Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0519
Vulnerability from certfr_avis - Published: 2026-04-30 - Updated: 2026-04-30
De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure Linux | azl3 cups 2.4.16-1 versions antérieures à 2.4.18-1 | ||
| Microsoft | Azure Linux | azl3 kernel 6.6.130.1-3 versions antérieures à 6.6.134.1-2 | ||
| Microsoft | Azure Linux | azl3 ruby 3.3.5-7 versions antérieures à 3.3.5-8 | ||
| Microsoft | Azure Linux | azl3 libgcrypt 1.10.3-1 versions antérieures à 1.10.3-2 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "azl3 cups 2.4.16-1 versions ant\u00e9rieures \u00e0 2.4.18-1",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kernel 6.6.130.1-3 versions ant\u00e9rieures \u00e0 6.6.134.1-2",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 ruby 3.3.5-7 versions ant\u00e9rieures \u00e0 3.3.5-8",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libgcrypt 1.10.3-1 versions ant\u00e9rieures \u00e0 1.10.3-2",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-31483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31483"
},
{
"name": "CVE-2026-31522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31522"
},
{
"name": "CVE-2026-31467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31467"
},
{
"name": "CVE-2026-31485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31485"
},
{
"name": "CVE-2026-31453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31453"
},
{
"name": "CVE-2026-31593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31593"
},
{
"name": "CVE-2026-31600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31600"
},
{
"name": "CVE-2026-31473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31473"
},
{
"name": "CVE-2026-31528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31528"
},
{
"name": "CVE-2026-31448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31448"
},
{
"name": "CVE-2026-31680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31680"
},
{
"name": "CVE-2026-31447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31447"
},
{
"name": "CVE-2026-31524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31524"
},
{
"name": "CVE-2026-31510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31510"
},
{
"name": "CVE-2026-31496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31496"
},
{
"name": "CVE-2026-31591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31591"
},
{
"name": "CVE-2026-31525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31525"
},
{
"name": "CVE-2026-31563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31563"
},
{
"name": "CVE-2026-41989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
},
{
"name": "CVE-2026-31566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31566"
},
{
"name": "CVE-2026-31494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31494"
},
{
"name": "CVE-2026-31565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31565"
},
{
"name": "CVE-2026-31609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31609"
},
{
"name": "CVE-2026-31469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31469"
},
{
"name": "CVE-2026-31520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31520"
},
{
"name": "CVE-2026-31601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31601"
},
{
"name": "CVE-2026-31620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31620"
},
{
"name": "CVE-2026-31555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31555"
},
{
"name": "CVE-2026-23360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23360"
},
{
"name": "CVE-2026-31515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31515"
},
{
"name": "CVE-2026-23414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23414"
},
{
"name": "CVE-2026-31523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31523"
},
{
"name": "CVE-2026-31450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31450"
},
{
"name": "CVE-2026-31608",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31608"
},
{
"name": "CVE-2026-31675",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31675"
},
{
"name": "CVE-2026-31521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31521"
},
{
"name": "CVE-2026-31518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31518"
},
{
"name": "CVE-2026-31504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31504"
},
{
"name": "CVE-2026-31509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31509"
},
{
"name": "CVE-2026-27820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27820"
},
{
"name": "CVE-2026-31679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31679"
},
{
"name": "CVE-2026-31621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31621"
},
{
"name": "CVE-2026-31497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31497"
},
{
"name": "CVE-2026-31682",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31682"
},
{
"name": "CVE-2026-31570",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31570"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-31441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31441"
},
{
"name": "CVE-2026-31444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31444"
},
{
"name": "CVE-2026-31495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31495"
},
{
"name": "CVE-2026-31507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31507"
},
{
"name": "CVE-2026-31476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31476"
},
{
"name": "CVE-2026-31674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31674"
},
{
"name": "CVE-2026-31458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31458"
},
{
"name": "CVE-2026-31589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31589"
},
{
"name": "CVE-2026-31678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31678"
},
{
"name": "CVE-2026-31503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31503"
},
{
"name": "CVE-2026-31455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31455"
},
{
"name": "CVE-2026-31474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31474"
},
{
"name": "CVE-2026-31519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31519"
},
{
"name": "CVE-2026-41079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41079"
},
{
"name": "CVE-2026-31439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31439"
},
{
"name": "CVE-2026-31446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31446"
},
{
"name": "CVE-2026-31500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31500"
},
{
"name": "CVE-2026-31454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31454"
},
{
"name": "CVE-2026-31452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31452"
}
],
"initial_release_date": "2026-04-30T00:00:00",
"last_revision_date": "2026-04-30T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0519",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-04-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Azure Linux. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure Linux",
"vendor_advisories": [
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31682",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31682"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31451",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31451"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31454",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31454"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31570",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31570"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31515",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31515"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31476",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31476"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31620",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31620"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31600",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31600"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31680",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31680"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31467",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31467"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31522",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31522"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31450",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31450"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23360",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23360"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31452",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31452"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31507",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31507"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31504",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31504"
},
{
"published_at": "2026-04-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31563",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31563"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31495",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31495"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31474",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31474"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31439",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31439"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31485",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31485"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31500",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31500"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31496",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31496"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31520",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31520"
},
{
"published_at": "2026-04-24",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41989",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41989"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31679",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31679"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31608",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31608"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31483",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31483"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31494",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31494"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31447",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31447"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31593",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31593"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31473",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31473"
},
{
"published_at": "2026-04-18",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-27820",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27820"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31675",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31675"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31555",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31555"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31523",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31523"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31589",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31589"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31678",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31678"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31528",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31528"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31444",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31444"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31519",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31519"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31510",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31510"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31609",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31609"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31469",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31469"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31448",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31448"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31674",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31674"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31524",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31524"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31453",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31453"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31601",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31601"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31441",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31441"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31591",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31591"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31455",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31455"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31518",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31518"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31566",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31566"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31509",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31509"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31446",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31446"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31497",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31497"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31565",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31565"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41079",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41079"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23414",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23414"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31458",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31458"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31521",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31521"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31503",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31503"
},
{
"published_at": "2026-04-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31621",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31621"
},
{
"published_at": "2026-04-23",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31525",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31525"
}
]
}
CVE-2026-31451 (GCVE-0-2026-31451)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-11-05 21:44
VLAI
EPSS
VEX
Title
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
Replace BUG_ON() with proper error handling when inline data size
exceeds PAGE_SIZE. This prevents kernel panic and allows the system to
continue running while properly reporting the filesystem corruption.
