc's TLS timeout on a kernel socket whose netns reference was not taken -- finds the request through the rhashtable, calls remove_pending(), and sees !list_empty(&req->hr_list). __remove_pending_locked() then list_del_init()s an entry off the scratch list while the drain iterates, corrupting it. The same call arriving after the drain loop has run list_del() on an entry hits LIST_POISON instead. Have remove_pending() check HANDSHAKE_F_NET_DRAINING under hn_lock and report not-found when drain is in progress. The drain has already taken ownership; handshake_complete()'s existing test_and_set on HANDSHAKE_F_REQ_COMPLETED still arbitrates between drain and cancel for who calls the consumer's hp_done. Use list_del_init() rather than list_del() in the drain so req->hr_list does not carry LIST_POISON after drain releases the entry. The DRAINING guard in remove_pending() makes cancel return false, but cancel still falls through to test_and_set_bit on HANDSHAKE_F_REQ_COMPLETED and drops the request's hr_file reference. Without another pin, if that is the last reference, sk_destruct frees the request while it is still linked on the drain loop's local list. Pin each request's hr_file under hn_lock before releasing the list, and drop that drain pin after the loop finishes with the request.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:34 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/ee4b2ba9d30155f99…
https://git.kernel.org/stable/c/9ec20c9a5a04f2c3f…
https://git.kernel.org/stable/c/2bf24a7e190aae0ea…
https://git.kernel.org/stable/c/8c35539db0ab0bfa1…
https://git.kernel.org/stable/c/ea5fe6a73ca57e515…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < ee4b2ba9d30155f9945811cd3c0c1b06d45787a9 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 2bf24a7e190aae0ea47c78099938ae056c622e44 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 8c35539db0ab0bfa1ea44efab00b053261a69469 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < ea5fe6a73ca57e5150b8a38b341aef2636eb72f0 (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63978",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:34:31.214941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:18:00.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee4b2ba9d30155f9945811cd3c0c1b06d45787a9",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "2bf24a7e190aae0ea47c78099938ae056c622e44",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "8c35539db0ab0bfa1ea44efab00b053261a69469",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "ea5fe6a73ca57e5150b8a38b341aef2636eb72f0",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Drain pending requests at net namespace exit\n\nThe arguments to list_splice_init() in handshake_net_exit() are\nreversed. The call moves the local empty \"requests\" list onto\nhn-\u003ehn_requests, leaving the local list empty, so the subsequent\ndrain loop runs zero iterations. Pending handshake requests that\nhad not yet been accepted are not torn down when the net namespace\nis destroyed; each one keeps a reference on a socket file and on\nthe handshake_req allocation.\n\nPass the source and destination in the documented order\n(list_splice_init(list, head) moves list onto head) so the pending\nlist is transferred to the local scratch list and drained through\nhandshake_complete().\n\nFixing the splice direction exposes a list-corruption race. After\nthe splice each req-\u003ehr_list still has non-empty link pointers,\nthreading the stack-local scratch list rather than hn_requests.\nA concurrent handshake_req_cancel() -- for example, from sunrpc\u0027s\nTLS timeout on a kernel socket whose netns reference was not\ntaken -- finds the request through the rhashtable, calls\nremove_pending(), and sees !list_empty(\u0026req-\u003ehr_list).\n__remove_pending_locked() then list_del_init()s an entry off the\nscratch list while the drain iterates, corrupting it. The same\ncall arriving after the drain loop has run list_del() on an\nentry hits LIST_POISON instead.\n\nHave remove_pending() check HANDSHAKE_F_NET_DRAINING under\nhn_lock and report not-found when drain is in progress. The\ndrain has already taken ownership; handshake_complete()\u0027s existing\ntest_and_set on HANDSHAKE_F_REQ_COMPLETED still arbitrates\nbetween drain and cancel for who calls the consumer\u0027s hp_done. Use\nlist_del_init() rather than list_del() in the drain so req-\u003ehr_list\ndoes not carry LIST_POISON after drain releases the entry.\n\nThe DRAINING guard in remove_pending() makes cancel return false,\nbut cancel still falls through to test_and_set_bit on\nHANDSHAKE_F_REQ_COMPLETED and drops the request\u0027s hr_file reference.\nWithout another pin, if that is the last reference, sk_destruct frees\nthe request while it is still linked on the drain loop\u0027s local list.\nPin each request\u0027s hr_file under hn_lock before releasing the list,\nand drop that drain pin after the loop finishes with the request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Pending handshake requests are created by network-facing kernel TLS consumers (nfsd via `tls_server_hello_x509()` in sunrpc, nvmet-tcp via `tls_server_hello_psk()`), reachable from unauthenticated remote TCP connections before credentials are verified; the bug fires when that namespace is torn down while those requests remain pending.\nAC:L - An attacker can reliably orchestrate the failure by opening TLS connections to leave handshakes pending, then destroying the namespace (user/net namespace or container teardown) and waiting for the predictable sunrpc/NVMe TLS timeout to invoke `handshake_req_cancel()` against freed per-net state.\nPR:N - No server-side privileges are required to reach the vulnerable path\u2014remote peers can initiate the pre-authentication TLS handshake that queues pending requests; namespace teardown is also achievable without init-namespace root via user namespaces granting CAP_SYS_ADMIN.\nUI:N - Exploitation requires no victim interaction beyond the attacker (or orchestrator) initiating connections and namespace lifecycle events; no end-user actions such as mounting filesystems or opening files are needed.\nS:U - Impact is confined to kernel memory corruption and host availability within the same kernel security domain; it does not cross a VM, container sandbox, or IOMMU boundary to affect a separate security authority.\nC:H - Undrained requests leave `handshake_req` objects and freed `handshake_net` state reachable through the global rhashtable; concurrent `handshake_req_cancel()` dereferences freed `hn_lock`/`hn_requests` and can hit LIST_POISON, constituting use-after-free with arbitrary-read potential.\nI:H - The reversed `list_splice_init()` and ensuing drain/cancel races corrupt kernel linked lists and free in-use `handshake_req` structures while still linked, enabling memory corruption exploitable for control-flow hijacking.\nA:H - List corruption and use-after-free on namespace exit or concurrent cancel reliably cause kernel oops/panic or deadlock-class failures, and repeated namespace churn with pending handshakes enables sustained denial of service on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:42:49.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee4b2ba9d30155f9945811cd3c0c1b06d45787a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bf24a7e190aae0ea47c78099938ae056c622e44"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c35539db0ab0bfa1ea44efab00b053261a69469"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea5fe6a73ca57e5150b8a38b341aef2636eb72f0"
        }
      ],
      "title": "net/handshake: Drain pending requests at net namespace exit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63978",
    "datePublished": "2026-07-19T14:56:02.484Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-10-21T12:42:49.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63979 (GCVE-0-2026-63979)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-10-21 12:42

