{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:56.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/rtnetlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f5489707cf528f9df2f39a3045c1ee713ec90e7",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "bb7bdf636cef74cdd7a7d548bdc7457ae161f617",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "5fed5f6de3cf734b231a11775748a6871ee3020f",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "15f150771e0ec97f8ab1657e7d2568e593c7fa04",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "28b21ee8e8fb326ba961a4bbce04ec04c65e705a",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "365c1ae819455561d4746aafabad673e4bcb0163",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "5f39454468329bb7fc7fc4895a6ba6ae3b95027e",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            },
            {
              "lessThan": "23f00807619d15063d676218f36c5dfeda1eb420",
              "status": "affected",
              "version": "30aad41721e087babcf27c5192474724d555936c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/rtnetlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: Allocate vfinfo size for VF GUIDs when supported\n\nCommit 30aad41721e0 (\"net/core: Add support for getting VF GUIDs\")\nadded support for getting VF port and node GUIDs in netlink ifinfo\nmessages, but their size was not taken into consideration in the\nfunction that allocates the netlink message, causing the following\nwarning when a netlink message is filled with many VF port and node\nGUIDs:\n # echo 64 \u003e /sys/bus/pci/devices/0000\\:08\\:00.0/sriov_numvfs\n # ip link show dev ib0\n RTNETLINK answers: Message too long\n Cannot send link get request: Message too long\n\nKernel warning:\n\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0\n Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core\n CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:rtnl_getlink+0x586/0x5a0\n Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07 80 4f cb 82 e9 36 fc ff ff \u003c0f\u003e 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00\n RSP: 0018:ffff888113557348 EFLAGS: 00010246\n RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000\n RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8\n RBP: 0000000000000009 R08: ffffffff821f44aa R09: 0000000000000000\n R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00\n R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff\n FS:  00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  \u003cTASK\u003e\n  ? __warn+0xa5/0x230\n  ? rtnl_getlink+0x586/0x5a0\n  ? report_bug+0x22d/0x240\n  ? handle_bug+0x53/0xa0\n  ? exc_invalid_op+0x14/0x50\n  ? asm_exc_invalid_op+0x16/0x20\n  ? skb_trim+0x6a/0x80\n  ? rtnl_getlink+0x586/0x5a0\n  ? __pfx_rtnl_getlink+0x10/0x10\n  ? rtnetlink_rcv_msg+0x1e5/0x860\n  ? __pfx___mutex_lock+0x10/0x10\n  ? rcu_is_watching+0x34/0x60\n  ? __pfx_lock_acquire+0x10/0x10\n  ? stack_trace_save+0x90/0xd0\n  ? filter_irq_stacks+0x1d/0x70\n  ? kasan_save_stack+0x30/0x40\n  ? kasan_save_stack+0x20/0x40\n  ? kasan_save_track+0x10/0x30\n  rtnetlink_rcv_msg+0x21c/0x860\n  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n  ? arch_stack_walk+0x9e/0xf0\n  ? rcu_is_watching+0x34/0x60\n  ? lock_acquire+0xd5/0x410\n  ? rcu_is_watching+0x34/0x60\n  netlink_rcv_skb+0xe0/0x210\n  ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n  ? __pfx_netlink_rcv_skb+0x10/0x10\n  ? rcu_is_watching+0x34/0x60\n  ? __pfx___netlink_lookup+0x10/0x10\n  ? lock_release+0x62/0x200\n  ? netlink_deliver_tap+0xfd/0x290\n  ? rcu_is_watching+0x34/0x60\n  ? lock_release+0x62/0x200\n  ? netlink_deliver_tap+0x95/0x290\n  netlink_unicast+0x31f/0x480\n  ? __pfx_netlink_unicast+0x10/0x10\n  ? rcu_is_watching+0x34/0x60\n  ? lock_acquire+0xd5/0x410\n  netlink_sendmsg+0x369/0x660\n  ? lock_release+0x62/0x200\n  ? __pfx_netlink_sendmsg+0x10/0x10\n  ? import_ubuf+0xb9/0xf0\n  ? __import_iovec+0x254/0x2b0\n  ? lock_release+0x62/0x200\n  ? __pfx_netlink_sendmsg+0x10/0x10\n  ____sys_sendmsg+0x559/0x5a0\n  ? __pfx_____sys_sendmsg+0x10/0x10\n  ? __pfx_copy_msghdr_from_user+0x10/0x10\n  ? rcu_is_watching+0x34/0x60\n  ? do_read_fault+0x213/0x4a0\n  ? rcu_is_watching+0x34/0x60\n  ___sys_sendmsg+0xe4/0x150\n  ? __pfx____sys_sendmsg+0x10/0x10\n  ? do_fault+0x2cc/0x6f0\n  ? handle_pte_fault+0x2e3/0x3d0\n  ? __pfx_handle_pte_fault+0x10/0x10\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:12:10.299Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f5489707cf528f9df2f39a3045c1ee713ec90e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb7bdf636cef74cdd7a7d548bdc7457ae161f617"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fed5f6de3cf734b231a11775748a6871ee3020f"
        },
        {
          "url": "https://git.kernel.org/stable/c/15f150771e0ec97f8ab1657e7d2568e593c7fa04"
        },
        {
          "url": "https://git.kernel.org/stable/c/28b21ee8e8fb326ba961a4bbce04ec04c65e705a"
        },
        {
          "url": "https://git.kernel.org/stable/c/365c1ae819455561d4746aafabad673e4bcb0163"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f39454468329bb7fc7fc4895a6ba6ae3b95027e"
        },
        {
          "url": "https://git.kernel.org/stable/c/23f00807619d15063d676218f36c5dfeda1eb420"
        }
      ],
      "title": "rtnetlink: Allocate vfinfo size for VF GUIDs when supported",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22075",
    "datePublished": "2025-04-16T14:12:26.566Z",
    "dateReserved": "2024-12-29T08:45:45.815Z",
    "dateUpdated": "2026-05-11T21:12:10.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:59.218Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef34840bda333fe99bafbd2d73b70ceaaf9eba66",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "538ed8b049ef801a86c543433e5061a91cc106e3",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "17c99ab3db2ba74096d36c69daa6e784e98fc0b8",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "11e24802e73362aa2948ee16b8fb4e32635d5b2a",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "3d012ba4404a0bb517658699ba85e6abda386dc3",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "49d2a2ea9d30991bae82107f9523915b91637683",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "b942f88fe7d2d789e51c5c30a675fa1c126f5a6d",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "a406aff8c05115119127c962cbbbbd202e1973ef",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate l_tree_depth to avoid out-of-bounds access\n\nThe l_tree_depth field is 16-bit (__le16), but the actual maximum depth is\nlimited to OCFS2_MAX_PATH_DEPTH.