{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T15:04:34.814514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T15:04:50.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:20.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d06977b9a4109f8738bb276125eb6a0b772bc433"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8bf7c76a2a207ca2b4cfda0a279192adf27678d7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2471d271042ea18e8a6babc132a8716bb2f08b9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf366ee3bc1b7d1c76a882640ba3b3f8f1039163"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/87b3593bed1868b2d9fe096c01bcdf0ea86cbebf"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h",
            "net/netfilter/nf_flow_table_inet.c",
            "net/netfilter/nf_flow_table_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d06977b9a4109f8738bb276125eb6a0b772bc433",
              "status": "affected",
              "version": "72efd585f7144a047f7da63864284764596ccad9",
              "versionType": "git"
            },
            {
              "lessThan": "8bf7c76a2a207ca2b4cfda0a279192adf27678d7",
              "status": "affected",
              "version": "72efd585f7144a047f7da63864284764596ccad9",
              "versionType": "git"
            },
            {
              "lessThan": "a2471d271042ea18e8a6babc132a8716bb2f08b9",
              "status": "affected",
              "version": "72efd585f7144a047f7da63864284764596ccad9",
              "versionType": "git"
            },
            {
              "lessThan": "cf366ee3bc1b7d1c76a882640ba3b3f8f1039163",
              "status": "affected",
              "version": "72efd585f7144a047f7da63864284764596ccad9",
              "versionType": "git"
            },
            {
              "lessThan": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "status": "affected",
              "version": "72efd585f7144a047f7da63864284764596ccad9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h",
            "net/netfilter/nf_flow_table_inet.c",
            "net/netfilter/nf_flow_table_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: validate pppoe header\n\nEnsure there is sufficient room to access the protocol field of the\nPPPoe header. Validate it once before the flowtable lookup, then use a\nhelper function to access protocol field."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code is the netfilter flowtable NF_NETDEV_INGRESS hook, reached purely by receiving an Ethernet frame with ethertype 0x8864 (ETH_P_PPP_SES); PPPoE session frames are a link-layer encapsulation and are not routable across L3, so the attacker must be on the same L2 segment (ISP access network of a PPPoE CPE, the router LAN, or a bridged VM/tap network).\nAC:L - The attacker simply emits a truncated PPPoE session frame carrying fewer than 8 bytes past the Ethernet header \u2014 there is no race, no memory-layout dependency, and no state the attacker cannot create, since tap/virtio, veth, and L2-tunnel decap paths impose no minimum-frame padding and can be triggered repeatedly at will.\nPR:N - No credentials or privileges on the target are needed \u2014 the flowtable ingress hook processes every received frame before any authentication, and the nftables flowtable configuration is the victim admin\u0027s normal router/offload setup, not an attacker prerequisite.\nUI:N - The out-of-bounds read happens automatically in softirq packet-receive context as soon as the crafted frame arrives on the flowtable-bound interface; no action by any local user or administrator is required.\nS:U - The out-of-bounds read and its consequences are confined to the kernel\u0027s own memory and the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - The bug reads 2 bytes of adjacent kernel heap memory beyond the packet buffer, but the read is strictly bounded to a fixed offset and the value is only compared against PPP_IP/PPP_IPV6, giving at most a weak fast-path-versus-slow-path oracle rather than a general memory-disclosure primitive.\nI:N - The defect is a read-only over-read; no kernel memory is written, and the misclassified packet\u0027s subsequent handling is re-validated by pskb_may_pull() in nf_flow_tuple_ip() before any header mangling occurs.\nA:H - The slab-out-of-bounds read is a KASAN-detectable memory-safety violation that panics debug/hardened kernels and can fault when the skb head abuts an unmapped region, and it is triggerable remotely, repeatedly, and without authentication on every arriving frame."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:59.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d06977b9a4109f8738bb276125eb6a0b772bc433"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bf7c76a2a207ca2b4cfda0a279192adf27678d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2471d271042ea18e8a6babc132a8716bb2f08b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf366ee3bc1b7d1c76a882640ba3b3f8f1039163"
        },
        {
          "url": "https://git.kernel.org/stable/c/87b3593bed1868b2d9fe096c01bcdf0ea86cbebf"
        }
      ],
      "title": "netfilter: flowtable: validate pppoe header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27016",
    "datePublished": "2024-05-01T05:29:57.099Z",
    "dateReserved": "2024-02-19T14:20:24.209Z",
    "dateUpdated": "2026-08-05T11:28:59.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T17:22:22.725918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:46:18.755Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:28.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_input.c",
            "net/bridge/br_netfilter_hooks.c",
            "net/bridge/br_private.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dceb683ab87ca3666a9bb5c0158528b646faedc4",
              "status": "affected",
              "version": "7c3f28599652acf431a2211168de4a583f30b6d5",
              "versionType": "git"
            },
            {
              "lessThan": "b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6",
              "status": "affected",
              "version": "2b1414d5e94e477edff1d2c79030f1d742625ea0",
              "versionType": "git"
            },
            {
              "lessThan": "3f59ac29dea0921637053908fe99268d157bbb9d",
              "status": "affected",
              "version": "80cd0487f630b5382734997c3e5e3003a77db315",
              "versionType": "git"
            },