Title

net/handshake: hand off the pinned file reference to accept_doit

Summary

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() then runs sock_orphan(), zeroing sk_socket, and frees the struct socket. The accept-side code either reads NULL through sk_socket or chases freed memory. The submit-side sock_hold() does not prevent this. sk_refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected. Retarget the accept-side dereferences at req->hr_file, which was pinned at submit time, instead of req->hr_sk->sk_socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake_req_next() returning and accept_doit reaching FD_PREPARE() takes the !remove_pending() branch in handshake_req_cancel() and drops hr_file before the accept side takes its own reference. Hand off an additional file reference inside handshake_req_next(), under hn_lock, so the accept side operates on a reference that no concurrent handshake_req_cancel() can revoke. FD_PREPARE() consumes that handed-off reference, either by transferring it to the new fd in fd_publish() or by dropping it in the cleanup destructor on error; the explicit get_file() that previously balanced FD_PREPARE() is therefore redundant and goes away. Update handshake_req_cancel_test2 and _test3 to simulate the FD_PREPARE() consumption with an fput() so the kunit file-count assertions stay balanced.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:34 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/b869e3e4ce1996df2…
https://git.kernel.org/stable/c/2f28dbb30b88eafab…
https://git.kernel.org/stable/c/68eba6519cbd6359f…
https://git.kernel.org/stable/c/c06876d4fac38f358…
https://git.kernel.org/stable/c/f4251190e58b20999…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < b869e3e4ce1996df23b3efdbbe9a64c4ab81d745 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 2f28dbb30b88eafab8d49aaec94710b4e12dea8e (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 68eba6519cbd6359fb554a9720f3a3b6b2eba23f (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < c06876d4fac38f35820946ee3b1be7d7da799cd4 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < f4251190e58b209999c1ba9e6d2976136a1be055 (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:34:33.675009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:18:00.491Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake-test.c",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b869e3e4ce1996df23b3efdbbe9a64c4ab81d745",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "2f28dbb30b88eafab8d49aaec94710b4e12dea8e",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake-test.c",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req-\u003ehr_sk-\u003esk_socket and dereferences sock-\u003efile (once in\nFD_PREPARE() and again in get_file()).  In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock-\u003efile.  sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket.  The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this.  sk_refcnt\nprotects struct sock, but struct socket and sock-\u003efile are\nindependently refcounted via the file descriptor the consumer\nowns.  Pinning sk leaves sock and sock-\u003efile unprotected.\n\nRetarget the accept-side dereferences at req-\u003ehr_file, which was\npinned at submit time, instead of req-\u003ehr_sk-\u003esk_socket-\u003efile.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference.  Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke.  FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is triggered by remote TLS handshake activity on network-facing kernel consumers (nfsd RPC-over-TLS STARTTLS probe, NVMe-oTCP TLS13 connections). A remote peer can initiate handshake_req_submit() and force cancellation via disconnect, while tlshd automatically issues HANDSHAKE_CMD_ACCEPT in response to kernel notifications.\nAC:L - The attacker controls both sides of the race by opening TLS connections and timing disconnects or aborts against tlshd accept processing. Repeated parallel connection attempts make winning the window between handshake_req_next() and FD_PREPARE() practical without conditions outside attacker control.\nPR:N - Exploitation requires no credentials on the target server. NFS RPC_AUTH_TLS uses a NULL-procedure STARTTLS probe before any RPC authentication, and NVMe-oTCP TLS handshakes run at initial connection setup prior to namespace authentication.\nUI:N - No victim interaction is required. The tlshd daemon automatically accepts pending handshake requests upon receiving HANDSHAKE_CMD_READY multicast notifications; the attacker only needs to manipulate connection timing over the network.\nS:U - The vulnerability corrupts kernel heap memory (struct socket/file UAF or NULL dereference through sk_socket) within the kernel\u0027s security authority. It does not cross a VM, container, or IOMMU security boundary.\nC:H - The accept path dereferences sock-\u003efile after sock_release() may free the struct socket and sock_orphan() zeroes sk_socket, constituting a use-after-free. UAF of socket/file structures can be leveraged for arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of the pinned socket file object provides a foundation for heap spraying and arbitrary write primitives to hijack kernel control flow, not merely a bounded or transient modification.\nA:H - The bug manifests as either a NULL pointer dereference through zeroed sk_socket or chasing freed socket memory in FD_PREPARE()/get_file(), both of which cause kernel oops or panic and deny service to the affected host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:42:50.338Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"
        }
      ],
      "title": "net/handshake: hand off the pinned file reference to accept_doit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63979",
    "datePublished": "2026-07-19T14:56:03.177Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-10-21T12:42:50.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64027 (GCVE-0-2026-64027)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-10-19 20:28