The error is logged via ext4_error_inode(), the buffer head is released
to prevent memory leak, and -EFSCORRUPTED is returned to indicate
filesystem corruption.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:33 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/3462a3f0716d27af5… | |
| https://git.kernel.org/stable/c/636e8d85a36ab6c31… | |
| https://git.kernel.org/stable/c/af25a6affeac4919e… | |
| https://git.kernel.org/stable/c/65c6c30ce6362c1c6… | |
| https://git.kernel.org/stable/c/d4b3f370c3d8f7ce5… | |
| https://git.kernel.org/stable/c/823849a26af089ffc… | |
| https://git.kernel.org/stable/c/a7d600e04732a7d29… | |
| https://git.kernel.org/stable/c/356227096eb66e41b… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
46c7f254543dedcf134ad05091ed2b935a9a597d , < 3462a3f0716d27af51896dc8688bcf0628fb17ee
(git)
Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < 636e8d85a36ab6c31aafd04ee66a69b18eebee7b (git) Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < af25a6affeac4919e8d8c5cccc01a9d53478447e (git) Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < 65c6c30ce6362c1c684568744ea510c921a756cd (git) Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed (git) Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < 823849a26af089ffc5dfdd2ae4b9d446b46a0cda (git) Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < a7d600e04732a7d29b107c91fe3aec64cf6ce7f2 (git) Affected: 46c7f254543dedcf134ad05091ed2b935a9a597d , < 356227096eb66e41b23caf7045e6304877322edf (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
Affected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:16:25.058Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:33:45.502116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:44:59.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3462a3f0716d27af51896dc8688bcf0628fb17ee",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "636e8d85a36ab6c31aafd04ee66a69b18eebee7b",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "af25a6affeac4919e8d8c5cccc01a9d53478447e",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "65c6c30ce6362c1c684568744ea510c921a756cd",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "823849a26af089ffc5dfdd2ae4b9d446b46a0cda",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "a7d600e04732a7d29b107c91fe3aec64cf6ce7f2",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "356227096eb66e41b23caf7045e6304877322edf",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:31.661Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee"
},
{
"url": "https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b"
},
{
"url": "https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e"
},
{
"url": "https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd"
},
{
"url": "https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed"
},
{
"url": "https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda"
},
{
"url": "https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2"
},
{
"url": "https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf"
}
],
"title": "ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31451",
"datePublished": "2026-04-22T13:53:46.243Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-11-05T21:44:59.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31452 (GCVE-0-2026-31452)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-11-05 21:44
VLAI
EPSS
VEX
Title
ext4: convert inline data to extents when truncate exceeds inline size
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: convert inline data to extents when truncate exceeds inline size
Add a check in ext4_setattr() to convert files from inline data storage
to extent-based storage when truncate() grows the file size beyond the
inline capacity. This prevents the filesystem from entering an
inconsistent state where the inline data flag is set but the file size
exceeds what can be stored inline.
Without this fix, the following sequence causes a kernel BUG_ON():
1. Mount filesystem with inode that has inline flag set and small size
2. truncate(file, 50MB) - grows size but inline flag remains set
3. sendfile() attempts to write data
4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
The crash occurs because ext4_write_inline_data() expects inline storage
to accommodate the write, but the actual inline capacity (~60 bytes for
i_block + ~96 bytes for xattrs) is far smaller than the file size and
write request.
The fix checks if the new size from setattr exceeds the inode's actual
inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to
extent-based storage before proceeding with the size change.
This addresses the root cause by ensuring the inline data flag and file
size remain consistent during truncate operations.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:33 UTC
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/110d7ef602659ce4d… | |
| https://git.kernel.org/stable/c/f53a5d9f32924bc2a… | |
| https://git.kernel.org/stable/c/c047332be7195833a… | |
| https://git.kernel.org/stable/c/699bac4d4c951974d… | |
| https://git.kernel.org/stable/c/7920dcc571cef3d8a… | |
| https://git.kernel.org/stable/c/93cb2d103e5c707de… | |
| https://git.kernel.org/stable/c/07c1a31af18290054… | |
| https://git.kernel.org/stable/c/ed9356a30e59c7cc3… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
67cf5b09a46f72e048501b84996f2f77bc42e947 , < 110d7ef602659ce4d7947c5480f7ca2779696aaf
(git)
Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < f53a5d9f32924bc2a810d2df243b7714da58b636 (git) Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < c047332be7195833a5c5126816c2502df8269fe4 (git) Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < 699bac4d4c951974d55b045c983d1de777215949 (git) Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < 7920dcc571cef3d8aa9ee109c136125d61d41669 (git) Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < 93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6 (git) Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < 07c1a31af18290054da3d18221b8bf58983c5d3a (git) Affected: 67cf5b09a46f72e048501b84996f2f77bc42e947 , < ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 (git) |
|
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.7 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.7 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.7 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:16:26.796Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:33:52.534537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:44:59.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "110d7ef602659ce4d7947c5480f7ca2779696aaf",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "f53a5d9f32924bc2a810d2df243b7714da58b636",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "c047332be7195833a5c5126816c2502df8269fe4",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "699bac4d4c951974d55b045c983d1de777215949",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "7920dcc571cef3d8aa9ee109c136125d61d41669",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "07c1a31af18290054da3d18221b8bf58983c5d3a",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "ed9356a30e59c7cc3198e7fc46cfedf3767b9b17",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u003e inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode\u0027s actual\ninline capacity (EXT4_I(inode)-\u003ei_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:58.941Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf"
},
{
"url": "https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636"
},
{
"url": "https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4"
},
{
"url": "https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949"
},
{
"url": "https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669"
},
{
"url": "https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6"
},
{
"url": "https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a"
},
{
"url": "https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17"
}
],
"title": "ext4: convert inline data to extents when truncate exceeds inline size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31452",
"datePublished": "2026-04-22T13:53:46.917Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-11-05T21:44:59.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31453 (GCVE-0-2026-31453)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-10-19 18:35
VLAI
EPSS
VEX
Title
xfs: avoid dereferencing log items after push callbacks
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: avoid dereferencing log items after push callbacks
After xfsaild_push_item() calls iop_push(), the log item may have been
freed if the AIL lock was dropped during the push. Background inode
reclaim or the dquot shrinker can free the log item while the AIL lock
is not held, and the tracepoints in the switch statement dereference
the log item after iop_push() returns.
