Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0519
Vulnerability from certfr_avis - Published: 2026-04-30 - Updated: 2026-04-30
De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure Linux | azl3 cups 2.4.16-1 versions antérieures à 2.4.18-1 | ||
| Microsoft | Azure Linux | azl3 kernel 6.6.130.1-3 versions antérieures à 6.6.134.1-2 | ||
| Microsoft | Azure Linux | azl3 ruby 3.3.5-7 versions antérieures à 3.3.5-8 | ||
| Microsoft | Azure Linux | azl3 libgcrypt 1.10.3-1 versions antérieures à 1.10.3-2 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "azl3 cups 2.4.16-1 versions ant\u00e9rieures \u00e0 2.4.18-1",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kernel 6.6.130.1-3 versions ant\u00e9rieures \u00e0 6.6.134.1-2",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 ruby 3.3.5-7 versions ant\u00e9rieures \u00e0 3.3.5-8",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libgcrypt 1.10.3-1 versions ant\u00e9rieures \u00e0 1.10.3-2",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-31483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31483"
},
{
"name": "CVE-2026-31522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31522"
},
{
"name": "CVE-2026-31467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31467"
},
{
"name": "CVE-2026-31485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31485"
},
{
"name": "CVE-2026-31453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31453"
},
{
"name": "CVE-2026-31593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31593"
},
{
"name": "CVE-2026-31600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31600"
},
{
"name": "CVE-2026-31473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31473"
},
{
"name": "CVE-2026-31528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31528"
},
{
"name": "CVE-2026-31448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31448"
},
{
"name": "CVE-2026-31680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31680"
},
{
"name": "CVE-2026-31447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31447"
},
{
"name": "CVE-2026-31524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31524"
},
{
"name": "CVE-2026-31510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31510"
},
{
"name": "CVE-2026-31496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31496"
},
{
"name": "CVE-2026-31591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31591"
},
{
"name": "CVE-2026-31525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31525"
},
{
"name": "CVE-2026-31563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31563"
},
{
"name": "CVE-2026-41989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
},
{
"name": "CVE-2026-31566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31566"
},
{
"name": "CVE-2026-31494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31494"
},
{
"name": "CVE-2026-31565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31565"
},
{
"name": "CVE-2026-31609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31609"
},
{
"name": "CVE-2026-31469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31469"
},
{
"name": "CVE-2026-31520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31520"
},
{
"name": "CVE-2026-31601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31601"
},
{
"name": "CVE-2026-31620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31620"
},
{
"name": "CVE-2026-31555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31555"
},
{
"name": "CVE-2026-23360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23360"
},
{
"name": "CVE-2026-31515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31515"
},
{
"name": "CVE-2026-23414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23414"
},
{
"name": "CVE-2026-31523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31523"
},
{
"name": "CVE-2026-31450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31450"
},
{
"name": "CVE-2026-31608",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31608"
},
{
"name": "CVE-2026-31675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31675"
},
{
"name": "CVE-2026-31521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31521"
},
{
"name": "CVE-2026-31518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31518"
},
{
"name": "CVE-2026-31504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31504"
},
{
"name": "CVE-2026-31509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31509"
},
{
"name": "CVE-2026-27820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27820"
},
{
"name": "CVE-2026-31679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31679"
},
{
"name": "CVE-2026-31621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31621"
},
{
"name": "CVE-2026-31497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31497"
},
{
"name": "CVE-2026-31682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31682"
},
{
"name": "CVE-2026-31570",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31570"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-31441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31441"
},
{
"name": "CVE-2026-31444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31444"
},
{
"name": "CVE-2026-31495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31495"
},
{
"name": "CVE-2026-31507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31507"
},
{
"name": "CVE-2026-31476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31476"
},
{
"name": "CVE-2026-31674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31674"
},
{
"name": "CVE-2026-31458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31458"
},
{
"name": "CVE-2026-31589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31589"
},
{
"name": "CVE-2026-31678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31678"
},
{
"name": "CVE-2026-31503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31503"
},
{
"name": "CVE-2026-31455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31455"
},
{
"name": "CVE-2026-31474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31474"
},
{
"name": "CVE-2026-31519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31519"
},
{
"name": "CVE-2026-41079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41079"
},
{
"name": "CVE-2026-31439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31439"
},
{
"name": "CVE-2026-31446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31446"
},
{
"name": "CVE-2026-31500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31500"
},
{
"name": "CVE-2026-31454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31454"
},
{
"name": "CVE-2026-31452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31452"
}
],
"initial_release_date": "2026-04-30T00:00:00",
"last_revision_date": "2026-04-30T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0519",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-04-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Azure Linux. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure Linux",
"vendor_advisories": [
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31682",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31682"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31451",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31451"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31454",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31454"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31570",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31570"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31515",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31515"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31476",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31476"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31620",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31620"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31600",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31600"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31680",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31680"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31467",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31467"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31522",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31522"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31450",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31450"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23360",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23360"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31452",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31452"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31507",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31507"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31504",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31504"
},
{
"published_at": "2026-04-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31563",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31563"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31495",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31495"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31474",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31474"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31439",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31439"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31485",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31485"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31500",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31500"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31496",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31496"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31520",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31520"
},
{
"published_at": "2026-04-24",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41989",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41989"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31679",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31679"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31608",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31608"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31483",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31483"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31494",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31494"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31447",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31447"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31593",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31593"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31473",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31473"
},
{
"published_at": "2026-04-18",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-27820",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27820"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31675",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31675"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31555",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31555"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31523",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31523"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31589",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31589"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31678",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31678"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31528",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31528"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31444",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31444"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31519",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31519"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31510",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31510"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31609",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31609"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31469",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31469"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31448",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31448"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31674",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31674"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31524",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31524"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31453",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31453"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31601",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31601"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31441",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31441"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31591",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31591"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31455",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31455"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31518",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31518"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31566",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31566"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31509",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31509"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31446",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31446"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31497",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31497"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31565",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31565"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41079",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41079"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23414",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23414"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31458",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31458"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31521",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31521"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31503",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31503"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31621",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31621"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31525",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31525"
}
]
}
CVE-2026-23360 (GCVE-0-2026-23360)
Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-05-23 16:04
VLAI
EPSS
VEX
Title
nvme: fix admin queue leak on controller reset
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
Severity
No CVSS data available.