Title

net: shaper: rework the VALID marking (again)

Summary

In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant. The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU. Looks like the XArray marks are buying us nothing at this point. Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:35 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/2417df5e7bb4184b9…
https://git.kernel.org/stable/c/96ea960dd40fd5530…
https://git.kernel.org/stable/c/b8d7519352ba8c6df…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 93954b40f6a4fc43226c01a15b02732f884500f1 , < 2417df5e7bb4184b9d3a2988036bf2c46e594545 (git) Affected: 93954b40f6a4fc43226c01a15b02732f884500f1 , < 96ea960dd40fd55302e0fd755176f26a95e6a50c (git) Affected: 93954b40f6a4fc43226c01a15b02732f884500f1 , < b8d7519352ba8c6df83259295d4a3bad093cae90 (git)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:35:31.868695Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:09.258Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/net_shaper.h",
            "net/shaper/shaper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2417df5e7bb4184b9d3a2988036bf2c46e594545",
              "status": "affected",
              "version": "93954b40f6a4fc43226c01a15b02732f884500f1",
              "versionType": "git"
            },
            {
              "lessThan": "96ea960dd40fd55302e0fd755176f26a95e6a50c",
              "status": "affected",
              "version": "93954b40f6a4fc43226c01a15b02732f884500f1",
              "versionType": "git"
            },
            {
              "lessThan": "b8d7519352ba8c6df83259295d4a3bad093cae90",
              "status": "affected",
              "version": "93954b40f6a4fc43226c01a15b02732f884500f1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/net_shaper.h",
            "net/shaper/shaper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: shaper: rework the VALID marking (again)\n\nRecent commit changed the semantics from NOT_VALID to VALID.\nI didn\u0027t realize that the flags are not stored atomically\nwith the entry in XArray. There\u0027s still a race of reader\nobserving a VALID mark for a slot, getting interrupted,\nwriter replacing the entry with a different one, reader\ncontinuing, fetching the entry which is now a different\npointer than the pointer for which VALID was meant.\n\nThe biggest consequence of this is that we may see a UAF\nsince net_shaper_rollback() assumed that entries without\nVALID can be freed without observing RCU.\n\nLooks like the XArray marks are buying us nothing at this\npoint. Let\u0027s convert the code to an explicit valid field.\nThe smp_load_acquire() / smp_store_release() barriers are\nmarginally cleaner."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the net-shaper generic netlink API (socket syscall), not via remote packet handling. This matches the kernel guidance for tc/netlink-style configuration subsystems.\nAC:L - The family sets parallel_ops, so an attacker can run concurrent SET/GROUP/DELETE and GET/dump requests to control both sides of the TOCTOU race. No attacker-uncontrollable memory layout or rare timing is required beyond issuing concurrent netlink operations.\nPR:L - Exploitation requires triggering net_shaper_rollback() via SET, GROUP, or DELETE, which are gated by GENL_ADMIN_PERM (CAP_NET_ADMIN). That capability is available to an unprivileged user inside a user network namespace, not only to init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink messages and requires no victim interaction such as mounting a filesystem or opening a file.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel; it does not cross a VM, container runtime, or IOMMU security boundary by itself.\nC:H - The commit explicitly identifies a use-after-free; concurrent RCU readers can dereference freed net_shaper objects, enabling arbitrary kernel memory disclosure via UAF exploitation.\nI:H - UAF on heap-allocated net_shaper structures can be leveraged for heap grooming and arbitrary write or control-flow hijack, consistent with standard kernel UAF impact.\nA:H - The UAF can cause kernel oops or panic on freed-object access during lookup, dump, or rollback, and matches kernel guidance that any UAF warrants High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:22.063Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2417df5e7bb4184b9d3a2988036bf2c46e594545"
        },
        {
          "url": "https://git.kernel.org/stable/c/96ea960dd40fd55302e0fd755176f26a95e6a50c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8d7519352ba8c6df83259295d4a3bad093cae90"
        }
      ],
      "title": "net: shaper: rework the VALID marking (again)",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64027",
    "datePublished": "2026-07-19T15:39:18.470Z",
    "dateReserved": "2026-07-19T07:54:57.028Z",
    "dateUpdated": "2026-10-19T20:28:09.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64109 (GCVE-0-2026-64109)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-10-19 20:28