            {
              "lessThan": "43193174510ea4f3ce09b796e559a2fd9f148615",
              "status": "affected",
              "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
              "versionType": "git"
            },
            {
              "lessThan": "751de2012eafa4d46d8081056761fa0e9cc8a178",
              "status": "affected",
              "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb734975b0ffa688ff6cc0eed463865bf07b6c01",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.157",
              "status": "affected",
              "version": "5.15.151",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.88",
              "status": "affected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.29",
              "status": "affected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_input.c",
            "net/bridge/br_netfilter_hooks.c",
            "net/bridge/br_private.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "5.15.151",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "6.1.81",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: skip conntrack input hook for promisc packets\n\nFor historical reasons, when bridge device is in promisc mode, packets\nthat are directed to the taps follow bridge input hook path. This patch\nadds a workaround to reset conntrack for these packets.\n\nJianbo Liu reports warning splats in their test infrastructure where\ncloned packets reach the br_netfilter input hook to confirm the\nconntrack object.\n\nScratch one bit from BR_INPUT_SKB_CB to annotate that this packet has\nreached the input hook because it is passed up to the bridge device to\nreach the taps.\n\n[   57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter]\n[   57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core\n[   57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19\n[   57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[   57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter]\n[   57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 \u003c0f\u003e 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1\n[   57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202\n[   57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000\n[   57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000\n[   57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003\n[   57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000\n[   57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800\n[   57.582313] FS:  0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000\n[   57.583040] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0\n[   57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[   57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[   57.585440] Call Trace:\n[   57.585721]  \u003cIRQ\u003e\n[   57.585976]  ? __warn+0x7d/0x130\n[   57.586323]  ? br_nf_local_in+0x157/0x180 [br_netfilter]\n[   57.586811]  ? report_bug+0xf1/0x1c0\n[   57.587177]  ? handle_bug+0x3f/0x70\n[   57.587539]  ? exc_invalid_op+0x13/0x60\n[   57.587929]  ? asm_exc_invalid_op+0x16/0x20\n[   57.588336]  ? br_nf_local_in+0x157/0x180 [br_netfilter]\n[   57.588825]  nf_hook_slow+0x3d/0xd0\n[   57.589188]  ? br_handle_vlan+0x4b/0x110\n[   57.589579]  br_pass_frame_up+0xfc/0x150\n[   57.589970]  ? br_port_flags_change+0x40/0x40\n[   57.590396]  br_handle_frame_finish+0x346/0x5e0\n[   57.590837]  ? ipt_do_table+0x32e/0x430\n[   57.591221]  ? br_handle_local_finish+0x20/0x20\n[   57.591656]  br_nf_hook_thresh+0x4b/0xf0 [br_netfilter]\n[   57.592286]  ? br_handle_local_finish+0x20/0x20\n[   57.592802]  br_nf_pre_routing_finish+0x178/0x480 [br_netfilter]\n[   57.593348]  ? br_handle_local_finish+0x20/0x20\n[   57.593782]  ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat]\n[   57.594279]  br_nf_pre_routing+0x24c/0x550 [br_netfilter]\n[   57.594780]  ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter]\n[   57.595280]  br_handle_frame+0x1f3/0x3d0\n[   57.595676]  ? br_handle_local_finish+0x20/0x20\n[   57.596118]  ? br_handle_frame_finish+0x5e0/0x5e0\n[   57.596566]  __netif_receive_skb_core+0x25b/0xfc0\n[   57.597017]  ? __napi_build_skb+0x37/0x40\n[   57.597418]  __netif_receive_skb_list_core+0xfb/0x220"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The defect is in the bridge receive path (net/bridge/br_input.c \u2192 br_nf_local_in), driven purely by received frames and their IP/L4 content, which determines the conntrack tuple; on a bridging VM/container host any remote sender\u0027s packets routed to a bridged guest arrive with pkt_type != PACKET_HOST and take this exact path. No authentication, session, or local access is needed \u2014 only the ability to get packets to a bridged endpoint.\nAC:L - Once the bridge device is in promiscuous mode (set automatically by macvlan/macvtap on top of br0, or by any tap/tcpdump \u2014 the reporter\u0027s own routine test setup), every frame crossing the bridge deterministically reaches br_pass_frame_up() and the conntrack confirm hook; the attacker wins no race and needs no special memory layout. br_netfilter + conntrack + bridging is the default configuration on Docker/Kubernetes/libvirt hosts, not a rare option.\nPR:N - The path runs in softirq context on packet receive with no capability, credential, or authentication check anywhere between the NIC and br_nf_local_in(). An unauthenticated sender is sufficient; the alternative local route via unprivileged user namespaces would only be PR:L, so None is the correct broader value.\nUI:N - Triggering requires only that the attacker transmit frames that traverse the bridge; no administrator or user on the target system needs to open, mount, or click anything.\nS:U - The faulty conntrack confirmation, the WARN, and any resulting state damage are all contained within the kernel\u0027s own network stack and its security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The bug confirms conntrack entries and emits warnings; no attacker-observable memory contents or kernel addresses are returned to the attacker. The stale conntrack pointer read on the clash path feeds only a WARN_ON_ONCE and never propagates data outward.