\n\nAdd a check to prevent out-of-bounds access if l_tree_depth has an invalid\nvalue, which may occur when reading from a corrupted mounted disk [1]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by parsing on-disk OCFS2 extent-tree metadata of a mounted volume, requiring local access to supply/attach the crafted block device or to operate on files of the corrupted filesystem. It is not reachable via any network protocol handler.\nAC:L - The attacker fully controls the on-disk `l_tree_depth` fields and the extent-block chain, so the descent depth \u2014 and therefore the number of out-of-bounds `p_node[]` slots written \u2014 is deterministic; no race or uncontrollable precondition is involved (metaecc checksums are trivially computed by the attacker, and the feature may be off entirely).\nPR:L - An unprivileged local user suffices in realistic deployments: desktop/kiosk automounters (udisks2) mount attacker-supplied removable media, and on an already-mounted volume any user with file access drives `ocfs2_find_path()` via write/truncate/punch-hole/reflink. Real root in the initial namespace is not required for the trigger itself.\nUI:N - No separate victim action is needed \u2014 an automounter mounts the attacker\u0027s device automatically, and in OCFS2\u0027s native shared-disk cluster deployment the corrupted extent block is written to shared storage and consumed by peer nodes on an already-mounted filesystem during normal file I/O.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow writes kernel `buffer_head`/`ocfs2_extent_list` pointers into adjacent kmalloc-96 slab objects, corrupting neighbouring structures in a way that is leverageable into an arbitrary-read primitive and leaks kernel pointer values into adjacent state.\nI:H - This is an unbounded out-of-bounds heap write (a cyclic extent-block chain lets the index grow without limit), overwriting adjacent slab objects with kernel pointers \u2014 a classic heap-corruption primitive exploitable for control-flow hijack and privilege escalation.\nA:H - Corrupting neighbouring slab objects with pointer values reliably produces a kernel oops/panic, and the crafted chain can also loop indefinitely while scribbling over memory, taking the machine down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:34.590Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef34840bda333fe99bafbd2d73b70ceaaf9eba66"
        },
        {
          "url": "https://git.kernel.org/stable/c/538ed8b049ef801a86c543433e5061a91cc106e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/17c99ab3db2ba74096d36c69daa6e784e98fc0b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/11e24802e73362aa2948ee16b8fb4e32635d5b2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d012ba4404a0bb517658699ba85e6abda386dc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d2a2ea9d30991bae82107f9523915b91637683"
        },
        {
          "url": "https://git.kernel.org/stable/c/b942f88fe7d2d789e51c5c30a675fa1c126f5a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a406aff8c05115119127c962cbbbbd202e1973ef"
        }
      ],
      "title": "ocfs2: validate l_tree_depth to avoid out-of-bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22079",
    "datePublished": "2025-04-16T14:12:29.215Z",
    "dateReserved": "2024-12-29T08:45:45.815Z",
    "dateUpdated": "2026-08-05T11:56:34.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T16:15:41.224860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T16:15:44.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/ntfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "201a2bdda13b619c4927700ffe47d387a30ced50",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "85615aa442830027923fc690390fa74d17b36ae1",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "b9982065b82b4177ba3a7a72ce18c84921f7494d",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "6bb81b94f7a9cba6bde9a905cef52a65317a8b04",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/ntfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Prevent integer overflow in hdr_first_de()\n\nThe \"de_off\" and \"used\" variables come from the disk so they both need to\ncheck.  The problem is that on 32bit systems if they\u0027re both greater than\nUINT_MAX - 16 then the check does work as intended because of an integer\noverflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by presenting a crafted NTFS volume to the local kernel as a block device \u2014 a USB stick on an automounting kiosk/NAS/infotainment unit, or a loop/NBD-backed image mounted via udisks2 \u2014 driving mount(2) and the subsequent index walks in fs/ntfs3/index.c. No network protocol handler is involved, and physical access is not strictly required since loop and network-block-backed images work equally well.\nAC:L - Every input to the wrap \u2014 hdr-\u003ede_off, hdr-\u003eused, hdr-\u003etotal, the entry size fields, and the attribute-list layout that steers which header escapes index_hdr_check() \u2014 is an attacker-chosen byte in the image, so the corruption is deterministic with no race to win and no dependency on kernel memory layout the attacker cannot influence. The 32-bit size_t requirement is a property of the target the attacker selects, and ntfs3 automounting removable NTFS media on 32-bit ARM NAS boxes, media players, and embedded appliances is the driver\u0027s canonical deployment rather than a rare configuration.\nPR:N - The attacker needs no account or credential on the target \u2014 they only supply the malicious filesystem image, which is then mounted by root, by an automount daemon such as udisks2/systemd, or by a container/VM image-handling service acting on the attacker\u0027s data. Every privileged operation along the path is performed by the victim system on the attacker\u0027s behalf; where a local account does exist, desktop polkit loop-mount brokering provides the same reach at even lower cost.\nUI:N - On kiosks, NAS appliances, and infotainment systems that automount removable media, inserting the device triggers the mount with no human participation, and the index code runs unattended during mount itself via ntfs_security_init()\u0027s indx_init()/indx_find() on the $SDH/$SII trees rather than waiting for a subsequent file access. In the loop-device scenario the attacker performs the mount themselves, so no separate victim action is required either.\nS:U - The wrapped pointer arithmetic, out-of-bounds reads, and memmove/memcpy writes all occur in kernel heap memory within the same kernel security authority that hosts the vulnerable ntfs3 code. No VM, IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The wrapped pointer makes hdr_first_de() return an NTFS_DE outside the index buffer, and because hdr_next_de()\u0027s bound check wraps identically with used near UINT_MAX, the entry walk proceeds past the allocation reading adjacent kernel heap as entry headers. Those bytes are consumed as file names, key_size, and MFT references and handed to userspace through ntfs_dir_emit()/dir_emit() during readdir, and steer de_get_vbn()-driven follow-on reads, making adjacent kernel memory directly observable.