Fix this by capturing the log item type, flags, and LSN before calling
xfsaild_push_item(), and introducing a new xfs_ail_push_class trace
event class that takes these pre-captured values and the ailp pointer
instead of the log item pointer.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:09 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/c8a2ab339b88d10fc… | |
| https://git.kernel.org/stable/c/7121b22b0bac89394… | |
| https://git.kernel.org/stable/c/c4d603e8e58a3bf35… | |
| https://git.kernel.org/stable/c/95fb5d643cc70959b… | |
| https://git.kernel.org/stable/c/451c6329d9afa4586… | |
| https://git.kernel.org/stable/c/79ef34ec0554ec04b… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
90c60e16401248a4900f3f9387f563d0178dcf34 , < c8a2ab339b88d10fc34a3318c92f07d8a467019d
(git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 7121b22b0bac89394cc4c6a54b5aebc15347bdf5 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < c4d603e8e58a3bf35480135ccca2b4f7238abda5 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 95fb5d643cc70959baa54cd17f52f80ffc3295e7 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 451c6329d9afa45862c36fe6677eb7750db60617 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 79ef34ec0554ec04bdbafafbc9836423734e1bd6 (git) |
|
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:09:37.370268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:35:49.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_trace.h",
"fs/xfs/xfs_trans_ail.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8a2ab339b88d10fc34a3318c92f07d8a467019d",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "7121b22b0bac89394cc4c6a54b5aebc15347bdf5",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "c4d603e8e58a3bf35480135ccca2b4f7238abda5",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "95fb5d643cc70959baa54cd17f52f80ffc3295e7",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "451c6329d9afa45862c36fe6677eb7750db60617",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "79ef34ec0554ec04bdbafafbc9836423734e1bd6",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_trace.h",
"fs/xfs/xfs_trans_ail.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid dereferencing log items after push callbacks\n\nAfter xfsaild_push_item() calls iop_push(), the log item may have been\nfreed if the AIL lock was dropped during the push. Background inode\nreclaim or the dquot shrinker can free the log item while the AIL lock\nis not held, and the tracepoints in the switch statement dereference\nthe log item after iop_push() returns.\n\nFix this by capturing the log item type, flags, and LSN before calling\nxfsaild_push_item(), and introducing a new xfs_ail_push_class trace\nevent class that takes these pre-captured values and the ailp pointer\ninstead of the log item pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable XFS AIL push path is reached through local filesystem activity on a mounted XFS filesystem, via syscalls such as ioctl/setattr, create/unlink, writes, and reclaim-triggering workload. It is not reachable directly over a network, adjacent, or physical interface.\nAC:L - A local attacker can generate dirty/reclaimable inode or dquot log items and induce reclaim or pressure while xfsaild pushes the AIL. The race is between attacker-influenced filesystem workload and kernel background paths, so under the higher-severity rule this is low complexity.\nPR:L - An unprivileged local user with ordinary access to files on an existing XFS mount can feed the AIL with log items and trigger reclaim behavior. Mounting XFS itself needs elevated privileges, but exploiting an already-mounted writable XFS filesystem does not require init-namespace root.\nUI:N - No victim interaction is required once the attacker has local access to the XFS filesystem. The vulnerable xfsaild work runs asynchronously in the kernel.\nS:U - The vulnerability affects the kernel and filesystem state within the same local security authority. It does not cross a virtualization, IOMMU, or separate security-scope boundary.\nC:H - This is a kernel use-after-free of XFS log-item memory after push callbacks can free the object. Under the required scoring guidance, use-after-free conditions are treated as high confidentiality impact because reclaimed object contents can enable kernel memory disclosure.\nI:H - The freed log-item memory can be reclaimed and attacker-influenced before kernel dereference, giving a plausible path to stronger heap exploitation primitives. Under the required scoring guidance, kernel use-after-free conditions are scored as high integrity impact.\nA:H - The bug is a KASAN-confirmed slab use-after-free in xfsaild and can crash or panic the kernel. Kernel crashes are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:42.104Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d"
},
{
"url": "https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5"
},
{
"url": "https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5"
},
{
"url": "https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7"
},
{
"url": "https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617"
},
{
"url": "https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6"
}
],
"title": "xfs: avoid dereferencing log items after push callbacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31453",
"datePublished": "2026-04-22T13:53:47.577Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-10-19T18:35:49.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31454 (GCVE-0-2026-31454)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-10-19 18:35
VLAI
EPSS
VEX
Title
xfs: save ailp before dropping the AIL lock in push callbacks
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: save ailp before dropping the AIL lock in push callbacks
In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock
is dropped to perform buffer IO. Once the cluster buffer no longer
protects the log item from reclaim, the log item may be freed by
background reclaim or the dquot shrinker. The subsequent spin_lock()
call dereferences lip->li_ailp, which is a use-after-free.