Title

af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

Summary

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even if `last` semantically refers to an already-freed SKB while `tail` is a new SKB allocated at the same address; which can cause unix_stream_data_wait() to wrongly keep blocking after new data has arrived, but only in a weird scenario where a peeking recv() and a normal recv() on the same socket are racing, which is probably not a real problem. But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in the following race scenario (where test_setup() runs single-threaded, and afterwards, test_thread1() and test_thread2() run concurrently in two threads: ``` static int socks[2]; void test_setup(void) { socketpair(AF_UNIX, SOCK_STREAM, 0, socks); send(socks[1], "A", 1, 0); int peekoff = 1; setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff)); } void test_thread1(void) { char dummy; recv(socks[0], &dummy, 1, MSG_PEEK); } void test_thread2(void) { char dummy; recv(socks[0], &dummy, 1, 0); shutdown(socks[1], SHUT_WR); } ``` when racing like this: ``` thread1 thread2 unix_stream_read_generic mutex_lock(&u->iolock) skb_peek(&sk->sk_receive_queue) skb_peek_next(skb, &sk->sk_receive_queue) mutex_unlock(&u->iolock) unix_stream_read_generic unix_state_lock(sk) skb_peek(&sk->sk_receive_queue) unix_state_unlock(sk) unix_stream_data_wait unix_state_lock(sk) tail = skb_peek_tail(&sk->sk_receive_queue) spin_lock(&sk->sk_receive_queue.lock) __skb_unlink(skb, &sk->sk_receive_queue) spin_unlock(&sk->sk_receive_queue.lock) consume_skb(skb) [frees the SKB] `tail != last`: false `tail`: true `tail->len != last_len` ***UAF*** ``` Fix the UAF by removing the read of tail->len; checking tail->len would only make sense if SKBs in the receive queue of a UNIX socket could grow, which can no longer happen. Kuniyuki explained: > When commit 869e7c62486e ("net: af_unix: implement stream sendpage > support") added sendpage() support, data could be appended to the last > skb in the receiver's queue. > > That's why we needed to check if the length of the last skb was changed > while waiting for new data in unix_stream_data_wait(). > > However, commit a0dbf5f818f9 ("af_unix: Support MSG_SPLICE_PAGES") and > commit 57d44a354a43 ("unix: Convert unix_stream_sendpage() to use > MSG_SPLICE_PAGES") refactored sendmsg(), and now data is always added > to a new skb. That means this fix is not suitable for kernels before 6.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:36 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/26342087fac93b393…
https://git.kernel.org/stable/c/38bccb927d83d7d52…
https://git.kernel.org/stable/c/acdff9907478e8220…
https://git.kernel.org/stable/c/5f162f95a95834f06…
https://git.kernel.org/stable/c/be309f8eae8b474a4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < 26342087fac93b3932e6af61dc91ec029cb8a623 (git) Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < 38bccb927d83d7d52e5b20015a172a0b6101d11e (git) Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < acdff9907478e82208475b1151700d0b71dcdc63 (git) Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < 5f162f95a95834f06a8ec6140889272ad12e842f (git) Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < be309f8eae8b474a4a617eaae01324da996fc719 (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64109",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:36:24.265690Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:28:12.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26342087fac93b3932e6af61dc91ec029cb8a623",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "38bccb927d83d7d52e5b20015a172a0b6101d11e",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "acdff9907478e82208475b1151700d0b71dcdc63",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "5f162f95a95834f06a8ec6140889272ad12e842f",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "be309f8eae8b474a4a617eaae01324da996fc719",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\nunix_stream_data_wait() does skb_peek_tail(\u0026sk-\u003esk_receive_queue) without\nholding any lock that prevents SKBs on that queue from being dequeued and\nfreed.\nThis has been the case since commit 79f632c71bea (\"unix/stream: fix\npeeking with an offset larger than data in queue\").\nThe first consequence of this is that the pointer comparison\n`tail != last` can be false even if `last` semantically refers to an\nalready-freed SKB while `tail` is a new SKB allocated at the same address;\nwhich can cause unix_stream_data_wait() to wrongly keep blocking after new\ndata has arrived, but only in a weird scenario where a peeking recv() and\na normal recv() on the same socket are racing, which is probably not a\nreal problem.\n\nBut since commit 2b514574f7e8 (\"net: af_unix: implement splice for stream\naf_unix sockets\"), `tail` is actually dereferenced, which can cause UAF in\nthe following race scenario (where test_setup() runs single-threaded,\nand afterwards, test_thread1() and test_thread2() run concurrently in\ntwo threads:\n```\nstatic int socks[2];\nvoid test_setup(void) {\n  socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\n  send(socks[1], \"A\", 1, 0);\n  int peekoff = 1;\n  setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, \u0026peekoff, sizeof(peekoff));\n}\nvoid test_thread1(void) {\n  char dummy;\n  recv(socks[0], \u0026dummy, 1, MSG_PEEK);\n}\nvoid test_thread2(void) {\n  char dummy;\n  recv(socks[0], \u0026dummy, 1, 0);\n  shutdown(socks[1], SHUT_WR);\n}\n```\n\nwhen racing like this:\n```\nthread1                       thread2\nunix_stream_read_generic\n  mutex_lock(\u0026u-\u003eiolock)\n  skb_peek(\u0026sk-\u003esk_receive_queue)\n  skb_peek_next(skb, \u0026sk-\u003esk_receive_queue)\n  mutex_unlock(\u0026u-\u003eiolock)\n                              unix_stream_read_generic\n                                unix_state_lock(sk)\n                                skb_peek(\u0026sk-\u003esk_receive_queue)\n                                unix_state_unlock(sk)\n  unix_stream_data_wait\n    unix_state_lock(sk)\n    tail = skb_peek_tail(\u0026sk-\u003esk_receive_queue)\n                                spin_lock(\u0026sk-\u003esk_receive_queue.lock)\n                                __skb_unlink(skb, \u0026sk-\u003esk_receive_queue)\n                                spin_unlock(\u0026sk-\u003esk_receive_queue.lock)\n                                consume_skb(skb) [frees the SKB]\n    `tail != last`: false\n    `tail`: true\n    `tail-\u003elen != last_len` ***UAF***\n```\n\nFix the UAF by removing the read of tail-\u003elen; checking tail-\u003elen would\nonly make sense if SKBs in the receive queue of a UNIX socket could grow,\nwhich can no longer happen.\n\nKuniyuki explained:\n\n\u003e When commit 869e7c62486e (\"net: af_unix: implement stream sendpage\n\u003e support\") added sendpage() support, data could be appended to the last\n\u003e skb in the receiver\u0027s queue.\n\u003e\n\u003e That\u0027s why we needed to check if the length of the last skb was changed\n\u003e while waiting for new data in unix_stream_data_wait().\n\u003e\n\u003e However, commit a0dbf5f818f9 (\"af_unix: Support MSG_SPLICE_PAGES\") and\n\u003e commit 57d44a354a43 (\"unix: Convert unix_stream_sendpage() to use\n\u003e MSG_SPLICE_PAGES\") refactored sendmsg(), and now data is always added\n\u003e to a new skb.\n\nThat means this fix is not suitable for kernels before 6.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff-\u003elen on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:18.983Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623"
        },
        {
          "url": "https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f"
        },
        {
          "url": "https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"
        }
      ],
      "title": "af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64109",
    "datePublished": "2026-07-19T15:40:11.510Z",
    "dateReserved": "2026-07-19T07:54:57.034Z",
    "dateUpdated": "2026-10-19T20:28:12.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64523 (GCVE-0-2026-64523)

Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-10-21 12:43

Title

net/handshake: Take a long-lived file reference at submit

Summary

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:41 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/22e371a93563c30eb…
https://git.kernel.org/stable/c/685b10dd0e32c7782…
https://git.kernel.org/stable/c/b913801ad9b9a5143…
https://git.kernel.org/stable/c/16eaba5aa89c04eea…
https://git.kernel.org/stable/c/09dba37eee70d0596…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 22e371a93563c30ebebc576db049785e0d7fc617 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 685b10dd0e32c7782cead16c8cf055c609678583 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < b913801ad9b9a51437d84d030ec6843e08976bd6 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 16eaba5aa89c04eea125905bb8f988c1897f4f29 (git) Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 09dba37eee70d0596e26645015f1aa95a9848e9d (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64523",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:41:36.840538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:48:37.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake.h",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22e371a93563c30ebebc576db049785e0d7fc617",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "685b10dd0e32c7782cead16c8cf055c609678583",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "b913801ad9b9a51437d84d030ec6843e08976bd6",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "16eaba5aa89c04eea125905bb8f988c1897f4f29",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "09dba37eee70d0596e26645015f1aa95a9848e9d",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake.h",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Take a long-lived file reference at submit\n\nhandshake_nl_accept_doit() needs the file pointer backing\nreq-\u003ehr_sk-\u003esk_socket to survive the window between\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\nThe submit-side sock_hold() does not provide that.  sk_refcnt keeps\nstruct sock alive, but struct socket is owned by sock-\u003efile: when\nthe consumer fputs the last file reference, sock_release() tears\nthe socket down regardless of any sock_hold.\n\nAdd an hr_file pointer to struct handshake_req and acquire an\nexplicit reference on sock-\u003efile during handshake_req_submit().\nhandshake_complete() and handshake_req_cancel() release the\nreference on the completion-bit-winning path.\n\nThe submit error path must also release the file reference, but\nafter rhashtable insertion a concurrent handshake_req_cancel() can\ndiscover the request and race the error path.  Gate the error-path\ncleanup -- sk_destruct restoration, fput, and request destruction\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\nserialization handshake_complete() and handshake_req_cancel()\nalready use.  When cancel has already claimed ownership, the submit\nerror path returns without touching the request; socket teardown\nhandles final destruction.\n\nThe accept-side dereferences are not yet retargeted; that change\ncomes in the next patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An unauthenticated remote peer can make network-facing NFS/RPC-over-TLS or TLS-enabled NVMe/TCP consumers submit a handshake, then disconnect or force timeout while tlshd accepts it.\nAC:L - Connection churn lets the attacker repeatedly create handshake requests and drive cancellation while the normal agent accepts; no secret state or uncontrollable memory layout is required.\nPR:N - The RPC_AUTH_TLS probe and NVMe/TCP TLS setup occur before peer authentication. ACCEPT requires init-namespace CAP_NET_ADMIN, but trusted tlshd issues it automatically rather than the attacker.\nUI:N - Kernel consumers and the handshake daemon process the request automatically without any victim user action.\nS:U - Exploitation compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The race can dereference reclaimed socket, file, or handshake-request memory; heap reuse of this UAF can provide access to arbitrary kernel data.\nI:H - The stale file pointer reaches refcount-writing operations such as get_file(), while reclaimed request data includes callback pointers, making arbitrary writes or control-flow hijacking defensible.\nA:H - The NULL dereference or use-after-free can cause a kernel oops or panic, and a remote attacker can trigger the race repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:43:25.473Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22e371a93563c30ebebc576db049785e0d7fc617"
        },
        {
          "url": "https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583"
        },
        {
          "url": "https://git.kernel.org/stable/c/b913801ad9b9a51437d84d030ec6843e08976bd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29"
        },
        {
          "url": "https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d"
        }
      ],
      "title": "net/handshake: Take a long-lived file reference at submit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64523",
    "datePublished": "2026-07-25T09:20:47.606Z",
    "dateReserved": "2026-07-19T15:36:31.794Z",
    "dateUpdated": "2026-10-21T12:43:25.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68136 (GCVE-0-2026-68136)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-10-19 20:58