\nI:H - The same out-of-bounds entry pointer is passed to the mutation paths \u2014 hdr_insert_de() performs memmove(Add2Ptr(before, de_size), before, used - off) and memcpy(before, de, de_size) through it, hdr_delete_de() memmoves through it, and indx_delete_entry() applies le16_sub_cpu()/le32_sub_cpu() to fields at that address \u2014 yielding an out-of-bounds write of attacker-chosen bytes into kernel heap adjacent to the MFT-record or index-block allocation. Controlled heap overwrite of that form is a usable memory-corruption primitive for control-flow hijack, and the corrupted headers are additionally written back to disk by indx_write().\nA:H - Dereferencing and walking a pointer built from wrapped 32-bit arithmetic reads and writes past the kmalloc\u0027d index buffer, producing slab corruption and oops/panic (KASAN-class out-of-bounds), and the resulting nonsensical index geometry drives _ntfs_bad_inode()/-EINVAL error paths across the mounted volume. The fault occurs during mount or the first directory operation and can be reproduced on every mount attempt of the crafted image."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:35.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/201a2bdda13b619c4927700ffe47d387a30ced50"
        },
        {
          "url": "https://git.kernel.org/stable/c/85615aa442830027923fc690390fa74d17b36ae1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9982065b82b4177ba3a7a72ce18c84921f7494d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bb81b94f7a9cba6bde9a905cef52a65317a8b04"
        }
      ],
      "title": "fs/ntfs3: Prevent integer overflow in hdr_first_de()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22080",
    "datePublished": "2025-04-16T14:12:29.886Z",
    "dateReserved": "2024-12-29T08:45:45.815Z",
    "dateUpdated": "2026-08-05T11:56:35.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T16:15:26.291199Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T16:15:28.849Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:00.625Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0922d86a7a6032cb1694eab0b44b861bd33ba8d5",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "1a14e9718a19d2e88de004a1360bfd7a86ed1395",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "0dfe700fbd3525f30a36ffbe390a5b9319bd009a",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "284c9549386e9883855fb82b730303bb2edea9de",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "0538f52410b619737e663167b6a2b2d0bc1a589d",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "4d0f4f42922a832388a0c2fe5204c0a1037ff786",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "5ad414f4df2294b28836b5b7b69787659d6aa708",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix a couple integer overflows on 32bit systems\n\nOn 32bit systems the \"off + sizeof(struct NTFS_DE)\" addition can\nhave an integer wrapping issue.  Fix it by using size_add()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable parser only runs against on-disk NTFS metadata, so the attacker must get a crafted image mounted locally (attacker-supplied removable media auto-mounted by udisks2/autofs, a loop-mounted image, or a privileged container) and then reach `hdr_find_e()` with a local `stat()`/`open()` on a path inside the malicious directory. No remote peer or network protocol touches this code.\nAC:L - The wrap is deterministic and fully attacker-authored: setting `de_off` to `0xFFFFFFF0` in the crafted index root defeats both `index_hdr_check()` and `hdr_find_e()`\u0027s gate every time, and the resulting `offs[0] = 0xFFF0` entry is reached by the very first binary-search step. No race, no timing window, and the 32-bit kernel is a property of the targeted deployment (i686 distros, ARM32 embedded/industrial, 32-bit Android) rather than a condition the attacker must win.\nPR:L - Mounting `ntfs3` nominally needs `CAP_SYS_ADMIN` (no `FS_USERNS_MOUNT`), but on desktop, kiosk and shared-workstation deployments an ordinary logged-in user gets attacker-supplied media mounted for them by udisks2/polkit, and every step that actually drives the bug \u2014 the path lookup, the file write that triggers `ni_update_parent()` \u2014 is an unprivileged file operation. Scoring the lower-privilege reachable path.\nUI:N - No second user has to act: the automounter mounts the attacker\u0027s own device without any victim interaction, and the attacker then performs the triggering `stat()`, `ftruncate()` and writeback themselves. In the loop-mount and privileged-container variants the attacker likewise performs the mount directly.\nS:U - The out-of-bounds reads and the `indx_update_dup()` write all land in kernel slab memory and stay within the kernel\u0027s own security authority \u2014 no hypervisor, IOMMU, or container/VM boundary is crossed.\nC:H - `Add2Ptr(hdr, offs[mid_idx])` yields a pointer 65520 bytes past a 1 KB MFT record or 4 KB index buffer, and that OOB memory is then interpreted as a directory entry \u2014 its `ref` field is passed to `ntfs_iget5()`, and `cmp_fnames()` compares its name bytes against the attacker\u0027s lookup string, giving a repeatable oracle that lets the attacker read back adjacent kernel heap contents byte by byte.\nI:H - The out-of-bounds entry pointer returned by `hdr_find_e()` flows into `indx_update_dup()`, whose `memcpy(\u0026e_fname-\u003edup, dup, sizeof(*dup))` performs a 0x38-byte heap write ~64 KB out of bounds with content the attacker chooses (`data_size`/`alloc_size` via `ftruncate`, four timestamps via `utimensat`) \u2014 a controlled OOB write suitable for corrupting adjacent slab objects and hijacking control flow.\nA:H - A read 65520 bytes past a small kmalloc allocation reliably faults on unmapped memory or trips KASAN/KFENCE, and the `WARN_ON(!e)` in `indx_insert_into_root()` fires on the same corrupted pointer, so a single `stat()` on the crafted mount oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:36.719Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0922d86a7a6032cb1694eab0b44b861bd33ba8d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a14e9718a19d2e88de004a1360bfd7a86ed1395"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dfe700fbd3525f30a36ffbe390a5b9319bd009a"
        },
        {
          "url": "https://git.kernel.org/stable/c/284c9549386e9883855fb82b730303bb2edea9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/0538f52410b619737e663167b6a2b2d0bc1a589d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d0f4f42922a832388a0c2fe5204c0a1037ff786"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ad414f4df2294b28836b5b7b69787659d6aa708"
        }
      ],