Fix this by saving the ailp pointer in a local variable while the AIL
lock is held and the log item is guaranteed to be valid.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:09 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/edd1637d4e3911ab6… | |
| https://git.kernel.org/stable/c/19437e4f7bb909afd… | |
| https://git.kernel.org/stable/c/6dbe17f19c290a72c… | |
| https://git.kernel.org/stable/c/75669e987137f49c9… | |
| https://git.kernel.org/stable/c/d8fc60bbaf5aea160… | |
| https://git.kernel.org/stable/c/50f5f056807b7bed7… | |
| https://git.kernel.org/stable/c/4c7d50147316cf049… | |
| https://git.kernel.org/stable/c/394d70b86fae9fe86… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
90c60e16401248a4900f3f9387f563d0178dcf34 , < edd1637d4e3911ab6c760f553f2040fe72f61a13
(git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 19437e4f7bb909afde832b39372aa2f3ce3cfd88 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 75669e987137f49c99ca44406bf0200d1892dd16 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 50f5f056807b7bed74f4f307f2ca0ed92f3e556d (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 4c7d50147316cf049462f327c4a3e9dc2b7f1dd0 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 394d70b86fae9fe865e7e6d9540b7696f73aa9b6 (git) |
|
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:09:39.757301Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:35:49.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_dquot_item.c",
"fs/xfs/xfs_inode_item.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "edd1637d4e3911ab6c760f553f2040fe72f61a13",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "19437e4f7bb909afde832b39372aa2f3ce3cfd88",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "75669e987137f49c99ca44406bf0200d1892dd16",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "50f5f056807b7bed74f4f307f2ca0ed92f3e556d",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "4c7d50147316cf049462f327c4a3e9dc2b7f1dd0",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "394d70b86fae9fe865e7e6d9540b7696f73aa9b6",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_dquot_item.c",
"fs/xfs/xfs_inode_item.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: save ailp before dropping the AIL lock in push callbacks\n\nIn xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock\nis dropped to perform buffer IO. Once the cluster buffer no longer\nprotects the log item from reclaim, the log item may be freed by\nbackground reclaim or the dquot shrinker. The subsequent spin_lock()\ncall dereferences lip-\u003eli_ailp, which is a use-after-free.\n\nFix this by saving the ailp pointer in a local variable while the AIL\nlock is held and the log item is guaranteed to be valid."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable XFS AIL push callbacks are reached through local filesystem activity on a mounted XFS filesystem, such as creating, modifying, unlinking, or quota-affecting files. There is no direct network or physical protocol entry point in XFS for this bug.\nAC:L - The race is between xfsaild dropping the AIL lock and inode/dquot reclaim freeing the log item, and an attacker can drive both sides with filesystem churn, AIL pressure, and memory pressure. Syzkaller reproduced this as a kernel slab use-after-free, so no rare external condition is required.\nPR:L - A basic unprivileged local user with write access to an existing XFS filesystem can generate inode and dquot log items through normal VFS operations; no XFS-specific CAP_SYS_ADMIN ioctl path is required. XFS is not user-namespace mountable, but exploiting an already mounted writable XFS filesystem does not require real root.\nUI:N - No victim action is needed beyond the attacker issuing local filesystem operations. The vulnerable callback runs asynchronously in the per-mount xfsaild kernel thread.\nS:U - The impact remains within the same kernel security authority. This is a standard local kernel memory-safety issue, not a guest-to-host or cross-sandbox boundary bypass by itself.\nC:H - The bug is a kernel slab use-after-free of XFS log-item memory after reclaim can free the object. Conservatively, kernel UAFs can be shaped for memory disclosure, so confidentiality impact is high.\nI:H - The stale log item is dereferenced after free and used to reacquire a spinlock through data read from freed memory, making this a plausible kernel memory corruption primitive. Following the required overestimate rule for UAFs, integrity impact is high.\nA:H - The observed failure is a KASAN slab-use-after-free in xfs_inode_item_push from xfsaild, which can crash or destabilize the kernel. Repeated triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:43.178Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/edd1637d4e3911ab6c760f553f2040fe72f61a13"
},
{
"url": "https://git.kernel.org/stable/c/19437e4f7bb909afde832b39372aa2f3ce3cfd88"
},
{
"url": "https://git.kernel.org/stable/c/6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5"
},
{
"url": "https://git.kernel.org/stable/c/75669e987137f49c99ca44406bf0200d1892dd16"
},
{
"url": "https://git.kernel.org/stable/c/d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d"
},
{
"url": "https://git.kernel.org/stable/c/50f5f056807b7bed74f4f307f2ca0ed92f3e556d"
},
{
"url": "https://git.kernel.org/stable/c/4c7d50147316cf049462f327c4a3e9dc2b7f1dd0"
},
{
"url": "https://git.kernel.org/stable/c/394d70b86fae9fe865e7e6d9540b7696f73aa9b6"
}
],
"title": "xfs: save ailp before dropping the AIL lock in push callbacks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31454",
"datePublished": "2026-04-22T13:53:48.242Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-10-19T18:35:49.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31455 (GCVE-0-2026-31455)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-11-05 21:44
VLAI
EPSS
VEX
Title
xfs: stop reclaim before pushing AIL during unmount
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: stop reclaim before pushing AIL during unmount
The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while
background reclaim and inodegc are still running. This is broken
independently of any use-after-free issues - background reclaim and
inodegc should not be running while the AIL is being pushed during
unmount, as inodegc can dirty and insert inodes into the AIL during the
flush, and background reclaim can race to abort and free dirty inodes.
Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background
reclaim before pushing the AIL. Stop inodegc before cancelling
m_reclaim_work because the inodegc worker can re-queue m_reclaim_work
via xfs_inodegc_set_reclaimable.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:33 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/e6cc490048f78b009… | |
| https://git.kernel.org/stable/c/239d734c006440728… | |
| https://git.kernel.org/stable/c/bda27fc0b4eb3a425… | |
| https://git.kernel.org/stable/c/d38135af04a3ad8a5… | |
| https://git.kernel.org/stable/c/a89434a6188d8430e… | |
| https://git.kernel.org/stable/c/8147e304d7d32fd5c… | |
| https://git.kernel.org/stable/c/558e3275d8a3b101b… | |
| https://git.kernel.org/stable/c/4f24a767e3d64a5f5… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
90c60e16401248a4900f3f9387f563d0178dcf34 , < e6cc490048f78b009259a5f032acead9f789c34c
(git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 239d734c00644072862fa833805c4471573b1445 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < bda27fc0b4eb3a425d9a18475c4cb94fbe862c60 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < d38135af04a3ad8a585c899d176efc8e97853115 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < a89434a6188d8430ea31120da96e3e4cefb58686 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 8147e304d7d32fd5c3e943babc296ce2873dc279 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 558e3275d8a3b101be18a7fe7d1634053e9d9b07 (git) Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 (git) |
|
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:33:58.259693Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:44:59.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_mount.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e6cc490048f78b009259a5f032acead9f789c34c",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "239d734c00644072862fa833805c4471573b1445",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "bda27fc0b4eb3a425d9a18475c4cb94fbe862c60",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "d38135af04a3ad8a585c899d176efc8e97853115",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "a89434a6188d8430ea31120da96e3e4cefb58686",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "8147e304d7d32fd5c3e943babc296ce2873dc279",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "558e3275d8a3b101be18a7fe7d1634053e9d9b07",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
},
{
"lessThan": "4f24a767e3d64a5f58c595b5c29b6063a201f1e3",
"status": "affected",
"version": "90c60e16401248a4900f3f9387f563d0178dcf34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_mount.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:03.235Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c"
},
{
"url": "https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445"
},
{
"url": "https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60"
},
{
"url": "https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115"
},
{
"url": "https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686"
},
{
"url": "https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279"
},
{
"url": "https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07"
},
{
"url": "https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3"
}
],
"title": "xfs: stop reclaim before pushing AIL during unmount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31455",
"datePublished": "2026-04-22T13:53:48.914Z",
"dateReserved": "2026-03-09T15:48:24.092Z",
"dateUpdated": "2026-11-05T21:44:59.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31458 (GCVE-0-2026-31458)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-11-05 21:44
VLAI
EPSS
VEX
Title
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
Multiple sysfs command paths dereference contexts_arr[0] without first
verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to
0 via sysfs while DAMON is running, causing NULL pointer dereferences.