\nI:L - Attacker traffic causes the host to create and confirm conntrack entries for flows it is not a party to, and confirmation at LOCAL_IN explicitly disables NAT and conntrack helpers for those flows (per commit 62e7151ae3eb), so a bridging firewall silently fails to apply its NAT/helper policy and its connection-tracking state is polluted with attacker-seeded entries. This is a bounded, security-relevant modification of kernel firewall state rather than arbitrary write capability.\nA:H - Remotely sent frames trigger kernel WARN splats in br_nf_local_in() and __nf_conntrack_confirm(), which is a kernel panic on the many hardened/cloud/CI kernels built with panic_on_warn=1. Even without that, the failed concurrent confirms return NF_DROP (packet loss on the bridge) and a promiscuous bridge under attacker traffic fills the conntrack table with entries for observed third-party flows, exhausting nf_conntrack_max and denying service to the host\u0027s own and forwarded traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:01.313Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dceb683ab87ca3666a9bb5c0158528b646faedc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b13db0d16bc7b2a52abcf5cb71334f63faa5dbd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f59ac29dea0921637053908fe99268d157bbb9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/43193174510ea4f3ce09b796e559a2fd9f148615"
        },
        {
          "url": "https://git.kernel.org/stable/c/751de2012eafa4d46d8081056761fa0e9cc8a178"
        }
      ],
      "title": "netfilter: br_netfilter: skip conntrack input hook for promisc packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27018",
    "datePublished": "2024-05-01T05:30:06.472Z",
    "dateReserved": "2024-02-19T14:20:24.209Z",
    "dateUpdated": "2026-08-05T11:29:01.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:40:24.038886Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:46:01.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:32.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cade34279c2249eafe528564bd2e203e4ff15f88"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/379bf7257bc5f2a1b1ca8514e08a871b7bf6d920"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df7c0fb8c2b9f9cac65659332581b19682a71349"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad333578f736d56920e090d7db1f8dec891d815e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4ca946b19caf655a08d5e2266d4d5526025ebb73"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d78d867dcea69c328db30df665be5be7d0148484"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cade34279c2249eafe528564bd2e203e4ff15f88",
              "status": "affected",
              "version": "e50092404c1bc7aaeb0a0f4077fa6f07b073a20f",
              "versionType": "git"
            },
            {
              "lessThan": "379bf7257bc5f2a1b1ca8514e08a871b7bf6d920",
              "status": "affected",
              "version": "e50092404c1bc7aaeb0a0f4077fa6f07b073a20f",
              "versionType": "git"
            },
            {
              "lessThan": "df7c0fb8c2b9f9cac65659332581b19682a71349",
              "status": "affected",
              "version": "e50092404c1bc7aaeb0a0f4077fa6f07b073a20f",
              "versionType": "git"
            },
            {
              "lessThan": "ad333578f736d56920e090d7db1f8dec891d815e",
              "status": "affected",
              "version": "e50092404c1bc7aaeb0a0f4077fa6f07b073a20f",
              "versionType": "git"
            },
            {
              "lessThan": "4ca946b19caf655a08d5e2266d4d5526025ebb73",
              "status": "affected",
              "version": "e50092404c1bc7aaeb0a0f4077fa6f07b073a20f",
              "versionType": "git"
            },
            {
              "lessThan": "d78d867dcea69c328db30df665be5be7d0148484",
              "status": "affected",
              "version": "e50092404c1bc7aaeb0a0f4077fa6f07b073a20f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()\n\nnft_unregister_obj() can concurrent with __nft_obj_type_get(),\nand there is not any protection when iterate over nf_tables_objects\nlist in __nft_obj_type_get(). Therefore, there is potential data-race\nof nf_tables_objects list entry.\n\nUse list_for_each_entry_rcu() to iterate over nf_tables_objects\nlist in __nft_obj_type_get(), and use rcu_read_lock() in the caller\nnft_obj_type_get() to protect the entire type query process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the nfnetlink/nf_tables netlink socket via an NFT_MSG_NEWOBJ batch message, which requires a local process on the system. There is no remote or adjacent-network path into `__nft_obj_type_get()`.\nAC:L - The attacker fully controls the racing reader side and can issue NFT_MSG_NEWOBJ batches in a tight loop with no rate limiting or retry penalty, and can independently drive the list-mutation side through on-demand module autoload (`nft_request_module()` \u2192 `nf_tables_module_autoload()`, which drops `commit_mutex` around `request_module()`). Nothing about winning the window depends on state the attacker cannot influence or repeatedly re-attempt.\nPR:L - The only gate is `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is evaluated against the network namespace\u0027s owning user namespace, so an ordinary unprivileged user obtains it with `unshare -Urn`. No real root or CAP_SYS_ADMIN in the initial namespace is required to reach the unsynchronized list walk.\nUI:N - The attacker triggers the entire sequence from their own process by sending netlink messages; no victim action, mount, file open, or administrator interaction is needed.\nS:U - The race and its consequences are confined to the kernel\u0027s own security authority \u2014 this is standard in-kernel memory corruption with no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - The unprotected traversal can dereference `struct nft_object_type` fields in module memory already released by `free_mod_mem()`, and the stale pointer is propagated into `nft_obj_init()` where `type-\u003emaxattr` and `type-\u003epolicy` steer a `kmalloc_array()` and `nla_parse_nested()`, giving an attacker-influenceable read out of reallocated kernel memory.\nI:H - `try_module_get(type-\u003eowner)` performs an atomic increment through a dangling pointer, and `nft_obj_init()` then invokes `type-\u003eselect_ops()` and `ops-\u003einit()` \u2014 indirect calls through function pointers read from freed vmalloc\u0027d module memory that can be reoccupied by a later module load or spray, yielding a control-flow hijack primitive.\nA:H - Following a stale list entry or a garbage `type-\u003eowner`/`select_ops` pointer produces an oops or panic, and the use-after-free reliably crashes the kernel even when not weaponized further."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:02.381Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cade34279c2249eafe528564bd2e203e4ff15f88"