      "title": "fs/ntfs3: Fix a couple integer overflows on 32bit systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22081",
    "datePublished": "2025-04-16T14:12:30.850Z",
    "dateReserved": "2024-12-29T08:45:45.816Z",
    "dateUpdated": "2026-08-05T11:56:36.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:41:16.490Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/scsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "451c72f5e7cf5d339a6410a635cee0825687c3dc",
              "status": "affected",
              "version": "4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3",
              "versionType": "git"
            },
            {
              "lessThan": "2b34bdc42df047794542f3e220fe989124e4499a",
              "status": "affected",
              "version": "4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3",
              "versionType": "git"
            },
            {
              "lessThan": "3a19eb3d9818e28f14c818a18dc913344a52ca92",
              "status": "affected",
              "version": "4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3",
              "versionType": "git"
            },
            {
              "lessThan": "3fd054baf382a426bbf5135ede0fc5673db74d3e",
              "status": "affected",
              "version": "4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3",
              "versionType": "git"
            },
            {
              "lessThan": "63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c",
              "status": "affected",
              "version": "4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3",
              "versionType": "git"
            },
            {
              "lessThan": "5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6",
              "status": "affected",
              "version": "4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/scsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint\n\nIf vhost_scsi_set_endpoint is called multiple times without a\nvhost_scsi_clear_endpoint between them, we can hit multiple bugs\nfound by Haoran Zhang:\n\n1. Use-after-free when no tpgs are found:\n\nThis fixes a use after free that occurs when vhost_scsi_set_endpoint is\ncalled more than once and calls after the first call do not find any\ntpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds\ntpgs to add to the vs_tpg array match=true, so we will do:\n\nvhost_vq_set_backend(vq, vs_tpg);\n...\n\nkfree(vs-\u003evs_tpg);\nvs-\u003evs_tpg = vs_tpg;\n\nIf vhost_scsi_set_endpoint is called again and no tpgs are found\nmatch=false so we skip the vhost_vq_set_backend call leaving the\npointer to the vs_tpg we then free via:\n\nkfree(vs-\u003evs_tpg);\nvs-\u003evs_tpg = vs_tpg;\n\nIf a scsi request is then sent we do:\n\nvhost_scsi_handle_vq -\u003e vhost_scsi_get_req -\u003e vhost_vq_get_backend\n\nwhich sees the vs_tpg we just did a kfree on.\n\n2. Tpg dir removal hang:\n\nThis patch fixes an issue where we cannot remove a LIO/target layer\ntpg (and structs above it like the target) dir due to the refcount\ndropping to -1.\n\nThe problem is that if vhost_scsi_set_endpoint detects a tpg is already\nin the vs-\u003evs_tpg array or if the tpg has been removed so\ntarget_depend_item fails, the undepend goto handler will do\ntarget_undepend_item on all tpgs in the vs_tpg array dropping their\nrefcount to 0. At this time vs_tpg contains both the tpgs we have added\nin the current vhost_scsi_set_endpoint call as well as tpgs we added in\nprevious calls which are also in vs-\u003evs_tpg.\n\nLater, when vhost_scsi_clear_endpoint runs it will do\ntarget_undepend_item on all the tpgs in the vs-\u003evs_tpg which will drop\ntheir refcount to -1. Userspace will then not be able to remove the tpg\nand will hang when it tries to do rmdir on the tpg dir.\n\n3. Tpg leak:\n\nThis fixes a bug where we can leak tpgs and cause them to be\nun-removable because the target name is overwritten when\nvhost_scsi_set_endpoint is called multiple times but with different\ntarget names.\n\nThe bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup\na vhost-scsi device to target/tpg mapping, then calls\nVHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we\nhaven\u0027t seen before (target1 has tpg1 but target2 has tpg2). When this\nhappens we don\u0027t teardown the old target tpg mapping and just overwrite\nthe target name and the vs-\u003evs_tpg array. Later when we do\nvhost_scsi_clear_endpoint, we are passed in either target1 or target2\u0027s\nname and we will only match that target\u0027s tpgs when we loop over the\nvs-\u003evs_tpg. We will then return from the function without doing\ntarget_undepend_item on the tpgs.\n\nBecause of all these bugs, it looks like being able to call\nvhost_scsi_set_endpoint multiple times was never supported. The major\nuser, QEMU, already has checks to prevent this use case. So to fix the\nissues, this patch prevents vhost_scsi_set_endpoint from being called\nif it\u0027s already successfully added tpgs. To add, remove or change the\ntpg config or target name, you must do a vhost_scsi_clear_endpoint\nfirst."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through the `VHOST_SCSI_SET_ENDPOINT` ioctl on the local `/dev/vhost-scsi` misc device, followed by virtqueue submission on the same open fd. There is no network-facing path \u2014 a guest can index the freed array but cannot itself perform the ioctl that frees it.\nAC:L - Triggering is fully deterministic and race-free: one successful `SET_ENDPOINT` followed by a second `SET_ENDPOINT` with a wwpn matching no tpg unconditionally frees the array still installed as the vq backend. Heap-spraying the freed 2048-byte kmalloc-2k object is standard and entirely under the attacker\u0027s control.\nPR:L - Neither `vhost_scsi_open()`, `vhost_scsi_ioctl()`, nor the vhost core performs any `capable()`/`CAP_*` check \u2014 only an open fd on `/dev/vhost-scsi` is needed, which the unprivileged QEMU/libvirt-qemu process routinely holds in any host actually using vhost-scsi. A compromised or malicious deprivileged VMM process reaches the bug with a single additional ioctl, so no real root is required.\nUI:N - The attacker performs both ioctls and the subsequent virtqueue kick entirely on its own; no action by any other user or administrator is needed. The LIO tpg configuration is pre-existing baseline state in any vhost-scsi deployment, not a victim action.\nS:U - The dangling backend and corrupted heap are host kernel memory, and the attacker is already a host-local process, so the compromise stays within the kernel\u0027s own security authority. This is standard local kernel privilege escalation rather than a VM-escape or IOMMU boundary crossing.