In more detail, the issue can be triggered by privileged users like
below.
First, start DAMON and make contexts directory empty
(kdamond->contexts->nr == 0).
# damo start
# cd /sys/kernel/mm/damon/admin/kdamonds/0
# echo 0 > contexts/nr_contexts
Then, each of below commands will cause the NULL pointer dereference.
# echo update_schemes_stats > state
# echo update_schemes_tried_regions > state
# echo update_schemes_tried_bytes > state
# echo update_schemes_effective_quotas > state
# echo update_tuned_intervals > state
Guard all commands (except OFF) at the entry point of
damon_sysfs_handle_cmd().
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:34 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0ac32b8affb5a384253dbb8339bd2d0e91add0b7 , < aba546061341b56e9ffb37e1eb661a3628b6ec12
(git)
Affected: 0ac32b8affb5a384253dbb8339bd2d0e91add0b7 , < 1e8da792672481d603fa7cd0d815577220a3ee27 (git) Affected: 0ac32b8affb5a384253dbb8339bd2d0e91add0b7 , < 708033c231bd782858f4ddbb46ee874a5a5fbdab (git) Affected: 0ac32b8affb5a384253dbb8339bd2d0e91add0b7 , < bbe03ad3fb9e714191757ca7b41582f930be7be2 (git) Affected: 0ac32b8affb5a384253dbb8339bd2d0e91add0b7 , < 1bfe9fb5ed2667fb075682408b776b5273162615 (git) |
|
| Linux | Linux |
Affected:
5.18
Unaffected: 0 , < 5.18 (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31458",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:34:11.121096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:44:59.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/damon/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aba546061341b56e9ffb37e1eb661a3628b6ec12",
"status": "affected",
"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7",
"versionType": "git"
},
{
"lessThan": "1e8da792672481d603fa7cd0d815577220a3ee27",
"status": "affected",
"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7",
"versionType": "git"
},
{
"lessThan": "708033c231bd782858f4ddbb46ee874a5a5fbdab",
"status": "affected",
"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7",
"versionType": "git"
},
{
"lessThan": "bbe03ad3fb9e714191757ca7b41582f930be7be2",
"status": "affected",
"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7",
"versionType": "git"
},
{
"lessThan": "1bfe9fb5ed2667fb075682408b776b5273162615",
"status": "affected",
"version": "0ac32b8affb5a384253dbb8339bd2d0e91add0b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/damon/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts-\u003enr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond-\u003econtexts-\u003enr == 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond-\u003econtexts-\u003enr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 \u003e contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats \u003e state\n # echo update_schemes_tried_regions \u003e state\n # echo update_schemes_tried_bytes \u003e state\n # echo update_schemes_effective_quotas \u003e state\n # echo update_tuned_intervals \u003e state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:07.003Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12"
},
{
"url": "https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27"
},
{
"url": "https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab"
},
{
"url": "https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2"
},
{
"url": "https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"
}
],
"title": "mm/damon/sysfs: check contexts-\u003enr before accessing contexts_arr[0]",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31458",
"datePublished": "2026-04-22T13:53:50.883Z",
"dateReserved": "2026-03-09T15:48:24.092Z",
"dateUpdated": "2026-11-05T21:44:59.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31467 (GCVE-0-2026-31467)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
EPSS
VEX
Title
erofs: add GFP_NOIO in the bio completion if needed
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: add GFP_NOIO in the bio completion if needed
The bio completion path in the process context (e.g. dm-verity)
will directly call into decompression rather than trigger another
workqueue context for minimal scheduling latencies, which can
then call vm_map_ram() with GFP_KERNEL.
Due to insufficient memory, vm_map_ram() may generate memory
swapping I/O, which can cause submit_bio_wait to deadlock
in some scenarios.
Trimmed down the call stack, as follows:
f2fs_submit_read_io
submit_bio //bio_list is initialized.
mmc_blk_mq_recovery
z_erofs_endio
vm_map_ram
__pte_alloc_kernel
__alloc_pages_direct_reclaim
shrink_folio_list
__swap_writepage
submit_bio_wait //bio_list is non-NULL, hang!!!
Use memalloc_noio_{save,restore}() to wrap up this path.
Severity
7.5 (High)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/d6565ea662e17d45a… | |
| https://git.kernel.org/stable/c/d9d8360cb66e3b599… | |
| https://git.kernel.org/stable/c/5c8ecdcfbfb0b0c6a… | |
| https://git.kernel.org/stable/c/378949f46e8972043… | |
| https://git.kernel.org/stable/c/da40464064599eefe… | |
| https://git.kernel.org/stable/c/e83e20b82859f0588… | |
| https://git.kernel.org/stable/c/c23df30915f83e725… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
648f2de053a882c87c05f0060f47d3b11841fdbe , < d6565ea662e17d45a577184b0011bd69de22dc2b
(git)
Affected: 648f2de053a882c87c05f0060f47d3b11841fdbe , < d9d8360cb66e3b599d89d2526e7da8b530ebf2ff (git) Affected: 648f2de053a882c87c05f0060f47d3b11841fdbe , < 5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902 (git) Affected: 648f2de053a882c87c05f0060f47d3b11841fdbe , < 378949f46e897204384f3f5f91e42e93e3f87568 (git) Affected: 648f2de053a882c87c05f0060f47d3b11841fdbe , < da40464064599eefe78749f75cd2bba371044c04 (git) Affected: 648f2de053a882c87c05f0060f47d3b11841fdbe , < e83e20b82859f0588e9a52a6fa9fea704a2061cf (git) Affected: 648f2de053a882c87c05f0060f47d3b11841fdbe , < c23df30915f83e7257c8625b690a1cece94142a0 (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6565ea662e17d45a577184b0011bd69de22dc2b",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
},
{
"lessThan": "d9d8360cb66e3b599d89d2526e7da8b530ebf2ff",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
},
{
"lessThan": "5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
},
{
"lessThan": "378949f46e897204384f3f5f91e42e93e3f87568",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
},
{
"lessThan": "da40464064599eefe78749f75cd2bba371044c04",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
},
{
"lessThan": "e83e20b82859f0588e9a52a6fa9fea704a2061cf",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
},
{
"lessThan": "c23df30915f83e7257c8625b690a1cece94142a0",
"status": "affected",
"version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n submit_bio //bio_list is initialized.\n mmc_blk_mq_recovery\n z_erofs_endio\n vm_map_ram\n __pte_alloc_kernel\n __alloc_pages_direct_reclaim\n shrink_folio_list\n __swap_writepage\n submit_bio_wait //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - EROFS is exportable and remote NFS clients can cause kernel VFS reads of exported compressed EROFS files, reaching the same compressed read and bio completion path without local code execution. Scoring the highest reasonable deployment therefore uses Network.\nAC:L - Given a target using compressed EROFS with process-context bio completions such as dm-verity, the attacker can repeatedly issue reads and create memory pressure to drive vm_map_ram() into reclaim. No attacker-uncontrolled race or precise memory layout is required.\nPR:N - In the network-export scenario, an unauthenticated or anonymous read-only NFS client can trigger READ operations that run in kernel nfsd context. EROFS itself adds no privilege gate beyond normal export and file read permissions.\nUI:N - The attacker can trigger the vulnerable path by issuing read requests; no victim user action is required.\nS:U - The deadlock occurs within the kernel filesystem, block I/O, and memory reclaim paths of the same system security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The bug is an allocation-context deadlock caused by reclaim issuing swap I/O while current-\u003ebio_list is active. It does not expose kernel memory or provide a read primitive.\nI:N - The fix only prevents I/O-generating reclaim during decompression, and the vulnerable behavior is a hang rather than memory corruption. There is no data modification or control-flow hijack primitive.\nA:H - The failure mode is a deadlock in submit_bio_wait with bios queued behind an active submit_bio path, which can hang I/O/reclaim and render the system or service unavailable. Kernel deadlocks are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:46.421Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6565ea662e17d45a577184b0011bd69de22dc2b"