        },
        {
          "url": "https://git.kernel.org/stable/c/379bf7257bc5f2a1b1ca8514e08a871b7bf6d920"
        },
        {
          "url": "https://git.kernel.org/stable/c/df7c0fb8c2b9f9cac65659332581b19682a71349"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad333578f736d56920e090d7db1f8dec891d815e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ca946b19caf655a08d5e2266d4d5526025ebb73"
        },
        {
          "url": "https://git.kernel.org/stable/c/d78d867dcea69c328db30df665be5be7d0148484"
        }
      ],
      "title": "netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27019",
    "datePublished": "2024-05-01T05:30:11.319Z",
    "dateReserved": "2024-02-19T14:20:24.209Z",
    "dateUpdated": "2026-08-05T11:29:02.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27020",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T19:26:58.391230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T19:27:09.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:36.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/939109c0a8e2a006a6cc8209e262d25065f4403a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b38a133d37fa421c8447b383d788c9cc6f5cb34c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/934e66e231cff2b18faa2c8aad0b8cec13957e05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0b6de00206adbbfc6373b3ae38d2a6f197987907"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8d56bad42ac4c43c6c72ddd6a654a2628bf839c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a9ebf340d123ae12582210407f879d6a5a1bc25b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/01f1a678b05ade4b1248019c2dcca773aebbeb7f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f969eb84ce482331a991079ab7a5c4dc3b7f89bf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:51:12.204Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "939109c0a8e2a006a6cc8209e262d25065f4403a",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "b38a133d37fa421c8447b383d788c9cc6f5cb34c",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "934e66e231cff2b18faa2c8aad0b8cec13957e05",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "0b6de00206adbbfc6373b3ae38d2a6f197987907",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "8d56bad42ac4c43c6c72ddd6a654a2628bf839c5",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "a9ebf340d123ae12582210407f879d6a5a1bc25b",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "01f1a678b05ade4b1248019c2dcca773aebbeb7f",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            },
            {
              "lessThan": "f969eb84ce482331a991079ab7a5c4dc3b7f89bf",
              "status": "affected",
              "version": "ef1f7df9170dbd875ce198ba84e6ab80f6fc139e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.313",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.313",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()\n\nnft_unregister_expr() can concurrent with __nft_expr_type_get(),\nand there is not any protection when iterate over nf_tables_expressions\nlist in __nft_expr_type_get(). Therefore, there is potential data-race\nof nf_tables_expressions list entry.\n\nUse list_for_each_entry_rcu() to iterate over nf_tables_expressions\nlist in __nft_expr_type_get(), and use rcu_read_lock() in the caller\nnft_expr_type_get() to protect the entire type query process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through NETLINK_NETFILTER messages (NFT_MSG_NEWRULE/NEWSET batches) sent by a local process on the same host. Per kernel scoring guidance, netfilter/nftables netlink configuration is a local attack vector.\nAC:L - The attacker fully controls the reader side (unbounded NFT_MSG_NEWRULE batches in one netns) and can drive the writer side by forcing expression-module autoload from a second netns, where nf_tables_module_autoload() intentionally releases commit_mutex before request_module(); because the writer holds only the global nfnl mutex and the reader only the per-netns commit_mutex, the two run concurrently with no shared lock and the race can be retried indefinitely.\nPR:L - nfnetlink gates on netlink_net_capable(skb, CAP_NET_ADMIN), which resolves to ns_capable() against the network namespace\u0027s owning user namespace, so an ordinary unprivileged user obtains it with \"unshare -Urn\". No real root or init-namespace capability is needed.\nUI:N - The attacker performs the entire sequence \u2014 creating namespaces, issuing nftables batches, and triggering module autoload \u2014 with no action by any other user or administrator.\nS:U - The race and its consequences are confined to the kernel of the same host; there is no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - Losing the RCU protection lets nft_expr_type_get() retain a pointer into module memory past free_module()\u0027s synchronize_rcu(), so type-\u003eowner, type-\u003ename, type-\u003emaxattr and type-\u003epolicy are read from freed and potentially reclaimed memory; an attacker-controlled reclaim of that module-region allocation combined with the attacker-supplied nla_policy parse yields kernel memory disclosure.\nI:H - try_module_get() performs an atomic increment through a dangling type-\u003eowner pointer, giving a write into freed memory, and type-\u003eselect_ops/type-\u003eops become indirect calls through freed module-region storage that can be reclaimed (e.g. by another module load or BPF JIT allocation), making control-flow hijack achievable.\nA:H - Dereferencing the stale nft_expr_type and the freed struct module after the module\u0027s vmalloc\u0027d memory is released causes an oops or panic, and the unsynchronized traversal of a concurrently modified list can itself derail into invalid pointers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:03.453Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/939109c0a8e2a006a6cc8209e262d25065f4403a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38a133d37fa421c8447b383d788c9cc6f5cb34c"
        },
        {