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/089a6f17881a82c6c… | |
| https://git.kernel.org/stable/c/6e28bab900e40e4d6… | |
| https://git.kernel.org/stable/c/2efbc838a26d3da72… | |
| https://git.kernel.org/stable/c/64f87b96de0e645a4… | |
| https://git.kernel.org/stable/c/e159eb852aeee9544… | |
| https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b… | |
| https://git.kernel.org/stable/c/b84bb7bd913d8ca2f… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ff037b5f47eeccc1636c03f84cd47db094eb73c9 , < 089a6f17881a82c6c6e05f8564a867be0767eade
(git)
Affected: 4896491c497226022626c3acc46044fd182f943c , < 6e28bab900e40e4d610b04f9f82e01983d8fb356 (git) Affected: a505f0ba36ab24176c300d7ff56aff85c2977e6c , < 2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 (git) Affected: e8061d02b49c5c901980f58d91e96580e9a14acf , < 64f87b96de0e645a4c066c7cffd753f334446db6 (git) Affected: 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 , < e159eb852aeee95443a9458ecb7d072bbb689913 (git) Affected: 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 , < 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f (git) Affected: 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 , < b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d (git) Affected: e7dac681790556c131854b97551337aa8042215b (git) Affected: 6.1.167 , < 6.1.168 (semver) Affected: 6.6.120 , < 6.6.131 (semver) Affected: 6.12.62 , < 6.12.77 (semver) Affected: 6.17.12 , < 6.18 (semver) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.17 , ≤ 6.18.* (semver) Unaffected: 6.19.7 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "089a6f17881a82c6c6e05f8564a867be0767eade",
"status": "affected",
"version": "ff037b5f47eeccc1636c03f84cd47db094eb73c9",
"versionType": "git"
},
{
"lessThan": "6e28bab900e40e4d610b04f9f82e01983d8fb356",
"status": "affected",
"version": "4896491c497226022626c3acc46044fd182f943c",
"versionType": "git"
},
{
"lessThan": "2efbc838a26d3da72d8fe05770bdf869d4ca3ac5",
"status": "affected",
"version": "a505f0ba36ab24176c300d7ff56aff85c2977e6c",
"versionType": "git"
},
{
"lessThan": "64f87b96de0e645a4c066c7cffd753f334446db6",
"status": "affected",
"version": "e8061d02b49c5c901980f58d91e96580e9a14acf",
"versionType": "git"
},
{
"lessThan": "e159eb852aeee95443a9458ecb7d072bbb689913",
"status": "affected",
"version": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
"versionType": "git"
},
{
"lessThan": "8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f",
"status": "affected",
"version": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
"versionType": "git"
},
{
"lessThan": "b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d",
"status": "affected",
"version": "03b3bcd319b3ab5182bc9aaa0421351572c78ac0",
"versionType": "git"
},
{
"status": "affected",
"version": "e7dac681790556c131854b97551337aa8042215b",
"versionType": "git"
},
{
"lessThan": "6.1.168",
"status": "affected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThan": "6.6.131",
"status": "affected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThan": "6.12.77",
"status": "affected",
"version": "6.12.62",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.6.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.12.62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin queue leak on controller reset\n\nWhen nvme_alloc_admin_tag_set() is called during a controller reset,\na previous admin queue may still exist. Release it properly before\nallocating a new one to avoid orphaning the old queue.\n\nThis fixes a regression introduced by commit 03b3bcd319b3 (\"nvme: fix\nadmin request_queue lifetime\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:04:36.667Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/089a6f17881a82c6c6e05f8564a867be0767eade"
},
{
"url": "https://git.kernel.org/stable/c/6e28bab900e40e4d610b04f9f82e01983d8fb356"
},
{
"url": "https://git.kernel.org/stable/c/2efbc838a26d3da72d8fe05770bdf869d4ca3ac5"
},
{
"url": "https://git.kernel.org/stable/c/64f87b96de0e645a4c066c7cffd753f334446db6"
},
{
"url": "https://git.kernel.org/stable/c/e159eb852aeee95443a9458ecb7d072bbb689913"
},
{
"url": "https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f"
},
{
"url": "https://git.kernel.org/stable/c/b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d"
}
],
"title": "nvme: fix admin queue leak on controller reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23360",
"datePublished": "2026-03-25T10:27:43.892Z",
"dateReserved": "2026-01-13T15:37:46.001Z",
"dateUpdated": "2026-05-23T16:04:36.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23414 (GCVE-0-2026-23414)
Vulnerability from cvelistv5 – Published: 2026-04-02 11:40 – Updated: 2026-08-05 12:21
VLAI
EPSS
VEX
Title
tls: Purge async_hold in tls_decrypt_async_wait()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tls: Purge async_hold in tls_decrypt_async_wait()
The async_hold queue pins encrypted input skbs while
the AEAD engine references their scatterlist data. Once
tls_decrypt_async_wait() returns, every AEAD operation
has completed and the engine no longer references those
skbs, so they can be freed unconditionally.
A subsequent patch adds batch async decryption to
tls_sw_read_sock(), introducing a new call site that
must drain pending AEAD operations and release held
skbs. Move __skb_queue_purge(&ctx->async_hold) into
tls_decrypt_async_wait() so the purge is centralized
and every caller -- recvmsg's drain path, the -EBUSY
fallback in tls_do_decryption(), and the new read_sock
batch path -- releases held skbs on synchronization
without each site managing the purge independently.
This fixes a leak when tls_strp_msg_hold() fails part-way through,
after having added some cloned skbs to the async_hold
queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to
process all pending decrypts, and drop back to synchronous mode, but
tls_sw_recvmsg() only flushes the async_hold queue when one record has
been processed in "fully-async" mode, which may not be the case here.
[pabeni@redhat.com: added leak comment]
Severity
7.5 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/ac435be7c7613eb13… | |
| https://git.kernel.org/stable/c/2dcf324855c34e7f9… | |
| https://git.kernel.org/stable/c/6dc11e0bd0a5466bc… | |
| https://git.kernel.org/stable/c/9f557c7eae127b44d… | |
| https://git.kernel.org/stable/c/fd8037e1f18ca5336… | |
| https://git.kernel.org/stable/c/84a8335d8300576f1… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9f83fd0c179e0f458e824e417f9d5ad53443f685 , < ac435be7c7613eb13a5a8ceb5182e10b50c9ce87
(git)
Affected: c61d4368197d65c4809d9271f3b85325a600586a , < 2dcf324855c34e7f934ce978aa19b645a8f3ee71 (git) Affected: 39dec4ea3daf77f684308576baf483b55ca7f160 , < 6dc11e0bd0a5466bcc76d275c09e5537bd0597dd (git) Affected: b8a6ff84abbcbbc445463de58704686011edc8e1 , < 9f557c7eae127b44d2e863917dc986a4b6cb1269 (git) Affected: b8a6ff84abbcbbc445463de58704686011edc8e1 , < fd8037e1f18ca5336934d0e0e7e1a4fe097e749d (git) Affected: b8a6ff84abbcbbc445463de58704686011edc8e1 , < 84a8335d8300576f1b377ae24abca1d9f197807f (git) Affected: 4fc109d0ab196bd943b7451276690fb6bb48c2e0 (git) Affected: 6.1.158 , < 6.1.168 (semver) Affected: 6.6.114 , < 6.6.131 (semver) Affected: 6.12.55 , < 6.12.80 (semver) Affected: 6.17.5 , < 6.18 (semver) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:46:57.475Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac435be7c7613eb13a5a8ceb5182e10b50c9ce87",
"status": "affected",
"version": "9f83fd0c179e0f458e824e417f9d5ad53443f685",
"versionType": "git"
},
{
"lessThan": "2dcf324855c34e7f934ce978aa19b645a8f3ee71",
"status": "affected",
"version": "c61d4368197d65c4809d9271f3b85325a600586a",
"versionType": "git"
},
{
"lessThan": "6dc11e0bd0a5466bcc76d275c09e5537bd0597dd",
"status": "affected",
"version": "39dec4ea3daf77f684308576baf483b55ca7f160",
"versionType": "git"
},
{
"lessThan": "9f557c7eae127b44d2e863917dc986a4b6cb1269",
"status": "affected",
"version": "b8a6ff84abbcbbc445463de58704686011edc8e1",
"versionType": "git"
},
{
"lessThan": "fd8037e1f18ca5336934d0e0e7e1a4fe097e749d",
"status": "affected",
"version": "b8a6ff84abbcbbc445463de58704686011edc8e1",
"versionType": "git"
},
{
"lessThan": "84a8335d8300576f1b377ae24abca1d9f197807f",
"status": "affected",
"version": "b8a6ff84abbcbbc445463de58704686011edc8e1",
"versionType": "git"
},
{
"status": "affected",
"version": "4fc109d0ab196bd943b7451276690fb6bb48c2e0",
"versionType": "git"
},
{
"lessThan": "6.1.168",
"status": "affected",