},
{
"url": "https://git.kernel.org/stable/c/d9d8360cb66e3b599d89d2526e7da8b530ebf2ff"
},
{
"url": "https://git.kernel.org/stable/c/5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902"
},
{
"url": "https://git.kernel.org/stable/c/378949f46e897204384f3f5f91e42e93e3f87568"
},
{
"url": "https://git.kernel.org/stable/c/da40464064599eefe78749f75cd2bba371044c04"
},
{
"url": "https://git.kernel.org/stable/c/e83e20b82859f0588e9a52a6fa9fea704a2061cf"
},
{
"url": "https://git.kernel.org/stable/c/c23df30915f83e7257c8625b690a1cece94142a0"
}
],
"title": "erofs: add GFP_NOIO in the bio completion if needed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31467",
"datePublished": "2026-04-22T13:53:56.910Z",
"dateReserved": "2026-03-09T15:48:24.097Z",
"dateUpdated": "2026-08-05T12:22:46.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31469 (GCVE-0-2026-31469)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-10-19 18:35
VLAI
EPSS
VEX
Title
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
expects the driver to hold the reference to skb->dst until the packet
is fully transmitted and freed. In virtio_net with napi_tx=N,
skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending,
the corresponding dst_ops structure has freed. When a subsequent packet
is transmitted, free_old_xmit() is triggered to clean up old skbs.
It then calls dst_release() on the skb associated with the stale dst_entry.
Since the dst_ops (referenced by the dst_entry) has already been freed,
a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
the dst reference before the skb is queued in virtio_net.
Call Trace:
Unable to handle kernel paging request at virtual address ffff80007e150000
CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
...
percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
dst_release+0xe0/0x110 net/core/dst.c:177
skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
__free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio
tc filter add dev $NETDEV parent 1:0 \
protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100
}
test_ns() {
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns
}
config_qdisc_route_filter
test_ns
sleep 2
test_ns
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:09 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/be0e63f3b97bbaf45… | |
| https://git.kernel.org/stable/c/c1ec36cb3768574b9… | |
| https://git.kernel.org/stable/c/8a4790850e710fd67… | |
| https://git.kernel.org/stable/c/fedd2e1630cac9208… | |
| https://git.kernel.org/stable/c/f04733c4dc40c4389… | |
| https://git.kernel.org/stable/c/9a18629f2525781f0… | |
| https://git.kernel.org/stable/c/63d45077b97bb0e0f… | |
| https://git.kernel.org/stable/c/ba8bda9a089674605… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… | |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < be0e63f3b97bbaf453c542e8a15ba2a536e2ac01
(git)
Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < c1ec36cb3768574b916f20d2d7415fd14fa1bf12 (git) Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < 8a4790850e710fd6771e4d2112168ed1dd6c0e54 (git) Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < fedd2e1630cac920844997227ccbe7b26a76375a (git) Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < f04733c4dc40c43899c3d1c97afbae5831a3770f (git) Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < 9a18629f2525781f0f3dda7be72b204e4cf77d08 (git) Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < 63d45077b97bb0e0fe0c75931acbbca7a47af141 (git) Affected: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 , < ba8bda9a0896746053aa97ac6c3e08168729172c (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.7 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.7 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.7 , < *
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:16:30.489Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:09:47.364337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:35:49.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be0e63f3b97bbaf453c542e8a15ba2a536e2ac01",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "c1ec36cb3768574b916f20d2d7415fd14fa1bf12",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "8a4790850e710fd6771e4d2112168ed1dd6c0e54",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "fedd2e1630cac920844997227ccbe7b26a76375a",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "f04733c4dc40c43899c3d1c97afbae5831a3770f",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "9a18629f2525781f0f3dda7be72b204e4cf77d08",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "63d45077b97bb0e0fe0c75931acbbca7a47af141",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "ba8bda9a0896746053aa97ac6c3e08168729172c",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device\u0027s IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb-\u003edst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n ...\n percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n dst_release+0xe0/0x110 net/core/dst.c:177\n skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]\n free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n ...\n\nReproduction Steps:\nNETDEV=\"enp3s0\"\n\nconfig_qdisc_route_filter() {\n tc qdisc del dev $NETDEV root\n tc qdisc add dev $NETDEV root handle 1: prio\n tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n ip netns add testns\n ip link set $NETDEV netns testns\n ip netns exec testns ifconfig $NETDEV 10.0.32.46/24\n ip netns exec testns ping -c 1 10.0.32.1\n ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable virtio_net transmit/free path is reached through local packet transmission plus local netlink/ethtool namespace setup on a virtio_net interface. Remote traffic alone does not provide the required control over tc/qdisc, TX NAPI state, and namespace/device lifecycle.\nAC:L - The required conditions are attacker-controllable once the attacker has the needed network administration rights: disable TX NAPI, clear IFF_XMIT_DST_RELEASE via tc route filtering, queue packets, destroy the namespace, then trigger another transmit. There is no uncontrollable race; the pending-ring timing can be induced with normal traffic.\nPR:L - The setup requires CAP_NET_ADMIN for tc/qdisc, ethtool coalescing, and net namespace/device operations. In a reasonable delegated container or network-namespace deployment with a virtio_net interface, that maps to low privileges rather than init-namespace root, and uncertainty is resolved toward higher severity.\nUI:N - No victim user action is required after the attacker has the relevant local privileges. The attacker can perform the configuration, traffic generation, namespace teardown, and retrigger steps directly.\nS:U - The bug is in the kernel networking/virtio_net path and impacts the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary by itself.\nC:H - This is a use-after-free involving dst_ops referenced from an skb-held dst_entry after namespace teardown. Kernel UAFs are treated as high confidentiality impact because freed object reuse can enable memory disclosure primitives.\nI:H - The stale dst_ops/percpu-counter access is memory corruption in kernel context. As a kernel UAF, it is defensibly treated as exploitable for control-flow or write-primitive development.\nA:H - The reported failure is a kernel paging request/oops in dst_release via free_old_xmit. Even without full exploitation, the UAF can crash the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:48.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be0e63f3b97bbaf453c542e8a15ba2a536e2ac01"