Title

net: gro: fix double aggregation of flush-marked skbs

Summary

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation. As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be re-aggregated. This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO session, corrupting the frag_list chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic. Scenario (Tethering/Device forwarding): 1. Driver: Generated aggregated packet P1 via LRO with frag_list 2. Dev A: Receives aggregated fraglist packet and flush flag set 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called 4. Missing flush check allows re-aggregation despite flush flag 5. Frag_list chain becomes corrupted (loops or dangling refs) 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list Root cause in skb_segment(): The check at line ~4891: if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) && (skb_headlen(list_skb) == len || sg)) { When frag_list is corrupted by double aggregation, when list_skb is a NULL pointer from skb->next, skb_headlen(list_skb) dereference NULL/corrupted pointers occurs. Call Trace: skb_headlen(NULL skb) skb_segment tcp_gso_segment tcp4_gso_segment inet_gso_segment skb_mac_gso_segment __skb_gso_segment skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit qdisc_restart __qdisc_run qdisc_run net_tx_action Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in skb_gro_receive_list(), matching the defensive programming pattern of skb_gro_receive().

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:44 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/7fc7e35212cf58c13…
https://git.kernel.org/stable/c/d1fb23f8f794ac468…
https://git.kernel.org/stable/c/db3e82da616f52e2b…
https://git.kernel.org/stable/c/107e1a469f53a2a70…
https://git.kernel.org/stable/c/a4dfd46cc8f08a29c…
https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d…
https://git.kernel.org/stable/c/e751256486d0ded20…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < 7fc7e35212cf58c134310fb47566a844297ceae9 (git) Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < d1fb23f8f794ac4683127bd49a6422bd87e0ac02 (git) Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < db3e82da616f52e2b27e25e7be3fde2f2a5e54d6 (git) Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < 107e1a469f53a2a70874f3f12bf6fcd23925da1d (git) Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < a4dfd46cc8f08a29c6183794790547d0945f3d45 (git) Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0 (git) Affected: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 , < e751256486d0ded20f5a9f9863467f1dce65142f (git)
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:44:29.127961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:52.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7fc7e35212cf58c134310fb47566a844297ceae9",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            },
            {
              "lessThan": "d1fb23f8f794ac4683127bd49a6422bd87e0ac02",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            },
            {
              "lessThan": "db3e82da616f52e2b27e25e7be3fde2f2a5e54d6",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            },
            {
              "lessThan": "107e1a469f53a2a70874f3f12bf6fcd23925da1d",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            },
            {
              "lessThan": "a4dfd46cc8f08a29c6183794790547d0945f3d45",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            },
            {
              "lessThan": "fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            },
            {
              "lessThan": "e751256486d0ded20f5a9f9863467f1dce65142f",
              "status": "affected",
              "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix double aggregation of flush-marked skbs\n\nCommit 0ab03f353d36 (\"net-gro: Fix GRO flush when receiving a GSO\npacket.\") added a flush check to skb_gro_receive(), but\nskb_gro_receive_list() lacks the same validation.\n\nAs a result, packets marked with NAPI_GRO_CB(skb)-\u003eflush may still be\nre-aggregated.\n\nThis allows already-GRO\u0027d packets with existing frag_list to be\nre-aggregated into a new GRO session, corrupting the frag_list chain\nstructure. When skb_segment() attempts to unpack these malformed packets,\nit encounters invalid state and triggers a kernel panic.\n\nScenario (Tethering/Device forwarding):\n  1. Driver: Generated aggregated packet P1 via LRO with frag_list\n  2. Dev A: Receives aggregated fraglist packet and flush flag set\n  3. Dev A: Re-enters GRO, skb_gro_receive_list() is called\n  4. Missing flush check allows re-aggregation despite flush flag\n  5. Frag_list chain becomes corrupted (loops or dangling refs)\n  6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list\n\nRoot cause in skb_segment():\n  The check at line ~4891:\n    if (hsize \u003c= 0 \u0026\u0026 i \u003e= nfrags \u0026\u0026 skb_headlen(list_skb) \u0026\u0026\n        (skb_headlen(list_skb) == len || sg)) {\n\n  When frag_list is corrupted by double aggregation, when list_skb is\n  a NULL pointer from skb-\u003enext, skb_headlen(list_skb) dereference\n  NULL/corrupted pointers occurs.\n\nCall Trace:\n skb_headlen(NULL skb)\n skb_segment\n tcp_gso_segment\n tcp4_gso_segment\n inet_gso_segment\n skb_mac_gso_segment\n __skb_gso_segment\n skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n qdisc_restart\n __qdisc_run\n qdisc_run\n net_tx_action\n\nFix: Add NAPI_GRO_CB(skb)-\u003eflush validation to the early-return check in\nskb_gro_receive_list(), matching the defensive programming pattern of\nskb_gro_receive()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive\u2192dev_gro_receive\u2192tcp_gro_receive\u2192skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:54.689Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02"
        },
        {
          "url": "https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f"
        }
      ],
      "title": "net: gro: fix double aggregation of flush-marked skbs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68136",
    "datePublished": "2026-08-10T11:58:59.450Z",
    "dateReserved": "2026-07-30T09:28:09.370Z",
    "dateUpdated": "2026-10-19T20:58:52.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68338 (GCVE-0-2026-68338)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-10-19 21:09