"version": "6.1.158",
"versionType": "semver"
},
{
"lessThan": "6.6.131",
"status": "affected",
"version": "6.6.114",
"versionType": "semver"
},
{
"lessThan": "6.12.80",
"status": "affected",
"version": "6.12.55",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.6.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.12.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: Purge async_hold in tls_decrypt_async_wait()\n\nThe async_hold queue pins encrypted input skbs while\nthe AEAD engine references their scatterlist data. Once\ntls_decrypt_async_wait() returns, every AEAD operation\nhas completed and the engine no longer references those\nskbs, so they can be freed unconditionally.\n\nA subsequent patch adds batch async decryption to\ntls_sw_read_sock(), introducing a new call site that\nmust drain pending AEAD operations and release held\nskbs. Move __skb_queue_purge(\u0026ctx-\u003easync_hold) into\ntls_decrypt_async_wait() so the purge is centralized\nand every caller -- recvmsg\u0027s drain path, the -EBUSY\nfallback in tls_do_decryption(), and the new read_sock\nbatch path -- releases held skbs on synchronization\nwithout each site managing the purge independently.\n\nThis fixes a leak when tls_strp_msg_hold() fails part-way through,\nafter having added some cloned skbs to the async_hold\nqueue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to\nprocess all pending decrypts, and drop back to synchronous mode, but\ntls_sw_recvmsg() only flushes the async_hold queue when one record has\nbeen processed in \"fully-async\" mode, which may not be the case here.\n\n[pabeni@redhat.com: added leak comment]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable receive-side kTLS path processes TLS records delivered over an established TCP connection, and a remote TLS peer can supply the encrypted records that drive `tls_sw_recvmsg()` into async decryption.\nAC:L - A reasonable deployment with software kTLS RX, TLS 1.2, and an async AEAD provider lets the attacker repeatedly send records that force the async hold path; allocation failure/memory pressure can be induced by sustained remote traffic, so no uncontrollable race is required.\nPR:N - The remote peer does not need local credentials or kernel privileges to send TLS application data to a service using kTLS RX, and no in-kernel authentication gate exists on the receive/decrypt path.\nUI:N - Exploitation only requires the victim service/socket to receive data in its normal operation; no separate user action is needed.\nS:U - The leak affects kernel networking memory and system availability within the same kernel security authority, without crossing a VM, sandbox, or hardware isolation boundary.\nC:N - The bug leaks skb references in `async_hold` after a partial `tls_strp_msg_hold()` failure, but it does not expose kernel memory or create an attacker-readable disclosure primitive.\nI:N - The fixed bug is a cleanup omission causing leaked held skbs, not an out-of-bounds write, UAF, or data/control-flow corruption primitive.\nA:H - The leaked skb clones and pinned receive buffers can accumulate across repeated remote-triggered failures and exhaust kernel memory, producing a denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:21:34.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac435be7c7613eb13a5a8ceb5182e10b50c9ce87"
},
{
"url": "https://git.kernel.org/stable/c/2dcf324855c34e7f934ce978aa19b645a8f3ee71"
},
{
"url": "https://git.kernel.org/stable/c/6dc11e0bd0a5466bcc76d275c09e5537bd0597dd"
},
{
"url": "https://git.kernel.org/stable/c/9f557c7eae127b44d2e863917dc986a4b6cb1269"
},
{
"url": "https://git.kernel.org/stable/c/fd8037e1f18ca5336934d0e0e7e1a4fe097e749d"
},
{
"url": "https://git.kernel.org/stable/c/84a8335d8300576f1b377ae24abca1d9f197807f"
}
],
"title": "tls: Purge async_hold in tls_decrypt_async_wait()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23414",
"datePublished": "2026-04-02T11:40:55.746Z",
"dateReserved": "2026-01-13T15:37:46.014Z",
"dateUpdated": "2026-08-05T12:21:34.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27820 (GCVE-0-2026-27820)
Vulnerability from cvelistv5 – Published: 2026-04-16 17:27 – Updated: 2026-04-16 18:20
VLAI
EPSS
VEX
Title
zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
Summary
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ruby/zlib/security/advisories/… | x_refsource_CONFIRM |
| https://hackerone.com/reports/3467067 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27820",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-16T18:20:13.051389Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T18:20:21.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zlib",
"vendor": "ruby",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.1"
},
{
"status": "affected",
"version": "\u003e= 3.1.0, \u003c 3.1.2"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 1.7,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131: Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T17:27:48.944Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w"
},
{
"name": "https://hackerone.com/reports/3467067",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/3467067"
}
],
"source": {
"advisory": "GHSA-g857-hhfv-j68w",
"discovery": "UNKNOWN"
},
"title": "zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27820",
"datePublished": "2026-04-16T17:27:48.944Z",
"dateReserved": "2026-02-24T02:32:39.799Z",
"dateUpdated": "2026-04-16T18:20:21.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31439 (GCVE-0-2026-31439)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-05-11 22:08
VLAI
EPSS
VEX
Title
dmaengine: xilinx: xdma: Fix regmap init error handling
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: xilinx: xdma: Fix regmap init error handling
devm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL.
Fix the error check and also fix the error message. Use the error code
from ERR_PTR() instead of the wrong value in ret.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
17ce252266c7f016ece026492c45838f852ddc79 , < 4b6e1da50b22e5528b9003f376a3cecccce4decc
(git)
Affected: 17ce252266c7f016ece026492c45838f852ddc79 , < 9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a (git) Affected: 17ce252266c7f016ece026492c45838f852ddc79 , < f27197ccfd2ecd2c71f27fd57c6d507e892ad24d (git) Affected: 17ce252266c7f016ece026492c45838f852ddc79 , < 59f6ccd0f3345be2e8a78bdef2103e93f180633a (git) Affected: 17ce252266c7f016ece026492c45838f852ddc79 , < e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8 (git) |
|
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/xilinx/xdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b6e1da50b22e5528b9003f376a3cecccce4decc",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "f27197ccfd2ecd2c71f27fd57c6d507e892ad24d",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "59f6ccd0f3345be2e8a78bdef2103e93f180633a",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/xilinx/xdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix regmap init error handling\n\ndevm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL.\nFix the error check and also fix the error message. Use the error code\nfrom ERR_PTR() instead of the wrong value in ret."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:43.715Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b6e1da50b22e5528b9003f376a3cecccce4decc"
},
{
"url": "https://git.kernel.org/stable/c/9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a"
},
{
"url": "https://git.kernel.org/stable/c/f27197ccfd2ecd2c71f27fd57c6d507e892ad24d"
},
{
"url": "https://git.kernel.org/stable/c/59f6ccd0f3345be2e8a78bdef2103e93f180633a"
},
{
"url": "https://git.kernel.org/stable/c/e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8"
}
],
"title": "dmaengine: xilinx: xdma: Fix regmap init error handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31439",
"datePublished": "2026-04-22T13:53:37.754Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-05-11T22:08:43.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31441 (GCVE-0-2026-31441)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-07-14 12:47
VLAI
EPSS
VEX
Title
dmaengine: idxd: Fix memory leak when a wq is reset
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix memory leak when a wq is reset
idxd_wq_disable_cleanup() which is called from the reset path for a
workqueue, sets the wq type to NONE, which for other parts of the
driver mean that the wq is empty (all its resources were released).