},
{
"url": "https://git.kernel.org/stable/c/c1ec36cb3768574b916f20d2d7415fd14fa1bf12"
},
{
"url": "https://git.kernel.org/stable/c/8a4790850e710fd6771e4d2112168ed1dd6c0e54"
},
{
"url": "https://git.kernel.org/stable/c/fedd2e1630cac920844997227ccbe7b26a76375a"
},
{
"url": "https://git.kernel.org/stable/c/f04733c4dc40c43899c3d1c97afbae5831a3770f"
},
{
"url": "https://git.kernel.org/stable/c/9a18629f2525781f0f3dda7be72b204e4cf77d08"
},
{
"url": "https://git.kernel.org/stable/c/63d45077b97bb0e0fe0c75931acbbca7a47af141"
},
{
"url": "https://git.kernel.org/stable/c/ba8bda9a0896746053aa97ac6c3e08168729172c"
}
],
"title": "virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31469",
"datePublished": "2026-04-22T13:53:58.266Z",
"dateReserved": "2026-03-09T15:48:24.097Z",
"dateUpdated": "2026-10-19T18:35:49.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31473 (GCVE-0-2026-31473)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-10-19 18:35
VLAI
EPSS
VEX
Title
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)
queue teardown paths. This can race request object cleanup against vb2
queue cancellation and lead to use-after-free reports.
We already serialize request queueing against STREAMON/OFF with
req_queue_mutex. Extend that serialization to REQBUFS, and also take
the same mutex in media_request_ioctl_reinit() so REINIT is in the
same exclusion domain.
This keeps request cleanup and queue cancellation from running in
parallel for request-capable devices.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:09 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/331242998a7ade5c2… | |
| https://git.kernel.org/stable/c/2c685e99efb3b3bd2… | |
| https://git.kernel.org/stable/c/585fd9a2063dacce8… | |
| https://git.kernel.org/stable/c/1a0d9083c24fbd5d2… | |
| https://git.kernel.org/stable/c/d8549a453d5bdc0a7… | |
| https://git.kernel.org/stable/c/72b9e81e0203f03c4… | |
| https://git.kernel.org/stable/c/cf2023e84f0888f96… | |
| https://git.kernel.org/stable/c/bef4f4a88b73e4cc5… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < 331242998a7ade5c2f65e14988901614629f3db5
(git)
Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < 2c685e99efb3b3bd2b78699fba6b1cf321975db0 (git) Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < 585fd9a2063dacce8b2820f675ef23d5d17434c5 (git) Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < 1a0d9083c24fbd5d22f7100f09d11e4d696a5f01 (git) Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < d8549a453d5bdc0a71de66ad47a1106703406a56 (git) Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < 72b9e81e0203f03c40f3adb457f55bd4c8eb112d (git) Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < cf2023e84f0888f96f4b65dc0804e7f3651969c1 (git) Affected: 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 , < bef4f4a88b73e4cc550d25f665b8a9952af22773 (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31473",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:09:53.356132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:35:50.197Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/mc/mc-request.c",
"drivers/media/v4l2-core/v4l2-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "331242998a7ade5c2f65e14988901614629f3db5",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "2c685e99efb3b3bd2b78699fba6b1cf321975db0",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "585fd9a2063dacce8b2820f675ef23d5d17434c5",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "1a0d9083c24fbd5d22f7100f09d11e4d696a5f01",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "d8549a453d5bdc0a71de66ad47a1106703406a56",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "72b9e81e0203f03c40f3adb457f55bd4c8eb112d",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "cf2023e84f0888f96f4b65dc0804e7f3651969c1",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
},
{
"lessThan": "bef4f4a88b73e4cc550d25f665b8a9952af22773",
"status": "affected",
"version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/mc/mc-request.c",
"drivers/media/v4l2-core/v4l2-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable paths are reached through local `ioctl()` calls on media/video device file descriptors: `MEDIA_REQUEST_IOC_REINIT` on a request fd and `VIDIOC_REQBUFS(0)` on a V4L2 video fd. The affected code is not reachable directly from network packets or adjacent/physical protocol input.\nAC:L - This is a race, but an attacker controls both racing operations by issuing concurrent ioctls from local threads or processes. No condition beyond access to a request-capable media device is required.\nPR:L - The kernel path has no capability or admin check; the attacker only needs ordinary local ability to open the relevant `/dev/media*` and `/dev/video*` nodes. This is basic local privilege rather than real root/admin privilege.\nUI:N - Once the attacker can run local code and open the device nodes, exploitation is driven entirely by attacker-issued ioctls. No separate victim action is required.\nS:U - The vulnerability corrupts kernel media/videobuf2 request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is a use-after-free involving media request objects and vb2 buffer/request state during concurrent cleanup and queue teardown. Per kernel CVSS guidance, UAF memory corruption can be leveraged for kernel memory disclosure, so confidentiality impact is high.\nI:H - The race can corrupt freed kernel heap objects and request/buffer state, giving a plausible path to control-flow or arbitrary-write style exploitation. Per kernel CVSS guidance, use-after-free memory corruption warrants high integrity impact.\nA:H - The fix commit explicitly addresses use-after-free reports, and such kernel UAFs can reliably trigger KASAN reports, oopses, or panics. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:51.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"
},
{
"url": "https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"
},
{
"url": "https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"
},
{
"url": "https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"
},
{
"url": "https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"
},
{
"url": "https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"
},
{
"url": "https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"
},
{
"url": "https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"
}
],
"title": "media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31473",
"datePublished": "2026-04-22T13:54:00.970Z",
"dateReserved": "2026-03-09T15:48:24.098Z",
"dateUpdated": "2026-10-19T18:35:50.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31474 (GCVE-0-2026-31474)
Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-10-19 18:35
VLAI
EPSS
VEX
Title
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access
to so->tx.buf. isotp_release() waits for ISOTP_IDLE via
wait_event_interruptible() and then calls kfree(so->tx.buf).