\nC:H - `vhost_scsi_get_req()` performs `READ_ONCE(vs_tpg[*vc-\u003etarget])` on the freed array with an attacker-chosen index, then downstream code dereferences the resulting pointer, giving a use-after-free read that can be steered into arbitrary kernel memory disclosure. Per UAF guidance the attacker controls the contents of the reclaimed slab object, enabling arbitrary read.\nI:H - Reclaiming the freed kmalloc-2k object yields a fully attacker-controlled `struct vhost_scsi_tpg *` that is dereferenced and whose `tpg_nexus-\u003etvn_se_sess` is passed into `target_init_cmd()`/`target_submit_tmr()`, a classic fake-object path to arbitrary write and control-flow hijack. The configfs `config_item` refcount underflow to \u22121 additionally corrupts target-core object lifetime state.\nA:H - The dangling backend reliably produces a kernel oops/panic on the next SCSI request even without successful exploitation. The refcount underflow also permanently wedges the LIO tpg so `rmdir` on the tpg/target directory hangs and the objects can never be removed short of reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:37.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/451c72f5e7cf5d339a6410a635cee0825687c3dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6"
        }
      ],
      "title": "vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22083",
    "datePublished": "2025-04-16T14:12:32.291Z",
    "dateReserved": "2024-12-29T08:45:45.816Z",
    "dateUpdated": "2026-09-08T08:41:16.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:06.134Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/cq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b97d77049856865ac5ce8ffbc6e716928310f7f",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "856d9e5d72dc44eca6d5a153581c58fbd84e92e1",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "f0447ceb8a31d79bee7144f98f9a13f765531e1a",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "dc7139b7031d877acd73d7eff55670f22f48cd5e",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "7c51a6964b45b6d40027abd77e89cef30d26dc5a",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "cad677085274ecf9c7565b5bfc5d2e49acbf174c",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "55c65a64aefa6267b964d90e9a4039cb68ec73a5",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "d52636eb13ccba448a752964cc6fc49970912874",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            },
            {
              "lessThan": "5ed3b0cb3f827072e93b4c5b6e2b8106fd7cccbd",
              "status": "affected",
              "version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/cq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow\n\nWhen cur_qp isn\u0027t NULL, in order to avoid fetching the QP from\nthe radix tree again we check if the next cqe QP is identical to\nthe one we already have.\n\nThe bug however is that we are checking if the QP is identical by\nchecking the QP number inside the CQE against the QP number inside the\nmlx5_ib_qp, but that\u0027s wrong since the QP number from the CQE is from\nFW so it should be matched against mlx5_core_qp which is our FW QP\nnumber.\n\nOtherwise we could use the wrong QP when handling a CQE which could\ncause the kernel trace below.\n\nThis issue is mainly noticeable over QPs 0 \u0026 1, since for now they are\nthe only QPs in our driver whereas the QP number inside mlx5_ib_qp\ndoesn\u0027t match the QP number inside mlx5_core_qp.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000012\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 0 UID: 0 PID: 7927 Comm: kworker/u62:1 Not tainted 6.14.0-rc3+ #189\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]\n RIP: 0010:mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib]\n Code: 03 00 00 8d 58 ff 21 cb 66 39 d3 74 39 48 c7 c7 3c 89 6e a0 0f b7 db e8 b7 d2 b3 e0 49 8b 86 60 03 00 00 48 c7 c7 4a 89 6e a0 \u003c0f\u003e b7 5c 98 02 e8 9f d2 b3 e0 41 0f b7 86 78 03 00 00 83 e8 01 21\n RSP: 0018:ffff88810511bd60 EFLAGS: 00010046\n RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffff88885fa1b3c0 RDI: ffffffffa06e894a\n RBP: 00000000000000b0 R08: 0000000000000000 R09: ffff88810511bc10\n R10: 0000000000000001 R11: 0000000000000001 R12: ffff88810d593000\n R13: ffff88810e579108 R14: ffff888105146000 R15: 00000000000000b0\n FS:  0000000000000000(0000) GS:ffff88885fa00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000012 CR3: 00000001077e6001 CR4: 0000000000370eb0\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x20/0x60\n  ? page_fault_oops+0x150/0x3e0\n  ? exc_page_fault+0x74/0x130\n  ? asm_exc_page_fault+0x22/0x30\n  ? mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib]\n  __ib_process_cq+0x5a/0x150 [ib_core]\n  ib_cq_poll_work+0x31/0x90 [ib_core]\n  process_one_work+0x169/0x320\n  worker_thread+0x288/0x3a0\n  ? work_busy+0xb0/0xb0\n  kthread+0xd7/0x1f0\n  ? kthreads_online_cpu+0x130/0x130\n  ? kthreads_online_cpu+0x130/0x130\n  ret_from_fork+0x2d/0x50\n  ? kthreads_online_cpu+0x130/0x130\n  ret_from_fork_asm+0x11/0x20\n  \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The mis-attributed completions are driven by MAD traffic on the ib_mad shared CQ, whose receive CQEs are generated by unsolicited SMP/GMP/CM MADs sent by any node on the InfiniBand subnet. This is a logically adjacent L2 fabric rather than a routable network, and the affected QP0+QP1-sharing-a-CQ configuration only exists on IB link-layer ports (not routable RoCE).\nAC:L - This is not a race \u2014 the mismatch is deterministic once a QP\u0027s firmware QPN collides with the fixed verbs numbers 0/1 used for SMI/GSI, and an attacker simply floods MADs to guarantee multi-QP batched polls of the shared MAD CQ. No memory layout or timing condition outside the attacker\u0027s influence must be met.\nPR:N - MAD reception on QP0/QP1 is completely unauthenticated \u2014 any node on the subnet can send MADs that land on the GSI/SMI receive queues and generate CQEs. The polling itself runs in an unbound kernel workqueue with no credential check.\nUI:N - The ib_mad port, its QP0/QP1 pair, and the shared CQ are created automatically when the mlx5 IB device is probed; no administrator or victim action is needed to arm or trigger the path.\nS:U - The wrong-QP handling, out-of-bounds accesses, and the resulting indirect call all occur within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Masking wqe_ctr with the wrong QP\u0027s wqe_cnt (zero for the HW GSI QP) yields out-of-bounds reads of wq-\u003ewrid[]/wq-\u003ewqe_head[] against a ZERO_SIZE_PTR base, and completions are delivered against the wrong QP, disclosing another QP\u0027s work-request cookies (kernel pointers) to the consuming ULP.\nI:H - The wrong QP\u0027s queue state (wq-\u003etail, sq.last_poll) is corrupted, and the out-of-bounds-read wr_id is consumed as a struct ib_cqe pointer by __ib_process_cq(), which performs wc-\u003ewr_cqe-\u003edone(cq, wc) \u2014 an indirect call through a heap-derived function pointer, followed by ib_mad list manipulation on the same bogus pointer, giving control-flow hijack and write primitives.\nA:H - The commit documents a reproducible kernel NULL/wild pointer dereference oops in mlx5_ib_poll_cq() from the MAD completion workqueue, and handle_atomics() can additionally spin in an unbounded loop over wild memory, hanging the CQ poll worker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:39.977Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b97d77049856865ac5ce8ffbc6e716928310f7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/856d9e5d72dc44eca6d5a153581c58fbd84e92e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0447ceb8a31d79bee7144f98f9a13f765531e1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc7139b7031d877acd73d7eff55670f22f48cd5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c51a6964b45b6d40027abd77e89cef30d26dc5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cad677085274ecf9c7565b5bfc5d2e49acbf174c"
        },
        {
          "url": "https://git.kernel.org/stable/c/55c65a64aefa6267b964d90e9a4039cb68ec73a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d52636eb13ccba448a752964cc6fc49970912874"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ed3b0cb3f827072e93b4c5b6e2b8106fd7cccbd"
        }
      ],
      "title": "RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22086",
    "datePublished": "2025-04-16T14:12:34.560Z",
    "dateReserved": "2024-12-29T08:45:45.816Z",
    "dateUpdated": "2026-08-05T11:56:39.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:08.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/device.c",
            "drivers/infiniband/core/sysfs.c",
            "include/rdma/ib_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a5b7f8842a90a5e6eeff37f9f6d814e61ea3529",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "d5212b99649c5740154f307e9e3d7fee9bf62773",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "0cf80f924aecb5b2bebd4f4ad11b2efc676a0b78",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "df45ae2a4f1cdfda00c032839e12092e1f32c05e",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "c14d9704f5d77a7c7fa46e2114b64a4f75b64e17",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "6682da5d8fd578a5068531d01633c9d2e4c8f12b",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "a1ecb30f90856b0be4168ad51b8875148e285c1f",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/device.c",
            "drivers/infiniband/core/sysfs.c",
            "include/rdma/ib_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Don\u0027t expose hw_counters outside of init net namespace\n\nCommit 467f432a521a (\"RDMA/core: Split port and device counter sysfs\nattributes\") accidentally almost exposed hw counters to non-init net\nnamespaces. It didn\u0027t expose them fully, as an attempt to read any of\nthose counters leads to a crash like this one:\n\n[42021.807566] BUG: kernel NULL pointer dereference, address: 0000000000000028\n[42021.814463] #PF: supervisor read access in kernel mode\n[42021.819549] #PF: error_code(0x0000) - not-present page\n[42021.824636] PGD 0 P4D 0\n[42021.827145] Oops: 0000 [#1] SMP PTI\n[42021.830598] CPU: 82 PID: 2843922 Comm: switchto-defaul Kdump: loaded Tainted: G S      W I        XXX\n[42021.841697] Hardware name: XXX\n[42021.849619] RIP: 0010:hw_stat_device_show+0x1e/0x40 [ib_core]\n[42021.855362] Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 49 89 d0 4c 8b 5e 20 48 8b 8f b8 04 00 00 48 81 c7 f0 fa ff ff \u003c48\u003e 8b 41 28 48 29 ce 48 83 c6 d0 48 c1 ee 04 69 d6 ab aa aa aa 48\n[42021.873931] RSP: 0018:ffff97fe90f03da0 EFLAGS: 00010287\n[42021.879108] RAX: ffff9406988a8c60 RBX: ffff940e1072d438 RCX: 0000000000000000\n[42021.886169] RDX: ffff94085f1aa000 RSI: ffff93c6cbbdbcb0 RDI: ffff940c7517aef0\n[42021.893230] RBP: ffff97fe90f03e70 R08: ffff94085f1aa000 R09: 0000000000000000\n[42021.900294] R10: ffff94085f1aa000 R11: ffffffffc0775680 R12: ffffffff87ca2530\n[42021.907355] R13: ffff940651602840 R14: ffff93c6cbbdbcb0 R15: ffff94085f1aa000\n[42021.914418] FS:  00007fda1a3b9700(0000) GS:ffff94453fb80000(0000) knlGS:0000000000000000\n[42021.922423] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[42021.928130] CR2: 0000000000000028 CR3: 00000042dcfb8003 CR4: 00000000003726f0\n[42021.935194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[42021.942257] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[42021.949324] Call Trace:\n[42021.951756]  \u003cTASK\u003e\n[42021.953842]  [\u003cffffffff86c58674\u003e] ? show_regs+0x64/0x70\n[42021.959030]  [\u003cffffffff86c58468\u003e] ? __die+0x78/0xc0\n[42021.963874]  [\u003cffffffff86c9ef75\u003e] ? page_fault_oops+0x2b5/0x3b0\n[42021.969749]  [\u003cffffffff87674b92\u003e] ? exc_page_fault+0x1a2/0x3c0\n[42021.975549]  [\u003cffffffff87801326\u003e] ? asm_exc_page_fault+0x26/0x30\n[42021.981517]  [\u003cffffffffc0775680\u003e] ? __pfx_show_hw_stats+0x10/0x10 [ib_core]\n[42021.988482]  [\u003cffffffffc077564e\u003e] ? hw_stat_device_show+0x1e/0x40 [ib_core]\n[42021.995438]  [\u003cffffffff86ac7f8e\u003e] dev_attr_show+0x1e/0x50\n[42022.000803]  [\u003cffffffff86a3eeb1\u003e] sysfs_kf_seq_show+0x81/0xe0\n[42022.006508]  [\u003cffffffff86a11134\u003e] seq_read_iter+0xf4/0x410\n[42022.011954]  [\u003cffffffff869f4b2e\u003e] vfs_read+0x16e/0x2f0\n[42022.017058]  [\u003cffffffff869f50ee\u003e] ksys_read+0x6e/0xe0\n[42022.022073]  [\u003cffffffff8766f1ca\u003e] do_syscall_64+0x6a/0xa0\n[42022.027441]  [\u003cffffffff8780013b\u003e] entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe problem can be reproduced using the following steps:\n  ip netns add foo\n  ip netns exec foo bash\n  cat /sys/class/infiniband/mlx4_0/hw_counters/*\n\nThe panic occurs because of casting the device pointer into an\nib_device pointer using container_of() in hw_stat_device_show() is\nwrong and leads to a memory corruption.\n\nHowever the real problem is that hw counters should never been exposed\noutside of the non-init net namespace.\n\nFix this by saving the index of the corresponding attribute group\n(it might be 1 or 2 depending on the presence of driver-specific\nattributes) and zeroing the pointer to hw_counters group for compat\ndevices during the initialization.\n\nWith this fix applied hw_counters are not available in a non-init\nnet namespace:\n  find /sys/class/infiniband/mlx4_0/ -name hw_counters\n    /sys/class/infiniband/mlx4_0/ports/1/hw_counters\n    /sys/class/infiniband/mlx4_0/ports/2/hw_counters\n    /sys/class/infiniband/mlx4_0/hw_counters\n\n  ip netns add foo\n  ip netns exec foo bash\n  find /sys/class/infiniband/mlx4_0/ -name hw_counters"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by a local `read()`/`write()` syscall on a sysfs attribute under `/sys/class/infiniband/\u003cdev\u003e/hw_counters/`, after the attacker places itself in a non-initial network namespace. No network input reaches the vulnerable code.\nAC:L - The trigger is fully deterministic and requires no race: create a netns, mount sysfs, read the counter file (the commit message documents the exact three-command reproducer). `ib_devices_shared_netns` defaults to true, so no unusual configuration is needed.\nPR:L - An unprivileged local user can reach it via `unshare -Urnm` plus a sysfs mount, since sysfs is `FS_USERNS_MOUNT` and only requires `ns_capable(net-\u003euser_ns, CAP_SYS_ADMIN)`; the counter files are world-readable (0444), so any process inside an ordinary container also qualifies. It is not PR:N because a local account/container foothold is required.\nUI:N - The attacker performs every step itself \u2014 namespace creation, sysfs mount and file read \u2014 with no action by any other user or administrator.\nS:U - The type confusion corrupts kernel memory within the same kernel security authority; no hypervisor, IOMMU or other trust boundary is crossed, matching standard kernel privilege-escalation scoring.\nC:H - The bogus `container_of()` makes the kernel read `hw_stats_data` from uninitialized/adjacent slab memory that heap grooming can control, after which `print_hw_stat()` returns `stats-\u003evalue[index]` \u2014 an attacker-influenced pointer plus index \u2014 to userspace through `sysfs_emit()`, yielding arbitrary kernel memory disclosure.\nI:H - The fabricated `ib_device` pointer produces a wild-pointer write via `mutex_lock(\u0026stats-\u003elock)` and via `set_stats_lifespan()` on the writable `lifespan` attribute, and `update_hw_stats()` performs an indirect call through `dev-\u003eops.get_hw_stats` read from fully out-of-bounds memory, giving a control-flow hijack primitive.\nA:H - The reported and reproducible outcome is an immediate kernel NULL pointer dereference oops/panic in `hw_stat_device_show()`, which any unprivileged user or container process can trigger on demand with a single `cat`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:43.154Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a5b7f8842a90a5e6eeff37f9f6d814e61ea3529"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5212b99649c5740154f307e9e3d7fee9bf62773"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cf80f924aecb5b2bebd4f4ad11b2efc676a0b78"
        },
        {
          "url": "https://git.kernel.org/stable/c/df45ae2a4f1cdfda00c032839e12092e1f32c05e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c14d9704f5d77a7c7fa46e2114b64a4f75b64e17"
        },
        {
          "url": "https://git.kernel.org/stable/c/6682da5d8fd578a5068531d01633c9d2e4c8f12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1ecb30f90856b0be4168ad51b8875148e285c1f"
        }
      ],
      "title": "RDMA/core: Don\u0027t expose hw_counters outside of init net namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22089",
    "datePublished": "2025-04-16T14:12:41.732Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2026-08-05T11:56:43.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:41:17.940Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "include/linux/pgtable.h",
            "kernel/fork.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6623712ba8449876f0b3de9462831523fb851e4",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "b07398e8a5da517083f5c3f2daa8f6681b48ab28",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "8d6373f83f367dbed316ddeb178130a3a64b5b67",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "da381c33f3aa6406406c9fdf07b8b0b63e0ce722",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "de6185b8892d88142ef69768fe4077cbf40109c0",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "dc84bc2aba85a1508f04a936f9f9a15f64ebfb31",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "include/linux/pgtable.h",
            "kernel/fork.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we\u0027ll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \"simply\"\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we\u0027ll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let\u0027s fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won\u0027t try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\"x86/mm/pat: clear VM_PAT if copy_p4d_range failed\")\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 mmap() of a device node that creates a whole-VMA VM_PFNMAP/VM_PAT mapping followed by fork()/clone(). No network or remote peer data is involved.\nAC:L - Deterministic trigger paths exist with no race or attacker-uncontrollable state: track_pfn_copy() unconditionally returns -EINVAL for a COW VM_PAT mapping whose first page has been COWed, and get_pat_info() unconditionally WARNs for a shared VM_PAT mapping whose PTEs were zapped (vfio BAR reset, TTM eviction, fbdev VT switch); the maintainer notes a reproducer triggers \"usually at the first try\".\nPR:L - Only an unprivileged local user account is needed, provided it can mmap any device that uses whole-VMA remap_pfn_range()/vm_iomap_memory() \u2014 DRM render nodes, /dev/kfd, /dev/fb0, UIO and vfio-pci, all routinely granted to normal users, Android apps, or DPDK operator accounts. No capability check guards copy_page_range() or the PAT tracking path.\nUI:N - The attacking process performs the mmap, the write fault and the fork() itself; no action by any other user or victim process is required.\nS:U - The corruption is confined to kernel PAT bookkeeping and the attacking process\u0027s own address-space teardown; no VM, IOMMU or sandbox boundary is crossed.\nC:L - The WARN_ON_ONCE splat dumps kernel register state, RIP and a call trace (defeating KASLR for readers of the log), and destroying a live PAT reservation allows the same physical range to be re-mapped with an incompatible cache mode, exposing stale/incoherent data. There is no arbitrary kernel-memory read primitive.\nI:H - untrack_pfn() on the dst VMA frees a memtype reservation that still belongs to the live parent mapping, and the subsequent END_MATCH erase can silently truncate an unrelated memtype entry \u2014 destroying the kernel\u0027s only protection against conflicting cacheability aliases, which x86 defines as undefined behaviour causing CPU cache/data corruption.\nA:H - The bug produces a kernel WARNING/oops in get_pat_info() (an outright panic on the common panic_on_warn=1 hardening setting), and the sibling path permanently leaks a memtype reservation, blocking later remapping of that physical range and leaking kernel memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:44.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6623712ba8449876f0b3de9462831523fb851e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b07398e8a5da517083f5c3f2daa8f6681b48ab28"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d6373f83f367dbed316ddeb178130a3a64b5b67"
        },
        {
          "url": "https://git.kernel.org/stable/c/da381c33f3aa6406406c9fdf07b8b0b63e0ce722"
        },
        {
          "url": "https://git.kernel.org/stable/c/de6185b8892d88142ef69768fe4077cbf40109c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc84bc2aba85a1508f04a936f9f9a15f64ebfb31"
        }
      ],
      "title": "x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22090",
    "datePublished": "2025-04-16T14:12:42.561Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2026-09-08T08:41:17.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:11.748Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:41:19.207Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/pcie-brcmstb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99a0efba9f903acbdece548862b6b4cbe7d999e1",
              "status": "affected",
              "version": "9e6be018b26347c26a93e63fb50a37ee2c9311de",
              "versionType": "git"
            },
            {
              "lessThan": "eedd054834930b8d678f0776cd4b091b8fffbb4a",
              "status": "affected",
              "version": "9e6be018b26347c26a93e63fb50a37ee2c9311de",
              "versionType": "git"
            },
            {
              "lessThan": "df63321a40cc98e52313cffbff376b8ae9ceffa7",
              "status": "affected",
              "version": "9e6be018b26347c26a93e63fb50a37ee2c9311de",
              "versionType": "git"
            },
            {
              "lessThan": "7842e842a9bf6bd5866c84f588353711d131ab1a",
              "status": "affected",
              "version": "9e6be018b26347c26a93e63fb50a37ee2c9311de",
              "versionType": "git"
            },
            {
              "lessThan": "6f44e1fdb006db61394aa4d4c25728ada00842e7",
              "status": "affected",
              "version": "9e6be018b26347c26a93e63fb50a37ee2c9311de",
              "versionType": "git"
            },
            {
              "lessThan": "3651ad5249c51cf7eee078e12612557040a6bdb4",
              "status": "affected",
              "version": "9e6be018b26347c26a93e63fb50a37ee2c9311de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/controller/pcie-brcmstb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: brcmstb: Fix error path after a call to regulator_bulk_get()\n\nIf the regulator_bulk_get() returns an error and no regulators\nare created, we need to set their number to zero.\n\nIf we don\u0027t do this and the PCIe link up fails, a call to the\nregulator_bulk_free() will result in a kernel panic.\n\nWhile at it, print the error value, as we cannot return an error\nupwards as the kernel will WARN() on an error from add_bus().\n\n[kwilczynski: commit log, use comma in the message to match style with\nother similar messages]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:12:52.237Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99a0efba9f903acbdece548862b6b4cbe7d999e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/eedd054834930b8d678f0776cd4b091b8fffbb4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/df63321a40cc98e52313cffbff376b8ae9ceffa7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7842e842a9bf6bd5866c84f588353711d131ab1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f44e1fdb006db61394aa4d4c25728ada00842e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3651ad5249c51cf7eee078e12612557040a6bdb4"
        }
      ],
      "title": "PCI: brcmstb: Fix error path after a call to regulator_bulk_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22095",
    "datePublished": "2025-04-16T14:12:46.226Z",
    "dateReserved": "2024-12-29T08:45:45.818Z",
    "dateUpdated": "2026-09-08T08:41:19.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22097",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-25T14:30:06.841533Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T14:36:34.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:13.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vkms/vkms_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49a69f67f53518bdd9b7eeebf019a2da6cc0e954",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            },
            {
              "lessThan": "79d138d137b80eeb0a83244d1cff29e64cf91067",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            },
            {
              "lessThan": "561fc0c5cf41f646f3e9e61784cbc0fc832fb936",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            },
            {
              "lessThan": "d5eb8e347905ab17788a7903fa1d3d06747355f5",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            },
            {
              "lessThan": "b8a18bb53e06d6d3c1fd03d12533d6e333ba8853",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            },
            {
              "lessThan": "1f68f1cf09d06061eb549726ff8339e064eddebd",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            },
            {
              "lessThan": "ed15511a773df86205bda66c37193569575ae828",
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vkms/vkms_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vkms: Fix use after free and double free on init error\n\nIf the driver initialization fails, the vkms_exit() function might\naccess an uninitialized or freed default_config pointer and it might\ndouble free it.\n\nFix both possible errors by initializing default_config only when the\ndriver initialization succeeded."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:12:54.498Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49a69f67f53518bdd9b7eeebf019a2da6cc0e954"
        },
        {
          "url": "https://git.kernel.org/stable/c/79d138d137b80eeb0a83244d1cff29e64cf91067"
        },
        {
          "url": "https://git.kernel.org/stable/c/561fc0c5cf41f646f3e9e61784cbc0fc832fb936"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5eb8e347905ab17788a7903fa1d3d06747355f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8a18bb53e06d6d3c1fd03d12533d6e333ba8853"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f68f1cf09d06061eb549726ff8339e064eddebd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed15511a773df86205bda66c37193569575ae828"
        }
      ],
      "title": "drm/vkms: Fix use after free and double free on init error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22097",
    "datePublished": "2025-04-16T14:12:47.649Z",
    "dateReserved": "2024-12-29T08:45:45.818Z",
    "dateUpdated": "2026-05-11T21:12:54.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}