          "url": "https://git.kernel.org/stable/c/934e66e231cff2b18faa2c8aad0b8cec13957e05"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b6de00206adbbfc6373b3ae38d2a6f197987907"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d56bad42ac4c43c6c72ddd6a654a2628bf839c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9ebf340d123ae12582210407f879d6a5a1bc25b"
        },
        {
          "url": "https://git.kernel.org/stable/c/01f1a678b05ade4b1248019c2dcca773aebbeb7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f969eb84ce482331a991079ab7a5c4dc3b7f89bf"
        }
      ],
      "title": "netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27020",
    "datePublished": "2024-05-01T05:30:15.908Z",
    "dateReserved": "2024-02-19T14:20:24.209Z",
    "dateUpdated": "2026-08-05T11:29:03.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:44.767Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c42f7e039aba3de6d7dbf92da708e2b2ecba557"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04b0c41912349aff11a1bbaef6a722bd7fbb90ac"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cec11fa2eb512ebe3a459c185f4aca1d44059bbf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd782da470761077f4d1120e191f1a35787cda6e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27022",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:40.515074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:37.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b",
              "status": "affected",
              "version": "8d9bfb2608145cf3e408428c224099e1585471af",
              "versionType": "git"
            },
            {
              "lessThan": "abdb88dd272bbeb93efe01d8e0b7b17e24af3a34",
              "status": "affected",
              "version": "8d9bfb2608145cf3e408428c224099e1585471af",
              "versionType": "git"
            },
            {
              "lessThan": "35e351780fa9d8240dd6f7e4f245f9ea37e96c19",
              "status": "affected",
              "version": "8d9bfb2608145cf3e408428c224099e1585471af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfork: defer linking file vma until vma is fully initialized\n\nThorvald reported a WARNING [1]. And the root cause is below race:\n\n CPU 1\t\t\t\t\tCPU 2\n fork\t\t\t\t\thugetlbfs_fallocate\n  dup_mmap\t\t\t\t hugetlbfs_punch_hole\n   i_mmap_lock_write(mapping);\n   vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.\n   i_mmap_unlock_write(mapping);\n   hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!\n\t\t\t\t\t i_mmap_lock_write(mapping);\n   \t\t\t\t\t hugetlb_vmdelete_list\n\t\t\t\t\t  vma_interval_tree_foreach\n\t\t\t\t\t   hugetlb_vma_trylock_write -- Vma_lock is cleared.\n   tmp-\u003evm_ops-\u003eopen -- Alloc new vma_lock outside i_mmap_rwsem!\n\t\t\t\t\t   hugetlb_vma_unlock_write -- Vma_lock is assigned!!!\n\t\t\t\t\t i_mmap_unlock_write(mapping);\n\nhugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside\ni_mmap_rwsem lock while vma lock can be used in the same time.  Fix this\nby deferring linking file vma until vma is fully initialized.  Those vmas\nshould be initialized first before they can be used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local syscalls \u2014 `memfd_create(MFD_HUGETLB)`/`ftruncate`/`mmap`, `fork()`, and `fallocate(FALLOC_FL_PUNCH_HOLE)` \u2014 on the attacker\u0027s own process. There is no network or remote-peer input path into `dup_mmap()` or `hugetlbfs_punch_hole()`.\nAC:L - The attacker controls both sides of the race, looping `fork()` in one thread while another loops hole-punch/truncate on the same hugetlbfs fd, and the vulnerable window spans `hugetlb_dup_vma_private()` through `copy_page_range()` to `vm_ops-\u003eopen()`, which is widened to milliseconds simply by using a multi-GB mapping. No condition outside the attacker\u0027s influence is required.\nPR:L - Any unprivileged local user can reach this: `memfd_create(name, MFD_HUGETLB)` uses `HUGETLB_ANONHUGE_INODE`, which bypasses the `can_do_hugetlb_shm()`/`CAP_IPC_LOCK` check, and `MAP_NORESERVE` lets the mapping succeed even with no huge pages configured. No hugetlbfs mount, capability, or namespace privilege is needed.\nUI:N - The attacker\u0027s own process performs both the `fork()` and the `fallocate()`/`ftruncate()` that collide; no victim action, mount, or file open by another user is involved.\nS:U - The corruption is confined to kernel memory-management state (rwsem counters and hugetlb page tables) within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Running `huge_pmd_unshare()` without the VMA lock reintroduces the shared-PMD page-table use-after-free that lock was added to prevent, letting a freed page-table page remain installed in another mm\u0027s PUD and be reallocated \u2014 yielding arbitrary physical memory read. Per kernel guidance, memory corruption of this class scores High.\nI:H - The same PMD page-table UAF gives an arbitrary-write primitive (attacker-controlled PTEs written into freed-and-reallocated memory map arbitrary physical frames), and the unbalanced `up_write()` underflows `sem-\u003ecount`, destroying mutual exclusion on the lock that guards hugetlb page-table teardown.\nA:H - The mismatched lock/unlock leaves the parent\u0027s `hugetlb_vma_lock-\u003erw_sema` permanently write-held, so every subsequent hugetlb fault, unmap, or `exit_mmap()` on that VMA blocks forever in D state \u2014 unkillable tasks and hung-task panic \u2014 in addition to the reported WARNING and UAF-induced oopses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:04.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34"
        },
        {
          "url": "https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19"
        }
      ],
      "title": "fork: defer linking file vma until vma is fully initialized",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27022",
    "datePublished": "2024-05-01T05:35:39.627Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2026-08-05T11:29:04.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/786854141057751bc08eb26f1b02e97c1631c8f4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/997efea2bf3a4adb96c306b9ad6a91442237bf5b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9dfc15a10dfd44f8ff7f27488651cb5be6af83c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b562ebe21ed9adcf42242797dd6cb75beef12bf0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/998fd719e6d6468b930ac0c44552ea9ff8b07b80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b505d05280739ce31d5708da840f42df827cb85"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/907761307469adecb02461a14120e9a1812a5fb1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c055fc00c07be1f0df7375ab0036cebd1106ed38"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:34.133420Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:36.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:51:13.363Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/rdma.c",