Title

net/packet: avoid fanout hook re-registration after unregister

Summary

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po->num, unregisters the protocol hook when needed, drops po->bind_lock, and later restores po->num and re-registers the hook from the saved was_running value. That unlocked window can race with NETDEV_UNREGISTER. The notifier can observe the socket as not running, skip __unregister_prot_hook(), and invalidate the per-socket binding by setting po->ifindex to -1 and clearing po->prot_hook.dev. A one-member fanout group can still retain its shared fanout hook device pointer. When packet_set_ring() resumes, re-registering solely from the stale was_running state can re-add the fanout hook after the device has been unregistered. Treat po->ifindex == -1 as an invalidated binding after reacquiring po->bind_lock. This is distinct from ifindex 0, the normal unbound/wildcard state: ifindex -1 marks an existing device binding that was invalidated when the device was unregistered. Restore po->num as before, but do not re-register the hook if device unregister already detached the socket.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:47 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/acb40ebfa5c4d62f8…
https://git.kernel.org/stable/c/c820f4b7f2fa38f87…
https://git.kernel.org/stable/c/4628efbdc7affd094…
https://git.kernel.org/stable/c/80ec024d53a05c60a…
https://git.kernel.org/stable/c/0a052e0808e015e68…
https://git.kernel.org/stable/c/1bc55c29cd85818e9…
https://git.kernel.org/stable/c/a885387dae7986a55…
https://git.kernel.org/stable/c/50aff80475abd3533…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < acb40ebfa5c4d62f84339fcbf713f2a9fd033a71 (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < c820f4b7f2fa38f8769db0d0cefdd94e2721504d (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < 4628efbdc7affd094181f5263e65c1062e31f15f (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < 80ec024d53a05c60ad1d08968dcf745f10c1665c (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < 0a052e0808e015e68144a9877e6ef42b952c49fa (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < 1bc55c29cd85818e9052f17deb287d5a11fb817f (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < a885387dae7986a55bae5c77a15bdd447f64e9b9 (git) Affected: dc99f600698dcac69b8f56dda9a8a00d645c5ffc , < 50aff80475abd3533eef4320477037e6fcc6b56e (git)
Linux	Linux	Affected: 3.1 Unaffected: 0 , < 3.1 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68338",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:47:16.591778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:05.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "acb40ebfa5c4d62f84339fcbf713f2a9fd033a71",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "c820f4b7f2fa38f8769db0d0cefdd94e2721504d",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "4628efbdc7affd094181f5263e65c1062e31f15f",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "80ec024d53a05c60ad1d08968dcf745f10c1665c",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "0a052e0808e015e68144a9877e6ef42b952c49fa",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "1bc55c29cd85818e9052f17deb287d5a11fb817f",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "a885387dae7986a55bae5c77a15bdd447f64e9b9",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            },
            {
              "lessThan": "50aff80475abd3533eef4320477037e6fcc6b56e",
              "status": "affected",
              "version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: avoid fanout hook re-registration after unregister\n\npacket_set_ring() temporarily detaches a socket from packet delivery while\nreconfiguring its ring. It records the previous running state, clears\npo-\u003enum, unregisters the protocol hook when needed, drops po-\u003ebind_lock,\nand later restores po-\u003enum and re-registers the hook from the saved\nwas_running value.\n\nThat unlocked window can race with NETDEV_UNREGISTER. The notifier can\nobserve the socket as not running, skip __unregister_prot_hook(), and\ninvalidate the per-socket binding by setting po-\u003eifindex to -1 and clearing\npo-\u003eprot_hook.dev. A one-member fanout group can still retain its shared\nfanout hook device pointer. When packet_set_ring() resumes, re-registering\nsolely from the stale was_running state can re-add the fanout hook after\nthe device has been unregistered.\n\nTreat po-\u003eifindex == -1 as an invalidated binding after reacquiring\npo-\u003ebind_lock. This is distinct from ifindex 0, the normal\nunbound/wildcard state: ifindex -1 marks an existing device binding that\nwas invalidated when the device was unregistered. Restore po-\u003enum as\nbefore, but do not re-register the hook if device unregister already\ndetached the socket."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through local syscalls \u2014 creating an AF_PACKET socket, PACKET_FANOUT/bind setsockopt, PACKET_RX_RING setsockopt, and a netlink device unregister \u2014 with no remote packet processing involved.\nAC:L - The attacker controls both sides of the race: it issues the packet_set_ring() reconfiguration and deletes the bound netdev in its own netns, and the unlocked window spans synchronize_net() plus the ring swap, making it wide and reliably winnable.\nPR:L - AF_PACKET requires CAP_NET_RAW and device unregistration CAP_NET_ADMIN, but an unprivileged user obtains both via user+network namespaces (unshare -Urn) and can create and delete veth/dummy devices there.\nUI:N - The attacker performs every step itself \u2014 socket setup, ring reconfiguration and device teardown \u2014 with no action required from any other user.\nS:U - The stale hook registration and resulting corruption stay within the kernel\u0027s own security authority; no hypervisor, IOMMU or other trust boundary is crossed.\nC:H - The fanout packet_type is left linked into a net_device that is being torn down, a dangling registration on soon-to-be-freed memory; such stale-pointer state in the ptype lists can be leveraged for kernel memory disclosure.\nI:H - The dangling list node in the freed net_device\u0027s ptype list yields a list_del write into freed memory when the hook is later removed, a controllable write primitive typical of use-after-free exploitation.\nA:H - The re-added hook makes netdev_run_todo() hit BUG_ON(!list_empty(\u0026dev-\u003eptype_all)) while RTNL is held, oopsing the kernel and permanently wedging all further network configuration \u2014 a repeatable, unprivileged host-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:38.308Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/acb40ebfa5c4d62f84339fcbf713f2a9fd033a71"
        },
        {
          "url": "https://git.kernel.org/stable/c/c820f4b7f2fa38f8769db0d0cefdd94e2721504d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4628efbdc7affd094181f5263e65c1062e31f15f"
        },
        {
          "url": "https://git.kernel.org/stable/c/80ec024d53a05c60ad1d08968dcf745f10c1665c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a052e0808e015e68144a9877e6ef42b952c49fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bc55c29cd85818e9052f17deb287d5a11fb817f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a885387dae7986a55bae5c77a15bdd447f64e9b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/50aff80475abd3533eef4320477037e6fcc6b56e"
        }
      ],
      "title": "net/packet: avoid fanout hook re-registration after unregister",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68338",
    "datePublished": "2026-08-10T12:03:14.549Z",
    "dateReserved": "2026-07-30T09:28:09.384Z",
    "dateUpdated": "2026-10-19T21:09:05.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72083 (GCVE-0-2026-72083)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-10-19 21:19