Only set the wq type to NONE after its resources are released.
Severity
No CVSS data available.
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/a16098a2f0c11ee5e… | |
| https://git.kernel.org/stable/c/54d77cc0c40ca2f89… | |
| https://git.kernel.org/stable/c/39c1504e0e76bcfb9… | |
| https://git.kernel.org/stable/c/a9e7815d38629bcf5… | |
| https://git.kernel.org/stable/c/0c3d3ac57e3c52b57… | |
| https://git.kernel.org/stable/c/d9cfb5193a047a92a… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
da32b28c95a79e399e18c03f8178f41aec9c66e4 , < a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658
(git)
Affected: da32b28c95a79e399e18c03f8178f41aec9c66e4 , < 54d77cc0c40ca2f894859dc7b3c52997574f1a2a (git) Affected: da32b28c95a79e399e18c03f8178f41aec9c66e4 , < 39c1504e0e76bcfb93991fd94288a83e05d13b51 (git) Affected: da32b28c95a79e399e18c03f8178f41aec9c66e4 , < a9e7815d38629bcf59d3005001f1f315424a58de (git) Affected: da32b28c95a79e399e18c03f8178f41aec9c66e4 , < 0c3d3ac57e3c52b570b8c695903306bff07e04c8 (git) Affected: da32b28c95a79e399e18c03f8178f41aec9c66e4 , < d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478 (git) Affected: 2a2df2bd10de44c3804661ed15157817c12d6291 (git) Affected: 5.7.10 , < 5.8 (semver) |
|
| Linux | Linux |
Affected:
5.8
Unaffected: 0 , < 5.8 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:50.075Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "54d77cc0c40ca2f894859dc7b3c52997574f1a2a",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "39c1504e0e76bcfb93991fd94288a83e05d13b51",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "a9e7815d38629bcf59d3005001f1f315424a58de",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "0c3d3ac57e3c52b570b8c695903306bff07e04c8",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"status": "affected",
"version": "2a2df2bd10de44c3804661ed15157817c12d6291",
"versionType": "git"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:04.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658"
},
{
"url": "https://git.kernel.org/stable/c/54d77cc0c40ca2f894859dc7b3c52997574f1a2a"
},
{
"url": "https://git.kernel.org/stable/c/39c1504e0e76bcfb93991fd94288a83e05d13b51"
},
{
"url": "https://git.kernel.org/stable/c/a9e7815d38629bcf59d3005001f1f315424a58de"
},
{
"url": "https://git.kernel.org/stable/c/0c3d3ac57e3c52b570b8c695903306bff07e04c8"
},
{
"url": "https://git.kernel.org/stable/c/d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478"
}
],
"title": "dmaengine: idxd: Fix memory leak when a wq is reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31441",
"datePublished": "2026-04-22T13:53:39.055Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-07-14T12:47:50.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31444 (GCVE-0-2026-31444)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
EPSS
VEX
Title
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
smb_grant_oplock() has two issues in the oplock publication sequence:
1) opinfo is linked into ci->m_op_list (via opinfo_add) before
add_lease_global_list() is called. If add_lease_global_list()
fails (kmalloc returns NULL), the error path frees the opinfo
via __free_opinfo() while it is still linked in ci->m_op_list.
Concurrent m_op_list readers (opinfo_get_list, or direct iteration
in smb_break_all_levII_oplock) dereference the freed node.
2) opinfo->o_fp is assigned after add_lease_global_list() publishes
the opinfo on the global lease list. A concurrent
find_same_lease_key() can walk the lease list and dereference
opinfo->o_fp->f_ci while o_fp is still NULL.
Fix by restructuring the publication sequence to eliminate post-publish
failure:
- Set opinfo->o_fp before any list publication (fixes NULL deref).
- Preallocate lease_table via alloc_lease_table() before opinfo_add()
so add_lease_global_list() becomes infallible after publication.
- Keep the original m_op_list publication order (opinfo_add before
lease list) so concurrent opens via same_client_has_lease() and
opinfo_get_list() still see the in-flight grant.
- Use opinfo_put() instead of __free_opinfo() on err_out so that
the RCU-deferred free path is used.