            "net/rds/send.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "786854141057751bc08eb26f1b02e97c1631c8f4",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "997efea2bf3a4adb96c306b9ad6a91442237bf5b",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "9dfc15a10dfd44f8ff7f27488651cb5be6af83c2",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "b562ebe21ed9adcf42242797dd6cb75beef12bf0",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "998fd719e6d6468b930ac0c44552ea9ff8b07b80",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "2b505d05280739ce31d5708da840f42df827cb85",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "907761307469adecb02461a14120e9a1812a5fb1",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "lessThan": "c055fc00c07be1f0df7375ab0036cebd1106ed38",
              "status": "affected",
              "version": "584a8279a44a800dea5a5c1e9d53a002e03016b4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "952835ccd917682ebb705f89ff1e56fbf068a1d8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "783941bd9f445a37c2854ec0b4cb9f9e603193a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "57d2ce1603101ce3f30d0ccdc35b98af08d2ed88",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ba1957f889f575f2a240eafe543c3fda5aa72e0",
              "versionType": "git"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.85",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.48",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.66",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/rdma.c",
            "net/rds/send.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.310",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.310",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.272",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.213",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.152",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.82",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.22",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.10",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.85",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.66",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: fix WARNING in rds_conn_connect_if_down\n\nIf connection isn\u0027t established yet, get_mr() will fail, trigger connection after\nget_mr()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:41:22.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/786854141057751bc08eb26f1b02e97c1631c8f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/997efea2bf3a4adb96c306b9ad6a91442237bf5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9dfc15a10dfd44f8ff7f27488651cb5be6af83c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b562ebe21ed9adcf42242797dd6cb75beef12bf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/998fd719e6d6468b930ac0c44552ea9ff8b07b80"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b505d05280739ce31d5708da840f42df827cb85"
        },
        {
          "url": "https://git.kernel.org/stable/c/907761307469adecb02461a14120e9a1812a5fb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c055fc00c07be1f0df7375ab0036cebd1106ed38"
        }
      ],
      "title": "net/rds: fix WARNING in rds_conn_connect_if_down",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27024",
    "datePublished": "2024-05-01T12:49:24.696Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2026-05-23T15:41:22.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27025",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:40:20.868698Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:45:55.898Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.917Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/44214d744be32a4769faebba764510888f1eb19e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4af837db0fd3679fabc7b7758397090b0c06dced"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/98e60b538e66c90b9a856828c71d4e975ebfa797"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/96436365e5d80d0106ea785a4f80a58e7c9edff8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7f5aed55829f376e4f7e5ea5b80ccdcb023e983"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e803040b368d046434fbc8a91945c690332c4fcf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba6a9970ce9e284cbc04099361c58731e308596a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:51:14.536Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44214d744be32a4769faebba764510888f1eb19e",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "4af837db0fd3679fabc7b7758397090b0c06dced",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "98e60b538e66c90b9a856828c71d4e975ebfa797",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "96436365e5d80d0106ea785a4f80a58e7c9edff8",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "b7f5aed55829f376e4f7e5ea5b80ccdcb023e983",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "e803040b368d046434fbc8a91945c690332c4fcf",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "ba6a9970ce9e284cbc04099361c58731e308596a",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            },
            {
              "lessThan": "31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d",
              "status": "affected",
              "version": "47d902b90a32a42a3d33aef3a02170fc6f70aa23",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.273",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: null check for nla_nest_start\n\nnla_nest_start() may fail and return NULL. Insert a check and set errno\nbased on other call sites within the same source code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:08:57.609Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44214d744be32a4769faebba764510888f1eb19e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4af837db0fd3679fabc7b7758397090b0c06dced"
        },
        {
          "url": "https://git.kernel.org/stable/c/98e60b538e66c90b9a856828c71d4e975ebfa797"
        },
        {
          "url": "https://git.kernel.org/stable/c/96436365e5d80d0106ea785a4f80a58e7c9edff8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7f5aed55829f376e4f7e5ea5b80ccdcb023e983"
        },
        {
          "url": "https://git.kernel.org/stable/c/e803040b368d046434fbc8a91945c690332c4fcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba6a9970ce9e284cbc04099361c58731e308596a"
        },
        {
          "url": "https://git.kernel.org/stable/c/31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d"
        }
      ],
      "title": "nbd: null check for nla_nest_start",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27025",
    "datePublished": "2024-05-01T12:49:28.124Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2026-05-12T11:51:14.536Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T17:22:02.102985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T18:43:33.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2342b05ec5342a519e00524a507f7a6ea6791a38"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/55f8ea6731aa64871ee6aef7dba53ee9f9f3b2f6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bcfcdf19698024565eff427706ebbd8df65abd11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c10fed329c1c104f375a75ed97ea3abef0786d62"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/766ec94cc57492eab97cbbf1595bd516ab0cb0e4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/62b1f837b15cf3ec2835724bdf8577e47d14c753"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bea82355df9e1c299625405b1947fc9b26b4c6d4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1784053cf10a14c4ebd8a890bad5cfe1bee51713"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a20ad45008a7c82f1184dc6dee280096009ece55"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-mt65xx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2342b05ec5342a519e00524a507f7a6ea6791a38",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "55f8ea6731aa64871ee6aef7dba53ee9f9f3b2f6",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "bcfcdf19698024565eff427706ebbd8df65abd11",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "c10fed329c1c104f375a75ed97ea3abef0786d62",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "766ec94cc57492eab97cbbf1595bd516ab0cb0e4",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "62b1f837b15cf3ec2835724bdf8577e47d14c753",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "bea82355df9e1c299625405b1947fc9b26b4c6d4",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "1784053cf10a14c4ebd8a890bad5cfe1bee51713",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            },
            {
              "lessThan": "a20ad45008a7c82f1184dc6dee280096009ece55",
              "status": "affected",
              "version": "1ce24864bff40e11500a699789412115fdf244bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-mt65xx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.311",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.273",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-mt65xx: Fix NULL pointer access in interrupt handler\n\nThe TX buffer in spi_transfer can be a NULL pointer, so the interrupt\nhandler may end up writing to the invalid memory and cause crashes.\n\nAdd a check to trans-\u003etx_buf before using it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:09:01.101Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2342b05ec5342a519e00524a507f7a6ea6791a38"
        },
        {
          "url": "https://git.kernel.org/stable/c/55f8ea6731aa64871ee6aef7dba53ee9f9f3b2f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcfcdf19698024565eff427706ebbd8df65abd11"
        },
        {
          "url": "https://git.kernel.org/stable/c/c10fed329c1c104f375a75ed97ea3abef0786d62"
        },
        {
          "url": "https://git.kernel.org/stable/c/766ec94cc57492eab97cbbf1595bd516ab0cb0e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/62b1f837b15cf3ec2835724bdf8577e47d14c753"
        },
        {
          "url": "https://git.kernel.org/stable/c/bea82355df9e1c299625405b1947fc9b26b4c6d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1784053cf10a14c4ebd8a890bad5cfe1bee51713"
        },
        {
          "url": "https://git.kernel.org/stable/c/a20ad45008a7c82f1184dc6dee280096009ece55"
        }
      ],
      "title": "spi: spi-mt65xx: Fix NULL pointer access in interrupt handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27028",
    "datePublished": "2024-05-01T12:53:19.069Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2026-05-11T20:09:01.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:21.007612Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:33.167Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "766c2627acb2d9d1722cce2e24837044d52d888a",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "772f18ded0e240cc1fa2b7020cc640e3e5c32b70",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "dc29dd00705a62c77de75b6d752259b869aac49d",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "ad6759e233db6fcc131055f8e23b4eafbe81053c",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            },
            {
              "lessThan": "50e60de381c342008c0956fd762e1c26408f372c",
              "status": "affected",
              "version": "7304ac4567bcb72fd57cc79582bf53ca7840136f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.273",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Use separate handlers for interrupts\n\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is an MSI-X interrupt handler in the OcteonTX2 RVU admin-function driver, reached by writing the mailbox doorbell from a local PF/VF function (ethtool/netdev operations, or a VFIO-assigned VF), not by processing any remote network data. No packet-processing path leads here, so exploitation requires local access to the host or to a passed-through VF.\nAC:L - The attacker drives both sides of the race himself \u2014 one thread spamming PF\u2192AF mailbox messages (e.g. unprivileged `ethtool -a`, which issues `cgx_cfg_pause_frm`) while another spams the VF\u2192AF doorbell on a separate MSI-X vector affined to a different CPU. No condition outside the attacker\u0027s control is required, and the race can be retried indefinitely at high rate.\nPR:L - Generating AF mailbox traffic needs only an ordinary local account \u2014 several octeontx2 ethtool GET operations (`get_pauseparam`, `get_fecparam`) send mailbox messages with no capability check \u2014 or possession of an SR-IOV VF exposed to a container/guest, which can write the mailbox trigger register directly. No root or CAP_NET_ADMIN in the initial namespace is required.\nUI:N - The attacker triggers both interrupt vectors entirely on his own by issuing ethtool/netdev requests and mailbox doorbell writes. No administrator or victim action is needed at any point.\nS:U - The corrupted mailbox bookkeeping and the resulting out-of-bounds accesses are all inside the host kernel, the same security authority as the vulnerable RVU AF driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - When the concurrently-bumped `num_msgs` extends the loop in `__rvu_mbox_handler()` past the valid message list, `msg` is taken from unvalidated memory and `offset` is advanced by an unchecked 16-bit `next_msgoff`, producing out-of-bounds reads outside the 64 KB `ioremap_wc()` mailbox window whose contents are then acted on and echoed back in mailbox responses \u2014 an unbounded kernel read primitive.\nI:H - The same overrun performs an unconditional write (`msg-\u003epcifunc \u0026= ...; msg-\u003epcifunc |= ...`) at the attacker-influenced out-of-bounds offset before any signature validation, and the duplicate work-queue dispatch re-executes already-completed AF resource commands such as LF free/detach against released state, corrupting the admin function\u0027s resource tables.\nA:H - Duplicate processing of resource-teardown mailbox messages and out-of-range accesses to the ioremapped mailbox region readily oops the kernel, while the mutually-cleared interrupt bits drop mailbox events and wedge the AF\u2194PF/VF control plane, taking down all NIX/NPA networking on the SoC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:07.771Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a"
        },
        {
          "url": "https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70"
        },
        {
          "url": "https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701"
        },
        {
          "url": "https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c"
        }
      ],
      "title": "octeontx2-af: Use separate handlers for interrupts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27030",
    "datePublished": "2024-05-01T12:53:25.954Z",
    "dateReserved": "2024-02-19T14:20:24.211Z",
    "dateUpdated": "2026-08-05T11:29:07.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-01T13:38:53.856287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:44.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.879Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d7ae7d1265686b55832a445b1db8cdd69738ac07"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/239174535dba11f7b83de0eaaa27909024f8c185"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0efb9ef6fb95384ba631d6819e66f10392aabfa2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a8b2b26fdd011ebe36d68a9a321ca45801685959"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a5d9b1aa61b401867b9066d54086b3e4ee91f8ed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c554badcae9c45b737a22d23454170c6020b90e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f073b24a9e2becd25ac4505a9780a87e621bb51"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e97fe4901e0f59a0bfd524578fe3768f8ca42428"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:51:15.740Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/clk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7ae7d1265686b55832a445b1db8cdd69738ac07",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "239174535dba11f7b83de0eaaa27909024f8c185",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "0efb9ef6fb95384ba631d6819e66f10392aabfa2",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "a8b2b26fdd011ebe36d68a9a321ca45801685959",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "a5d9b1aa61b401867b9066d54086b3e4ee91f8ed",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "c554badcae9c45b737a22d23454170c6020b90e6",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "6f073b24a9e2becd25ac4505a9780a87e621bb51",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            },
            {
              "lessThan": "e97fe4901e0f59a0bfd524578fe3768f8ca42428",
              "status": "affected",
              "version": "dde4eff47c82c52a72af333d9e55370eee6d95d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/clk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.273",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix clk_core_get NULL dereference\n\nIt is possible for clk_core_get to dereference a NULL in the following\nsequence:\n\nclk_core_get()\n    of_clk_get_hw_from_clkspec()\n        __of_clk_get_hw_from_provider()\n            __clk_get_hw()\n\n__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at\nhw-\u003ecore.\n\nPrior to commit dde4eff47c82 (\"clk: Look for parents with clkdev based\nclk_lookups\") the check IS_ERR_OR_NULL() was performed which would have\ncaught the NULL.\n\nReading the description of this function it talks about returning NULL but\nthat cannot be so at the moment.\n\nUpdate the function to check for hw before dereferencing it and return NULL\nif hw is NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:09:13.165Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7ae7d1265686b55832a445b1db8cdd69738ac07"
        },
        {
          "url": "https://git.kernel.org/stable/c/239174535dba11f7b83de0eaaa27909024f8c185"
        },
        {
          "url": "https://git.kernel.org/stable/c/0efb9ef6fb95384ba631d6819e66f10392aabfa2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8b2b26fdd011ebe36d68a9a321ca45801685959"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5d9b1aa61b401867b9066d54086b3e4ee91f8ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/c554badcae9c45b737a22d23454170c6020b90e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f073b24a9e2becd25ac4505a9780a87e621bb51"
        },
        {
          "url": "https://git.kernel.org/stable/c/e97fe4901e0f59a0bfd524578fe3768f8ca42428"
        }
      ],
      "title": "clk: Fix clk_core_get NULL dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27038",
    "datePublished": "2024-05-01T12:53:53.698Z",
    "dateReserved": "2024-02-19T14:20:24.212Z",
    "dateUpdated": "2026-05-12T11:51:15.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}