If a signal interrupts the wait_event_interruptible() inside close()
while tx.state is ISOTP_SENDING, the loop exits early and release
proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf)
while sendmsg may still be reading so->tx.buf for the final CAN frame
in isotp_fill_dataframe().
The so->tx.buf can be allocated once when the standard tx.buf length needs
to be extended. Move the kfree() of this potentially extended tx.buf to
sk_destruct time when either isotp_sendmsg() and isotp_release() are done.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:09 UTC
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://git.kernel.org/stable/c/cb3d6efa78460e6d5… | |
| https://git.kernel.org/stable/c/9649d051e54413049… | |
| https://git.kernel.org/stable/c/eec8a1b18a79600bd… | |
| https://git.kernel.org/stable/c/2e62e7051eca75a7f… | |
| https://git.kernel.org/stable/c/424e95d62110cdbc8… | |
| https://access.redhat.com/security/cve/CVE-2026-31474 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2460646 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:27731 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:27288 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:27789 | vendor-advisoryx_refsource_REDHAT |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
96d1c81e6a0478535342dff6c730adb076cd84e8 , < cb3d6efa78460e6d50bf68806d0db66265709f64
(git)
Affected: 96d1c81e6a0478535342dff6c730adb076cd84e8 , < 9649d051e54413049c009638ec1dc23962c884a4 (git) Affected: 96d1c81e6a0478535342dff6c730adb076cd84e8 , < eec8a1b18a79600bd4419079dc0026c1db72a830 (git) Affected: 96d1c81e6a0478535342dff6c730adb076cd84e8 , < 2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c (git) Affected: 96d1c81e6a0478535342dff6c730adb076cd84e8 , < 424e95d62110cdbc8fd12b40918f37e408e35a92 (git) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:6.12.0-211.26.1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:6.12.0-55.82.1.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:5.14.0-687.17.1.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.26.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.82.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.17.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Controller Area Network (CAN) ISO-TP (isotp) module. This vulnerability, known as a use-after-free, occurs when the system attempts to free a memory region while it is still being used. A local attacker could trigger this condition by sending a signal that interrupts a specific waiting process during a close operation. This can lead to memory corruption, potentially causing the system to crash (denial of service) or behave unpredictably."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-364",
"description": "Signal Handler Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:09:14.681Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-31474"
},
{
"name": "RHBZ#2460646",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460646"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-22T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-22T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()",
"workarounds": [
{
"lang": "en",
"value": "Systems which do not require it can blocklist the `can_isotp` module to prevent it from being loaded. See https://access.redhat.com/solutions/41278 for more information."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:09:55.947236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:35:50.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb3d6efa78460e6d50bf68806d0db66265709f64",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "9649d051e54413049c009638ec1dc23962c884a4",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "eec8a1b18a79600bd4419079dc0026c1db72a830",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "424e95d62110cdbc8fd12b40918f37e408e35a92",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix tx.buf use-after-free in isotp_sendmsg()\n\nisotp_sendmsg() uses only cmpxchg() on so-\u003etx.state to serialize access\nto so-\u003etx.buf. isotp_release() waits for ISOTP_IDLE via\nwait_event_interruptible() and then calls kfree(so-\u003etx.buf).\n\nIf a signal interrupts the wait_event_interruptible() inside close()\nwhile tx.state is ISOTP_SENDING, the loop exits early and release\nproceeds to force ISOTP_SHUTDOWN and continues to kfree(so-\u003etx.buf)\nwhile sendmsg may still be reading so-\u003etx.buf for the final CAN frame\nin isotp_fill_dataframe().\n\nThe so-\u003etx.buf can be allocated once when the standard tx.buf length needs\nto be extended. Move the kfree() of this potentially extended tx.buf to\nsk_destruct time when either isotp_sendmsg() and isotp_release() are done."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ISO-TP transmit path is reached through local socket syscalls such as socket/bind/sendmsg/close on an AF_CAN CAN_ISOTP socket. A CAN peer may influence flow control, but the bug requires a local process to create the socket, send the PDU, and interrupt close.\nAC:L - Once ISO-TP extended PDU buffers are available, the attacker controls the socket options, message size, close operation, and signal timing needed to hit the close-vs-transmit race. The race is between attacker-controlled local operations and in-kernel asynchronous transmit completion, so no uncontrollable external condition is required.\nPR:L - The AF_CAN CAN_ISOTP socket create, bind, setsockopt, sendmsg, and release paths do not impose a CAP_NET_ADMIN check. An unprivileged local user can reach the vulnerable code on a system with an available CAN interface or equivalent namespace/preconfigured CAN setup.\nUI:N - No victim action is needed once the attacker can run local code. The attacker can drive the send, close, and signal sequence directly.\nS:U - The issue is a kernel memory lifetime bug in the same operating-system security authority. It does not cross a VM, IOMMU, or separate sandbox boundary by itself.\nC:H - The freed tx.buf can be reused while the ISO-TP transmit path later reads from it into outgoing CAN frames, creating a kernel heap use-after-free information disclosure primitive. Under conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - This is kernel heap use-after-free memory corruption reachable by attacker-controlled timing and heap grooming. Following the required conservative UAF guidance, it is treated as potentially exploitable for high integrity impact.\nA:H - The stale freed buffer can be dereferenced asynchronously during frame construction after release, which can trigger kernel memory corruption symptoms including oops or panic. Repeated local triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:52.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64"
},
{
"url": "https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4"
},
{
"url": "https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830"
},
{
"url": "https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c"
},
{
"url": "https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92"
}
],
"title": "can: isotp: fix tx.buf use-after-free in isotp_sendmsg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31474",
"datePublished": "2026-04-22T13:54:03.100Z",
"dateReserved": "2026-03-09T15:48:24.098Z",
"dateUpdated": "2026-10-19T18:35:50.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…