This also requires splitting add_lease_global_list() to take a
preallocated lease_table and changing its return type from int to void,
since it can no longer fail.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
302fef75512b2c8329a3f5efab1ae7ba2562387a , < 9e785f004cbc56390479b77375726ea9b0d1a8a6
(git)
Affected: 08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c , < 7de55bba69cbf0f9280daaea385daf08bc076121 (git) Affected: 1d6abf145615dbfe267ce3b0a271f95e3780e18e , < a5c6f6d6ceefed2d5210ee420fb75f8362461f46 (git) Affected: ce8507ee82c888126d8e7565e27c016308d24cde , < 6d7e5a918c1d0aad06db0e17677b66fc9a471021 (git) Affected: 1dfd062caa165ec9d7ee0823087930f3ab8a6294 , < 48623ec358c1c600fa1e38368746f933e0f1a617 (git) |
|
| Linux | Linux |
Affected:
6.6.130 , < 6.6.131
(semver)
Affected: 6.12.78 , < 6.12.80 (semver) Affected: 6.18.19 , < 6.18.21 (semver) Affected: 6.19.9 , < 6.19.11 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/oplock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e785f004cbc56390479b77375726ea9b0d1a8a6",
"status": "affected",
"version": "302fef75512b2c8329a3f5efab1ae7ba2562387a",
"versionType": "git"
},
{
"lessThan": "7de55bba69cbf0f9280daaea385daf08bc076121",
"status": "affected",
"version": "08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c",
"versionType": "git"
},
{
"lessThan": "a5c6f6d6ceefed2d5210ee420fb75f8362461f46",
"status": "affected",
"version": "1d6abf145615dbfe267ce3b0a271f95e3780e18e",
"versionType": "git"
},
{
"lessThan": "6d7e5a918c1d0aad06db0e17677b66fc9a471021",
"status": "affected",
"version": "ce8507ee82c888126d8e7565e27c016308d24cde",
"versionType": "git"
},
{
"lessThan": "48623ec358c1c600fa1e38368746f933e0f1a617",
"status": "affected",
"version": "1dfd062caa165ec9d7ee0823087930f3ab8a6294",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/oplock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.6.131",
"status": "affected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThan": "6.12.80",
"status": "affected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThan": "6.18.21",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.19.11",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.6.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.12.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.18.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.19.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n\nsmb_grant_oplock() has two issues in the oplock publication sequence:\n\n1) opinfo is linked into ci-\u003em_op_list (via opinfo_add) before\n add_lease_global_list() is called. If add_lease_global_list()\n fails (kmalloc returns NULL), the error path frees the opinfo\n via __free_opinfo() while it is still linked in ci-\u003em_op_list.\n Concurrent m_op_list readers (opinfo_get_list, or direct iteration\n in smb_break_all_levII_oplock) dereference the freed node.\n\n2) opinfo-\u003eo_fp is assigned after add_lease_global_list() publishes\n the opinfo on the global lease list. A concurrent\n find_same_lease_key() can walk the lease list and dereference\n opinfo-\u003eo_fp-\u003ef_ci while o_fp is still NULL.\n\nFix by restructuring the publication sequence to eliminate post-publish\nfailure:\n\n- Set opinfo-\u003eo_fp before any list publication (fixes NULL deref).\n- Preallocate lease_table via alloc_lease_table() before opinfo_add()\n so add_lease_global_list() becomes infallible after publication.\n- Keep the original m_op_list publication order (opinfo_add before\n lease list) so concurrent opens via same_client_has_lease() and\n opinfo_get_list() still see the in-flight grant.\n- Use opinfo_put() instead of __free_opinfo() on err_out so that\n the RCU-deferred free path is used.\n\nThis also requires splitting add_lease_global_list() to take a\npreallocated lease_table and changing its return type from int to void,\nsince it can no longer fail."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reachable through ksmbd over SMB on TCP/445 via SMB2 CREATE/open requests carrying lease contexts.\nAC:L - An attacker can drive the relevant lease/oplock publication races with concurrent SMB opens and attacker-chosen lease keys/client GUIDs; no condition outside attacker influence is required for the NULL dereference path.\nPR:N - Although SMB2 CREATE requires a valid session and tree connection, ksmbd supports guest/anonymous sessions and guest shares, making unauthenticated remote triggering reasonable in exposed deployments.\nUI:N - No victim user action is needed once the ksmbd service and share are reachable; the attacker sends SMB protocol requests directly.\nS:U - The vulnerability affects the kernel SMB server within the same host security authority and does not cross a separate security boundary such as a VM escape.\nC:H - The bug includes a use-after-free of struct oplock_info left reachable from shared lists, which can plausibly be leveraged for kernel memory disclosure through heap reuse.\nI:H - The use-after-free is kernel memory corruption in a network-reachable path and can plausibly be exploited for control-flow or data-structure corruption.\nA:H - Both the NULL dereference and use-after-free can crash or oops the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:35.585Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6"
},
{
"url": "https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121"
},
{
"url": "https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46"
},
{
"url": "https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021"
},
{
"url": "https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617"
}
],
"title": "ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31444",
"datePublished": "2026-04-22T13:53:41.351Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-08-05T12:22:35.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31446 (GCVE-0-2026-31446)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
EPSS
VEX
Title
ext4: fix use-after-free in update_super_work when racing with umount
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix use-after-free in update_super_work when racing with umount
Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount
filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work
to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups
reads during unmount. However, this introduced a use-after-free because
update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which
accesses the kobject's kernfs_node after it has been freed by kobject_del()
in ext4_unregister_sysfs():
update_super_work ext4_put_super
----------------- --------------
ext4_unregister_sysfs(sb)
kobject_del(&sbi->s_kobj)
__kobject_del()
sysfs_remove_dir()
kobj->sd = NULL
sysfs_put(sd)
kernfs_put() // RCU free
ext4_notify_error_sysfs(sbi)
sysfs_notify(&sbi->s_kobj)
kn = kobj->sd // stale pointer
kernfs_get(kn) // UAF on freed kernfs_node
ext4_journal_destroy()
flush_work(&sbi->s_sb_upd_work)
Instead of reordering the teardown sequence, fix this by making
ext4_notify_error_sysfs() detect that sysfs has already been torn down
by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call
in that case. A dedicated mutex (s_error_notify_mutex) serializes
ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()
to prevent TOCTOU races where the kobject could be deleted between the
state_in_sysfs check and the sysfs_notify() call.
Severity
7.8 (High)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/c8fe17a1b308c3d8c… | |
| https://git.kernel.org/stable/c/c4d829737329f2290… | |
| https://git.kernel.org/stable/c/9449f99ba04f5dd1c… | |
| https://git.kernel.org/stable/c/034053378dd81837f… | |
| https://git.kernel.org/stable/c/c97e282f7bfd0c355… | |
| https://git.kernel.org/stable/c/08b10e6f37fc533a7… | |
| https://git.kernel.org/stable/c/d15e4b0a418537aaf… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
52c3a04f9ec2a16a4204d6274db338cb8d5b2d74 , < c8fe17a1b308c3d8c703ebfb049b325f844342c3
(git)
Affected: b98535d091795a79336f520b0708457aacf55c67 , < c4d829737329f2290dd41e290b7d75effdb2a7ff (git) Affected: b98535d091795a79336f520b0708457aacf55c67 , < 9449f99ba04f5dd1c8423ad8a90b3651d7240d1d (git) Affected: b98535d091795a79336f520b0708457aacf55c67 , < 034053378dd81837fd6c7a43b37ee2e58d4f0b4e (git) Affected: b98535d091795a79336f520b0708457aacf55c67 , < c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe (git) Affected: b98535d091795a79336f520b0708457aacf55c67 , < 08b10e6f37fc533a759e9833af0692242e8b3f93 (git) Affected: b98535d091795a79336f520b0708457aacf55c67 , < d15e4b0a418537aafa56b2cb80d44add83e83697 (git) Affected: 585ef03c9e79672781f954daae730dfe24bf3a46 (git) Affected: afe490e48d47df1b3f64012835c1bc2f075a8c8b (git) Affected: 5.15.38 , < 5.15.203 (semver) Affected: 5.10.114 , < 5.11 (semver) Affected: 5.17.6 , < 5.18 (semver) |
|
| Linux | Linux |
Affected:
5.18
Unaffected: 0 , < 5.18 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:51.536Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/super.c",
"fs/ext4/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8fe17a1b308c3d8c703ebfb049b325f844342c3",
"status": "affected",
"version": "52c3a04f9ec2a16a4204d6274db338cb8d5b2d74",
"versionType": "git"
},
{
"lessThan": "c4d829737329f2290dd41e290b7d75effdb2a7ff",
"status": "affected",
"version": "b98535d091795a79336f520b0708457aacf55c67",
"versionType": "git"
},
{
"lessThan": "9449f99ba04f5dd1c8423ad8a90b3651d7240d1d",
"status": "affected",
"version": "b98535d091795a79336f520b0708457aacf55c67",
"versionType": "git"
},
{
"lessThan": "034053378dd81837fd6c7a43b37ee2e58d4f0b4e",
"status": "affected",
"version": "b98535d091795a79336f520b0708457aacf55c67",
"versionType": "git"
},
{
"lessThan": "c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe",
"status": "affected",
"version": "b98535d091795a79336f520b0708457aacf55c67",
"versionType": "git"
},
{
"lessThan": "08b10e6f37fc533a759e9833af0692242e8b3f93",
"status": "affected",
"version": "b98535d091795a79336f520b0708457aacf55c67",
"versionType": "git"
},
{
"lessThan": "d15e4b0a418537aafa56b2cb80d44add83e83697",
"status": "affected",
"version": "b98535d091795a79336f520b0708457aacf55c67",
"versionType": "git"
},
{
"status": "affected",
"version": "585ef03c9e79672781f954daae730dfe24bf3a46",
"versionType": "git"
},
{
"status": "affected",
"version": "afe490e48d47df1b3f64012835c1bc2f075a8c8b",
"versionType": "git"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.38",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.114",
"versionType": "semver"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/super.c",
"fs/ext4/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\"ext4: fix bug_on in start_this_handle during umount\nfilesystem\") moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -\u003e sysfs_notify() which\naccesses the kobject\u0027s kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n update_super_work ext4_put_super\n ----------------- --------------\n ext4_unregister_sysfs(sb)\n kobject_del(\u0026sbi-\u003es_kobj)\n __kobject_del()\n sysfs_remove_dir()\n kobj-\u003esd = NULL\n sysfs_put(sd)\n kernfs_put() // RCU free\n ext4_notify_error_sysfs(sbi)\n sysfs_notify(\u0026sbi-\u003es_kobj)\n kn = kobj-\u003esd // stale pointer\n kernfs_get(kn) // UAF on freed kernfs_node\n ext4_journal_destroy()\n flush_work(\u0026sbi-\u003es_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ext4 paths are reached through local filesystem operations such as mounting/unmounting an ext4 image, reading ext4 procfs state, or writing ext4 sysfs controls; there is no direct network packet path.\nAC:L - The race is between queued ext4 superblock error work and teardown, and a crafted/ext4-error scenario can repeatedly drive the work while unmount/cleanup proceeds; under the required rule, this attacker-influenced race is Low complexity.\nPR:N - Directly initiating mount/umount or sysfs error injection requires CAP_SYS_ADMIN in the initial namespace, but a highest-severity reasonable scenario is an attacker-supplied crafted ext4 filesystem image mounted/unmounted by a victim or privileged automounter, requiring no attacker privilege.\nUI:R - Exploitation in the no-attacker-privilege scenario requires a victim or privileged system component to mount and later unmount/process the malicious ext4 filesystem image.\nS:U - The corruption occurs inside the kernel filesystem/sysfs/kernfs lifetime management for the same host kernel security authority; it is not a VM escape or cross-authority boundary break.\nC:H - The bug is a use-after-free of a kernfs_node reached through sysfs_notify after kobject deletion, and kernel UAFs are treated as capable of enabling high-impact information disclosure.\nI:H - The stale kernfs_node is refcounted and used after free, giving a memory-corruption primitive that is defensibly treated as potentially exploitable for kernel control-flow or data modification.\nA:H - At minimum the UAF can crash or oops the kernel during ext4 unmount/error-work processing, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:36.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3"
},
{
"url": "https://git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff"
},
{
"url": "https://git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d"
},
{
"url": "https://git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e"
},
{
"url": "https://git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe"
},
{
"url": "https://git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93"
},
{
"url": "https://git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697"
}
],
"title": "ext4: fix use-after-free in update_super_work when racing with umount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31446",
"datePublished": "2026-04-22T13:53:42.751Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-08-05T12:22:36.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31447 (GCVE-0-2026-31447)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
EPSS
VEX
Title
ext4: reject mount if bigalloc with s_first_data_block != 0
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: reject mount if bigalloc with s_first_data_block != 0
bigalloc with s_first_data_block != 0 is not supported, reject mounting
it.
Severity
7.8 (High)
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/5ad6d994255e27a32… | |
| https://git.kernel.org/stable/c/3a926957cc95899ef… | |
| https://git.kernel.org/stable/c/7b58c110b4e1f028e… | |
| https://git.kernel.org/stable/c/b77de3fceafbb39f3… | |
| https://git.kernel.org/stable/c/d787d3ae96648dc14… | |
| https://git.kernel.org/stable/c/ad1f6d608f33f59d2… | |
| https://git.kernel.org/stable/c/7d5b04290156c3fc3… | |
| https://git.kernel.org/stable/c/3822743dc20386d98… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
281b59959707dfae03ce038cdf231bf4904e170c , < 5ad6d994255e27a3254079dfb50ca861fc31f2d0
(git)
Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < 3a926957cc95899ef88529710836edadc03c71a1 (git) Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < 7b58c110b4e1f028eb38eec9ed3555e9be81c8b0 (git) Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < b77de3fceafbb39f30e4ff5dc986f863d5456417 (git) Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < d787d3ae96648dc14a3b7ca8fde817177e82c1c7 (git) Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < ad1f6d608f33f59d21a3d025615d6786a6443998 (git) Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < 7d5b04290156c3fc316eecc86a4f9d201ab7d44a (git) Affected: 281b59959707dfae03ce038cdf231bf4904e170c , < 3822743dc20386d9897e999dbb990befa3a5b3f8 (git) |
|
| Linux | Linux |
Affected:
3.2
Unaffected: 0 , < 3.2 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:53.009Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ad6d994255e27a3254079dfb50ca861fc31f2d0",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "3a926957cc95899ef88529710836edadc03c71a1",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "7b58c110b4e1f028eb38eec9ed3555e9be81c8b0",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "b77de3fceafbb39f30e4ff5dc986f863d5456417",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "d787d3ae96648dc14a3b7ca8fde817177e82c1c7",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "ad1f6d608f33f59d21a3d025615d6786a6443998",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "7d5b04290156c3fc316eecc86a4f9d201ab7d44a",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "3822743dc20386d9897e999dbb990befa3a5b3f8",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ext4 code is reached through local filesystem mount and file-operation paths on an attacker-controlled ext4 image or block device, not through a network protocol.\nAC:L - The attacker controls the filesystem geometry and extent layout, and the reported trigger is deterministic after mounting and operating on the crafted filesystem; no race or external timing condition is required.\nPR:N - Direct mounting is gated by CAP_SYS_ADMIN in the initial user namespace because ext4 lacks FS_USERNS_MOUNT, but in the attacker-supplied filesystem scenario the privileged mount is performed by the victim or system automounter. The attacker does not need their own kernel privileges.\nUI:R - Exploitation requires a victim or privileged mounting path to mount the crafted ext4 filesystem and perform an operation such as unlink/truncate on it.\nS:U - The impact remains within the kernel/filesystem security authority; this is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is a use-after-free in ext4 extent metadata handling, and UAF conditions can expose reused memory contents or be shaped into broader kernel information disclosure.\nI:H - The faulty cluster arithmetic can free and reuse metadata blocks still referenced by extents, creating memory/filesystem metadata corruption that is defensibly exploitable for high-integrity impact.\nA:H - The observed failure is a KASAN use-after-free in ext4_ext_remove_space and can crash or destabilize the kernel, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:37.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ad6d994255e27a3254079dfb50ca861fc31f2d0"
},
{
"url": "https://git.kernel.org/stable/c/3a926957cc95899ef88529710836edadc03c71a1"
},
{
"url": "https://git.kernel.org/stable/c/7b58c110b4e1f028eb38eec9ed3555e9be81c8b0"
},
{
"url": "https://git.kernel.org/stable/c/b77de3fceafbb39f30e4ff5dc986f863d5456417"
},
{
"url": "https://git.kernel.org/stable/c/d787d3ae96648dc14a3b7ca8fde817177e82c1c7"
},
{
"url": "https://git.kernel.org/stable/c/ad1f6d608f33f59d21a3d025615d6786a6443998"
},
{
"url": "https://git.kernel.org/stable/c/7d5b04290156c3fc316eecc86a4f9d201ab7d44a"
},
{
"url": "https://git.kernel.org/stable/c/3822743dc20386d9897e999dbb990befa3a5b3f8"
}
],
"title": "ext4: reject mount if bigalloc with s_first_data_block != 0",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31447",
"datePublished": "2026-04-22T13:53:43.467Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-08-05T12:22:37.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31448 (GCVE-0-2026-31448)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
EPSS
VEX
Title
ext4: avoid infinite loops caused by residual data
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid infinite loops caused by residual data
On the mkdir/mknod path, when mapping logical blocks to physical blocks,
if inserting a new extent into the extent tree fails (in this example,
because the file system disabled the huge file feature when marking the
inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to
reclaim the physical block without deleting the corresponding data in
the extent tree. This causes subsequent mkdir operations to reference
the previously reclaimed physical block number again, even though this
physical block is already being used by the xattr block. Therefore, a
situation arises where both the directory and xattr are using the same
buffer head block in memory simultaneously.
The above causes ext4_xattr_block_set() to enter an infinite loop about
"inserted" and cannot release the inode lock, ultimately leading to the
143s blocking problem mentioned in [1].
If the metadata is corrupted, then trying to remove some extent space
can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE
was passed, remove space wrongly update quota information.
Jan Kara suggests distinguishing between two cases:
1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully
consistent and we must maintain its consistency including all the
accounting. However these errors can happen only early before we've
inserted the extent into the extent tree. So current code works correctly
for this case.
2) Some other error - this means metadata is corrupted. We should strive to
do as few modifications as possible to limit damage. So I'd just skip
freeing of allocated blocks.
[1]
INFO: task syz.0.17:5995 blocked for more than 143 seconds.
Call Trace:
inode_lock_nested include/linux/fs.h:1073 [inline]
__start_dirop fs/namei.c:2923 [inline]
start_dirop fs/namei.c:2934 [inline]
Severity
9.4 (Critical)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/c66545e83a802c385… | |
| https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6… | |
| https://git.kernel.org/stable/c/3a7667595bcad84da… | |
| https://git.kernel.org/stable/c/416c86f30f91b4fb2… | |
| https://git.kernel.org/stable/c/64f425b06b3bea9ab… | |
| https://git.kernel.org/stable/c/5422fe71d26d42af6… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
315054f023d28ee64f308adf8b5737831541776b , < c66545e83a802c3851d9be27a41c0479dd29ff0c
(git)
Affected: 315054f023d28ee64f308adf8b5737831541776b , < ecc50bfca9b5c2ee6aeef998181689b80477367b (git) Affected: 315054f023d28ee64f308adf8b5737831541776b , < 3a7667595bcad84da53fc156a418e110267c3412 (git) Affected: 315054f023d28ee64f308adf8b5737831541776b , < 416c86f30f91b4fb2642ef6b102596ca898f41a5 (git) Affected: 315054f023d28ee64f308adf8b5737831541776b , < 64f425b06b3bea9abc8977fd3982779b3ad070c9 (git) Affected: 315054f023d28ee64f308adf8b5737831541776b , < 5422fe71d26d42af6c454ca9527faaad4e677d6c (git) |
|
| Linux | Linux |
Affected:
2.6.22
Unaffected: 0 , < 2.6.22 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:54.473Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c66545e83a802c3851d9be27a41c0479dd29ff0c",
"status": "affected",
"version": "315054f023d28ee64f308adf8b5737831541776b",
"versionType": "git"
},
{
"lessThan": "ecc50bfca9b5c2ee6aeef998181689b80477367b",
"status": "affected",
"version": "315054f023d28ee64f308adf8b5737831541776b",
"versionType": "git"
},
{
"lessThan": "3a7667595bcad84da53fc156a418e110267c3412",
"status": "affected",
"version": "315054f023d28ee64f308adf8b5737831541776b",
"versionType": "git"
},
{
"lessThan": "416c86f30f91b4fb2642ef6b102596ca898f41a5",
"status": "affected",
"version": "315054f023d28ee64f308adf8b5737831541776b",
"versionType": "git"
},
{
"lessThan": "64f425b06b3bea9abc8977fd3982779b3ad070c9",
"status": "affected",
"version": "315054f023d28ee64f308adf8b5737831541776b",
"versionType": "git"
},
{
"lessThan": "5422fe71d26d42af6c454ca9527faaad4e677d6c",
"status": "affected",
"version": "315054f023d28ee64f308adf8b5737831541776b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid infinite loops caused by residual data\n\nOn the mkdir/mknod path, when mapping logical blocks to physical blocks,\nif inserting a new extent into the extent tree fails (in this example,\nbecause the file system disabled the huge file feature when marking the\ninode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to\nreclaim the physical block without deleting the corresponding data in\nthe extent tree. This causes subsequent mkdir operations to reference\nthe previously reclaimed physical block number again, even though this\nphysical block is already being used by the xattr block. Therefore, a\nsituation arises where both the directory and xattr are using the same\nbuffer head block in memory simultaneously.\n\nThe above causes ext4_xattr_block_set() to enter an infinite loop about\n\"inserted\" and cannot release the inode lock, ultimately leading to the\n143s blocking problem mentioned in [1].\n\nIf the metadata is corrupted, then trying to remove some extent space\ncan do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE\nwas passed, remove space wrongly update quota information.\nJan Kara suggests distinguishing between two cases:\n\n1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully\nconsistent and we must maintain its consistency including all the\naccounting. However these errors can happen only early before we\u0027ve\ninserted the extent into the extent tree. So current code works correctly\nfor this case.\n\n2) Some other error - this means metadata is corrupted. We should strive to\ndo as few modifications as possible to limit damage. So I\u0027d just skip\nfreeing of allocated blocks.\n\n[1]\nINFO: task syz.0.17:5995 blocked for more than 143 seconds.\nCall Trace:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable ext4 path is reachable through VFS mkdir/mknod/xattr operations, and the same operations can be driven remotely through in-kernel file servers such as ksmbd or nfsd on an ext4-backed writable export. A network-accessible writable share is a reasonable severe deployment scenario.\nAC:L - No race or probabilistic exploitation condition is required; once the affected ext4 state exists, the attacker can repeatedly drive the create/xattr sequence that reaches the stale extent mapping. The attacker controls the filesystem operations that trigger the hang.\nPR:N - In the most severe reasonable deployment, a guest/anonymous writable network export can expose the needed create operations without prior authentication. Locally, the same path only needs ordinary write permission on the directory, not kernel capabilities.\nUI:N - The attacker can trigger the vulnerable operations directly by issuing filesystem requests. No separate victim action is required in the network-export scenario.\nS:U - The impact remains within the Linux kernel/filesystem security authority. There is no VM escape, IOMMU bypass, or other cross-scope boundary crossing.\nC:L - The stale block aliasing can cause filesystem metadata/xattr contents to be interpreted through the wrong object, giving a plausible limited metadata disclosure risk. It is not a kernel memory arbitrary-read primitive.\nI:H - The bug creates a double-use physical block situation where directory and xattr metadata share the same buffer, allowing attacker-driven filesystem operations to corrupt security-relevant filesystem metadata. Given uncertainty about controllability of the aliased xattr block, the higher severity integrity value is selected.\nA:H - The observed failure is an infinite loop while holding inode locks, causing hung tasks for more than 143 seconds and repeatable filesystem denial of service. Kernel hung-task/deadlock conditions are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:38.829Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c66545e83a802c3851d9be27a41c0479dd29ff0c"
},
{
"url": "https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b"
},
{
"url": "https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412"
},
{
"url": "https://git.kernel.org/stable/c/416c86f30f91b4fb2642ef6b102596ca898f41a5"
},
{
"url": "https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9"
},
{
"url": "https://git.kernel.org/stable/c/5422fe71d26d42af6c454ca9527faaad4e677d6c"
}
],
"title": "ext4: avoid infinite loops caused by residual data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31448",
"datePublished": "2026-04-22T13:53:44.129Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-08-05T12:22:38.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31450 (GCVE-0-2026-31450)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
EPSS
VEX
Title
ext4: publish jinode after initialization
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: publish jinode after initialization
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
allowing a reader to observe a non-NULL jinode with i_vfs_inode
still unset.
The fast commit flush path can then pass this jinode to
jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
may crash.
Below is the crash I observe:
```
BUG: unable to handle page fault for address: 000000010beb47f4
PGD 110e51067 P4D 110e51067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
RIP: 0010:xas_find_marked+0x3d/0x2e0
Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02
RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246
RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003
RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10
RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec
R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000
R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88
FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
filemap_get_folios_tag+0x87/0x2a0
__filemap_fdatawait_range+0x5f/0xd0
? srso_alias_return_thunk+0x5/0xfbef5
? __schedule+0x3e7/0x10c0
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? cap_safe_nice+0x37/0x70
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
filemap_fdatawait_range_keep_errors+0x12/0x40
ext4_fc_commit+0x697/0x8b0
? ext4_file_write_iter+0x64b/0x950
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? vfs_write+0x356/0x480
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
ext4_sync_file+0xf7/0x370
do_fsync+0x3b/0x80
? syscall_trace_enter+0x108/0x1d0
__x64_sys_fdatasync+0x16/0x20
do_syscall_64+0x62/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
...
```
Fix this by initializing the jbd2_inode first.
Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after
initialization. Readers use READ_ONCE() to fetch the pointer.
Severity
8.8 (High)
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/2d2b648960147d078… | |
| https://git.kernel.org/stable/c/e4325e84727e539c8… | |
| https://git.kernel.org/stable/c/be54c0055407a73b6… | |
| https://git.kernel.org/stable/c/a070d5a872ffe0e0f… | |
| https://git.kernel.org/stable/c/e76bcb727e4874a2f… | |
| https://git.kernel.org/stable/c/4855a59e21789c79f… | |
| https://git.kernel.org/stable/c/33f486987af21531a… | |
| https://git.kernel.org/stable/c/1aec30021edd410b9… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a361293f5fedea0016a10599f409631a15d47ee7 , < 2d2b648960147d078b000b9a7494017082024366
(git)
Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < e4325e84727e539c8597bd5b8491349f57f7fb17 (git) Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < be54c0055407a73b60349c093c8ce621cb8fa232 (git) Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < a070d5a872ffe0e0fe5c46eda6386140ded39adb (git) Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < e76bcb727e4874a2f9d0297f8e3f8eced89b0764 (git) Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < 4855a59e21789c79f003a9b5f4135c95a7495c6b (git) Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < 33f486987af21531a7b18973d11795ede3da9ddd (git) Affected: a361293f5fedea0016a10599f409631a15d47ee7 , < 1aec30021edd410b986c156f195f3d23959a9d11 (git) |
|
| Linux | Linux |
Affected:
3.11
Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:55.794Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/fast_commit.c",
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d2b648960147d078b000b9a7494017082024366",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "e4325e84727e539c8597bd5b8491349f57f7fb17",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "be54c0055407a73b60349c093c8ce621cb8fa232",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "a070d5a872ffe0e0fe5c46eda6386140ded39adb",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "e76bcb727e4874a2f9d0297f8e3f8eced89b0764",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "4855a59e21789c79f003a9b5f4135c95a7495c6b",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "33f486987af21531a7b18973d11795ede3da9ddd",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "1aec30021edd410b986c156f195f3d23959a9d11",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/fast_commit.c",
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei-\u003ejinode to concurrent users.\nIt used to set ei-\u003ejinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode-\u003ei_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f \u003c49\u003e 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei-\u003ejinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable server deployment, an ext4 filesystem with fast commits can be exported through in-kernel NFS or ksmbd, whose remote write/commit/flush paths call VFS fsync into ext4. Remote clients can therefore reach the vulnerable fast-commit flush path over the network.\nAC:L - The bug is a race, but the attacker can drive both sides with concurrent open/write/truncate and fsync/fdatasync or network flush/commit operations. Fast commit being enabled is a deployment condition for the affected ext4 configuration, not an uncontrollable exploitation condition.\nPR:L - The attacker needs permission to write and sync a file on the affected ext4 filesystem or exported share. No kernel capability or administrator privilege is required once such filesystem access is available.\nUI:N - Exploitation is triggered entirely by attacker-controlled file operations. No separate victim action is required.\nS:U - The impact remains within the vulnerable kernel and filesystem security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The race exposes an uninitialized slab-allocated jbd2_inode to consumers, allowing stale kernel pointers and ranges to be interpreted by writeback/wait paths. Under the required higher-severity rule, this UAF-like invalid object use is treated as capable of enabling kernel memory disclosure primitives.\nI:H - The same stale jbd2_inode fields can drive ext4/jbd2 writeback callbacks through an invalid or stale inode pointer. Under the required higher-severity rule, this kernel object misuse is treated as potentially exploitable for memory corruption or arbitrary modification.\nA:H - The demonstrated failure is a kernel oops/page fault in the fast commit fsync path. A local or remote authorized attacker can repeatedly trigger the crash, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:40.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366"
},
{
"url": "https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17"
},
{
"url": "https://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232"
},
{
"url": "https://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adb"
},
{
"url": "https://git.kernel.org/stable/c/e76bcb727e4874a2f9d0297f8e3f8eced89b0764"
},
{
"url": "https://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6b"
},
{
"url": "https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9ddd"
},
{
"url": "https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11"
}
],
"title": "ext4: publish jinode after initialization",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31450",
"datePublished": "2026-04-22T13:53:45.532Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-08-05T12:22:40.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…