Title

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() and parses the destination TransportID with target_parse_pr_out_transport_id(). For an iSCSI TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns the ISID in iport_ptr as a raw pointer into that mapped buffer. The function then unmaps the buffer with transport_kunmap_data_sg() before dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and core_scsi3_alloc_registration(). When the parameter list spans more than one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual address backing iport_ptr is torn down and every subsequent dereference is a use-after-free read of the unmapped region. Keep the parameter list mapped until iport_ptr is no longer needed: drop the early transport_kunmap_data_sg() and unmap once on the success path, right before returning. The error paths already unmap through the existing "if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs on every post-map error exit because buf is no longer cleared early. Only reads of the mapping happen while spinlocks are held; the map and unmap calls remain outside any lock. The sibling caller core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it and is left unchanged.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:51 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7d56f5c868d92c9d5…
https://git.kernel.org/stable/c/59a2a5a37dc49a641…
https://git.kernel.org/stable/c/9f8076cc73dfa6b10…
https://git.kernel.org/stable/c/a040004846f1fbe68…
https://git.kernel.org/stable/c/05b3e37433cf2eaf8…
https://git.kernel.org/stable/c/cb7bdae7fba404852…
https://git.kernel.org/stable/c/ef2ee18fec92088c7…
https://git.kernel.org/stable/c/fda6a1f3c3d7047b5…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < 7d56f5c868d92c9d504a34a3ea450bce481c7f63 (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < 59a2a5a37dc49a641ad6bc64aee34e5a61025ffd (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < 9f8076cc73dfa6b10155978c160587e986b22169 (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < a040004846f1fbe687f6ec76d9ccc27b4ead42e4 (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < 05b3e37433cf2eaf8867f1c16528aa347bb212ab (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < cb7bdae7fba404852ade34b0c1445fbaf3e54fbb (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < ef2ee18fec92088c7d8877baf7674e89389ccd66 (git) Affected: 4949314c7283ea4f9ade182ca599583b89f7edd6 , < fda6a1f3c3d7047b5ce5654487649c2daa738bfc (git) Affected: d2227f84ba0e97906153ac83db13213fb2e3938d (git) Affected: 3.2.9 , < 3.3 (semver)
Linux	Linux	Affected: 3.3 Unaffected: 0 , < 3.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:51:39.405960Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:26.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_pr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d56f5c868d92c9d504a34a3ea450bce481c7f63",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "59a2a5a37dc49a641ad6bc64aee34e5a61025ffd",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "9f8076cc73dfa6b10155978c160587e986b22169",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "a040004846f1fbe687f6ec76d9ccc27b4ead42e4",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "05b3e37433cf2eaf8867f1c16528aa347bb212ab",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "cb7bdae7fba404852ade34b0c1445fbaf3e54fbb",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "ef2ee18fec92088c7d8877baf7674e89389ccd66",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "lessThan": "fda6a1f3c3d7047b5ce5654487649c2daa738bfc",
              "status": "affected",
              "version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2227f84ba0e97906153ac83db13213fb2e3938d",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_pr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH \u003e 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()\u2192target_execute_cmd()\u2192target_scsi3_emulate_pr_out()\u2192core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (\u003e4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed\u2014only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted \u003e4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:05.325Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63"
        },
        {
          "url": "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169"
        },
        {
          "url": "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc"
        }
      ],
      "title": "scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72083",
    "datePublished": "2026-08-15T05:52:32.045Z",
    "dateReserved": "2026-08-09T03:40:39.904Z",
    "dateUpdated": "2026-10-19T21:19:26.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:91565 (CVE-2026-53236)

CVE-2026-53236 (GCVE-0-2026-53236)

CVE-2026-53388 (GCVE-0-2026-53388)

CVE-2026-63978 (GCVE-0-2026-63978)

CVE-2026-63979 (GCVE-0-2026-63979)

CVE-2026-64027 (GCVE-0-2026-64027)

CVE-2026-64109 (GCVE-0-2026-64109)

CVE-2026-64523 (GCVE-0-2026-64523)

CVE-2026-68136 (GCVE-0-2026-68136)

CVE-2026-68338 (GCVE-0-2026-68338)

CVE-2026-72083 (GCVE-0-2026-72083)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour