Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0957
Vulnerability from certfr_avis - Published: 2026-07-31 - Updated: 2026-07-31
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 6.1.177-1~deb11u1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-63807",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63807"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-53391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53391"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64246"
},
{
"name": "CVE-2026-53163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53163"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-53327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53327"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-53383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53383"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-63817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63817"
},
{
"name": "CVE-2026-63795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63795"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-63833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63833"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-64254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64254"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-53139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53139"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-53362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53362"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-23302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23302"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-53388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53388"
},
{
"name": "CVE-2026-23278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23278"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-53359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53359"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-53384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53384"
},
{
"name": "CVE-2026-23272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23272"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-52928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52928"
},
{
"name": "CVE-2026-53366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53366"
},
{
"name": "CVE-2026-53390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53390"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
}
],
"initial_release_date": "2026-07-31T00:00:00",
"last_revision_date": "2026-07-31T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0957",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-31T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-07-26",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00042",
"url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00042.html"
}
]
}
CVE-2026-53383 (GCVE-0-2026-53383)
Vulnerability from cvelistv5 – Published: 2026-07-19 11:59 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
ksmbd: reject non-VALID session in compound request branch
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.
A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
\\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and
reaches ksmbd_ipc_tree_connect_request(), which dereferences
user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704)
-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
worker for all clients.
Reject any non-first compound operation that lands on a session which is
not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
but it is never carried as a non-first compound operation, so multi-leg
authentication is unaffected by this check.
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eb947403518ea3d93f6d89264bb1f5416bb0c7d0 , < 25ff12b82a376ff5c4583102a63d2456a6b9ebb9
(git)
Affected: 854156d12caa9d36de1cf5f084591c7686cc8a9d , < fc578523a72cb8b329d32070b95898e81613cc3f (git) Affected: 5005bcb4219156f1bf7587b185080ec1da08518e , < d2bbbb6c55812220fee5d801c275cc267ea3cbeb (git) Affected: 5005bcb4219156f1bf7587b185080ec1da08518e , < 8f0302fb691537d33ec8f668565257ea9d340ffe (git) Affected: 5005bcb4219156f1bf7587b185080ec1da08518e , < 7cad3ceaf679c55bc9946685dacafce78ce6b51a (git) Affected: 5005bcb4219156f1bf7587b185080ec1da08518e , < 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 (git) Affected: 5005bcb4219156f1bf7587b185080ec1da08518e , < 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 (git) Affected: 5005bcb4219156f1bf7587b185080ec1da08518e , < 609ca17d869d04ba249e32cdcbf13c0b1c66f43c (git) Affected: d1066c1b3663401cd23c0d6e60cdae750ce00c0f (git) Affected: 5.15.121 , < 5.15.211 (semver) Affected: 6.1.36 , < 6.1.177 (semver) Affected: 6.3.10 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25ff12b82a376ff5c4583102a63d2456a6b9ebb9",
"status": "affected",
"version": "eb947403518ea3d93f6d89264bb1f5416bb0c7d0",
"versionType": "git"
},
{
"lessThan": "fc578523a72cb8b329d32070b95898e81613cc3f",
"status": "affected",
"version": "854156d12caa9d36de1cf5f084591c7686cc8a9d",
"versionType": "git"
},
{
"lessThan": "d2bbbb6c55812220fee5d801c275cc267ea3cbeb",
"status": "affected",
"version": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
},
{
"lessThan": "8f0302fb691537d33ec8f668565257ea9d340ffe",
"status": "affected",
"version": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
},
{
"lessThan": "7cad3ceaf679c55bc9946685dacafce78ce6b51a",
"status": "affected",
"version": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
},
{
"lessThan": "06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7",
"status": "affected",
"version": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
},
{
"lessThan": "5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4",
"status": "affected",
"version": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
},
{
"lessThan": "609ca17d869d04ba249e32cdcbf13c0b1c66f43c",
"status": "affected",
"version": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
},
{
"status": "affected",
"version": "d1066c1b3663401cd23c0d6e60cdae750ce00c0f",
"versionType": "git"
},
{
"lessThan": "5.15.211",
"status": "affected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.36",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15.121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reject non-VALID session in compound request branch\n\nsmb2_check_user_session() takes a shortcut for any operation that is not\nthe first in a COMPOUND request: it reuses work-\u003esess (the session bound by\nthe first operation) and validates only the SessionId, then returns\n\"valid\". It never re-checks work-\u003esess-\u003estate == SMB2_SESSION_VALID, and a\nSessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation\nvalue) skips even the id comparison. The standalone path\n(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does\nenforce the VALID state; the compound branch bypasses all of it.\n\nA SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes\na fresh SMB2_SESSION_IN_PROGRESS session whose sess-\u003euser is still NULL\n(-\u003euser is assigned later, by ntlm_authenticate()). Used as operation 1 of\na COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,\n\\\\host\\IPC$), the tree-connect then runs on that IN_PROGRESS session and\nreaches ksmbd_ipc_tree_connect_request(), which dereferences\nuser_name(sess-\u003euser) with sess-\u003euser == NULL (transport_ipc.c:687/701/704)\n-\u003e remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd\nworker for all clients.\n\nReject any non-first compound operation that lands on a session which is\nnot SMB2_SESSION_VALID, mirroring the validity the standalone lookup path\nenforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,\nbut it is never carried as a non-first compound operation, so multi-leg\nauthentication is unaffected by this check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in ksmbd\u0027s SMB2 compound-request handler, reachable by any remote attacker who can send crafted SMB2 packets to TCP port 445 on a host running the in-kernel SMB server.\nAC:L - An attacker can reliably trigger the bug by sending a compound SMB2 request with SESSION_SETUP (NTLM Type-1 only) as the first operation and TREE_CONNECT (SessionId=0xFFFFFFFFFFFFFFFF, \\\\host\\IPC$) as the second; no special timing, memory layout, or victim state is required.\nPR:N - Exploitation requires only network access to ksmbd during the SMB2 authentication handshake, before sess-\u003euser is assigned; no Linux local account, capability, or prior authenticated OS session is needed.\nUI:N - No victim user action (opening files, mounting shares, clicking links) is required; the attacker triggers the crash solely by sending malicious SMB2 protocol traffic.\nS:U - The impact is a kernel oops and ksmbd worker disruption within the kernel/SMB server security authority; it does not cross a VM, container, or IOMMU boundary.\nC:N - The failure is a NULL pointer dereference on sess-\u003euser in ksmbd_ipc_tree_connect_request() when user_name(sess-\u003euser) is called with sess-\u003euser == NULL; this is a pure crash with no information disclosure.\nI:N - The bug causes a NULL pointer dereference only; there is no memory corruption, arbitrary write, or code-execution primitive\u2014only a kernel fault.\nA:H - The NULL dereference causes a kernel oops that wedges the shared ksmbd-io workqueue worker, denying SMB service to all clients connected through that worker and potentially panicking the host if panic_on_oops is enabled."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:33.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9"
},
{
"url": "https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f"
},
{
"url": "https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbeb"
},
{
"url": "https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffe"
},
{
"url": "https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51a"
},
{
"url": "https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7"
},
{
"url": "https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4"
},
{
"url": "https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43c"
}
],
"title": "ksmbd: reject non-VALID session in compound request branch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53383",
"datePublished": "2026-07-19T11:59:31.616Z",
"dateReserved": "2026-06-09T07:44:35.401Z",
"dateUpdated": "2026-08-17T04:50:33.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53384 (GCVE-0-2026-53384)
Vulnerability from cvelistv5 – Published: 2026-07-19 11:59 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
dw8250_probe() registers the 8250 port via serial8250_register_8250_port()
and then, if the device has a clock, registers a clock notifier. If
clk_notifier_register() fails, probe returns the error but leaves the
8250 port registered. The matching serial8250_unregister_port() lives
in dw8250_remove(), which is not called when probe fails, so the port
slot stays occupied until the device is rebound or the system is
rebooted. The devm-allocated driver data is freed while the port still
references it (via the saved private_data and serial_in/serial_out
callbacks), so any access to that port slot before a rebind is a
use-after-free hazard.
Unregister the port on the clk_notifier_register() error path.
Severity
9.8 (Critical)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
57f83e5dd6a33c4696699954784f8fee789b1d0c , < ccdf4510a3873b14e5e348cdb038717996f09fda
(git)
Affected: 57f83e5dd6a33c4696699954784f8fee789b1d0c , < 511d2b92f8d20de04acafab676150d26fb5c67f4 (git) Affected: 57f83e5dd6a33c4696699954784f8fee789b1d0c , < 07ffe414a708ae60551401cec5d727ed156b8caf (git) Affected: 57f83e5dd6a33c4696699954784f8fee789b1d0c , < 3d205fe80f2181f0109150ad1fa06ee5bc046935 (git) Affected: 57f83e5dd6a33c4696699954784f8fee789b1d0c , < d72650a4f334581b23a1892b888a4cb1be142f76 (git) Affected: 57f83e5dd6a33c4696699954784f8fee789b1d0c , < 778b9dda4b24005a27bcd9c35c110bf8d7f259ca (git) Affected: 57f83e5dd6a33c4696699954784f8fee789b1d0c , < 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 (git) |
|
| Linux | Linux |
Affected:
5.19
Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_dw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ccdf4510a3873b14e5e348cdb038717996f09fda",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
},
{
"lessThan": "511d2b92f8d20de04acafab676150d26fb5c67f4",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
},
{
"lessThan": "07ffe414a708ae60551401cec5d727ed156b8caf",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
},
{
"lessThan": "3d205fe80f2181f0109150ad1fa06ee5bc046935",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
},
{
"lessThan": "d72650a4f334581b23a1892b888a4cb1be142f76",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
},
{
"lessThan": "778b9dda4b24005a27bcd9c35c110bf8d7f259ca",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
},
{
"lessThan": "10fc708b4de7f86002d2d735a2dbf3b5b7f65692",
"status": "affected",
"version": "57f83e5dd6a33c4696699954784f8fee789b1d0c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_dw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_dw: unregister 8250 port if clk_notifier_register() fails\n\ndw8250_probe() registers the 8250 port via serial8250_register_8250_port()\nand then, if the device has a clock, registers a clock notifier. If\nclk_notifier_register() fails, probe returns the error but leaves the\n8250 port registered. The matching serial8250_unregister_port() lives\nin dw8250_remove(), which is not called when probe fails, so the port\nslot stays occupied until the device is rebound or the system is\nrebooted. The devm-allocated driver data is freed while the port still\nreferences it (via the saved private_data and serial_in/serial_out\ncallbacks), so any access to that port slot before a rebind is a\nuse-after-free hazard.\n\nUnregister the port on the clk_notifier_register() error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The UAF is reached when the registered 8250 port is exercised via tty/console/IRQ callbacks in dw8250_serial_in/out; on dw8250-equipped embedded/industrial systems (RZN1, StarFive, Intel PCH UARTs) serial ports are commonly bridged to TCP (ser2net, Modbus/SCADA gateways, BMC SOL), letting a remote attacker drive those kernel paths without physical UART access.\nAC:L - Once clk_notifier_register() fails during probe and devm frees dw8250_data while the port stays registered, any subsequent tty open, console write, or IRQ-driven handler reliably dereferences the dangling private_data and membase; no attacker-uncontrollable race or heap layout is required.\nPR:N - The corrupt state can arise automatically at boot when probe fails under memory pressure (no attacker action), and on typical embedded deployments the affected /dev/ttyS* is reachable via unauthenticated network serial bridges or world-accessible console nodes without Linux account privileges.\nUI:N - Exploitation requires no victim interaction beyond the attacker (or boot-time probe failure) accessing the already-registered port; no mount, plug-in, or UI action is needed.\nS:U - Impact is confined to kernel memory via the serial driver UAF; it does not cross VM, container, or IOMMU security boundaries into a separate authority.\nC:H - The bug leaves uart_port callbacks pointing at freed devm_kzalloc(dw8250_data) and freed devm_ioremap(membase), giving a kernel heap/IO-memory UAF that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same dangling private_data and membase pointers in serial_in/serial_out/IRQ handlers enable kernel heap corruption and control-flow hijack primitives typical of exploitable UAFs.\nA:H - Any access to the orphaned port slot (tty I/O, serial console output, or IRQ handling) dereferences freed driver data and can cause kernel oops/panic, especially if the port serves as boot console."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:34.893Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ccdf4510a3873b14e5e348cdb038717996f09fda"
},
{
"url": "https://git.kernel.org/stable/c/511d2b92f8d20de04acafab676150d26fb5c67f4"
},
{
"url": "https://git.kernel.org/stable/c/07ffe414a708ae60551401cec5d727ed156b8caf"
},
{
"url": "https://git.kernel.org/stable/c/3d205fe80f2181f0109150ad1fa06ee5bc046935"
},
{
"url": "https://git.kernel.org/stable/c/d72650a4f334581b23a1892b888a4cb1be142f76"
},
{
"url": "https://git.kernel.org/stable/c/778b9dda4b24005a27bcd9c35c110bf8d7f259ca"
},
{
"url": "https://git.kernel.org/stable/c/10fc708b4de7f86002d2d735a2dbf3b5b7f65692"
}
],
"title": "serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53384",
"datePublished": "2026-07-19T11:59:32.153Z",
"dateReserved": "2026-06-09T07:44:35.401Z",
"dateUpdated": "2026-08-17T04:50:34.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53385 (GCVE-0-2026-53385)
Vulnerability from cvelistv5 – Published: 2026-07-19 11:59 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
Summary
In the Linux kernel, the following vulnerability has been resolved:
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
A KASAN null-ptr-deref was observed in vcs_notifier():
BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}
The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).
Fix this by adding a NULL check for vc before calling vcs_scr_updated().
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
11dddfbb7a4e62489b01074d6c04d9d1b42e4047 , < 43a6281790273c1b0a9ab76609ff0245b968f1e6
(git)
Affected: e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67 , < b6bbb85cf45bf0b070e741997fe0af3a772c5ad5 (git) Affected: 3338d0b9acde770ee588eead5cac32c25e7048fc , < ff4806202749a51938236214adc0281481a57366 (git) Affected: 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 , < 8232fca738011ca2ec865b46ec721d1796dc0580 (git) Affected: 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 , < 73049768ad57145acd337102c5aa3c788e6642c8 (git) Affected: 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 , < 7cc3dd79777f6ae4625ec37e84dd18a26dc88bde (git) Affected: 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 , < 74be188eb2dc1c99d63986167b9a67d415fe7326 (git) Affected: 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 , < 09a43e81279b8da15526da09877134b8bcf618b0 (git) Affected: 8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357 , < a287620312dc6dcb9a093417a0e589bf30fcf38a (git) Affected: 934de9a9b659785fed3e820bc0c813a460c71fea (git) Affected: 0deff678157333d775af190f84696336cdcccd6d (git) Affected: a4e3c4c65ae8510e01352c9a4347e05c035b2ce2 (git) Affected: 1de42e7653d6714a7507ba6696151a1fa028c69f (git) Affected: 5.10.181 , < 5.10.260 (semver) Affected: 5.15.113 , < 5.15.211 (semver) Affected: 6.1.30 , < 6.1.177 (semver) Affected: 4.14.327 , < 4.15 (semver) Affected: 4.19.284 , < 4.20 (semver) Affected: 5.4.244 , < 5.5 (semver) Affected: 6.3.4 , < 6.4 (semver) |
|
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/vt/vc_screen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43a6281790273c1b0a9ab76609ff0245b968f1e6",
"status": "affected",
"version": "11dddfbb7a4e62489b01074d6c04d9d1b42e4047",
"versionType": "git"
},
{
"lessThan": "b6bbb85cf45bf0b070e741997fe0af3a772c5ad5",
"status": "affected",
"version": "e3d1adcad5b73c7ed0c7edb35ab68abcaa45cf67",
"versionType": "git"
},
{
"lessThan": "ff4806202749a51938236214adc0281481a57366",
"status": "affected",
"version": "3338d0b9acde770ee588eead5cac32c25e7048fc",
"versionType": "git"
},
{
"lessThan": "8232fca738011ca2ec865b46ec721d1796dc0580",
"status": "affected",
"version": "8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357",
"versionType": "git"
},
{
"lessThan": "73049768ad57145acd337102c5aa3c788e6642c8",
"status": "affected",
"version": "8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357",
"versionType": "git"
},
{
"lessThan": "7cc3dd79777f6ae4625ec37e84dd18a26dc88bde",
"status": "affected",
"version": "8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357",
"versionType": "git"
},
{
"lessThan": "74be188eb2dc1c99d63986167b9a67d415fe7326",
"status": "affected",
"version": "8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357",
"versionType": "git"
},
{
"lessThan": "09a43e81279b8da15526da09877134b8bcf618b0",
"status": "affected",
"version": "8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357",
"versionType": "git"
},
{
"lessThan": "a287620312dc6dcb9a093417a0e589bf30fcf38a",
"status": "affected",
"version": "8fb9ea65c9d1338b0d2bb0a9122dc942cdd32357",
"versionType": "git"
},
{
"status": "affected",
"version": "934de9a9b659785fed3e820bc0c813a460c71fea",
"versionType": "git"
},
{
"status": "affected",
"version": "0deff678157333d775af190f84696336cdcccd6d",
"versionType": "git"
},
{
"status": "affected",
"version": "a4e3c4c65ae8510e01352c9a4347e05c035b2ce2",
"versionType": "git"
},
{
"status": "affected",
"version": "1de42e7653d6714a7507ba6696151a1fa028c69f",
"versionType": "git"
},
{
"lessThan": "5.10.260",
"status": "affected",
"version": "5.10.181",
"versionType": "semver"
},
{
"lessThan": "5.15.211",
"status": "affected",
"version": "5.15.113",
"versionType": "semver"
},
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.327",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.284",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.244",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/vt/vc_screen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.10.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15.113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.327",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.284",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.244",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write\n\nA KASAN null-ptr-deref was observed in vcs_notifier():\n\nBUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130\nRead of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}\n\nThe issue is a race condition in vcs_write(). When the console_lock is\ntemporarily dropped (to copy data from userspace), the vc_data pointer\nobtained from vcs_vc() may become stale. After re-acquiring the lock,\nvcs_vc() is called again to re-validate the pointer. If the vc has been\ndeallocated in the meantime, vcs_vc() returns NULL, and the while loop\nbreaks (with written \u003e 0). However, after the loop, vcs_scr_updated(vc)\nis still called with the now-NULL vc pointer, leading to a null pointer\ndereference in the notifier chain (vcs_notifier dereferences param-\u003evc).\n\nFix this by adding a NULL check for vc before calling vcs_scr_updated()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:36.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43a6281790273c1b0a9ab76609ff0245b968f1e6"
},
{
"url": "https://git.kernel.org/stable/c/b6bbb85cf45bf0b070e741997fe0af3a772c5ad5"
},
{
"url": "https://git.kernel.org/stable/c/ff4806202749a51938236214adc0281481a57366"
},
{
"url": "https://git.kernel.org/stable/c/8232fca738011ca2ec865b46ec721d1796dc0580"
},
{
"url": "https://git.kernel.org/stable/c/73049768ad57145acd337102c5aa3c788e6642c8"
},
{
"url": "https://git.kernel.org/stable/c/7cc3dd79777f6ae4625ec37e84dd18a26dc88bde"
},
{
"url": "https://git.kernel.org/stable/c/74be188eb2dc1c99d63986167b9a67d415fe7326"
},
{
"url": "https://git.kernel.org/stable/c/09a43e81279b8da15526da09877134b8bcf618b0"
},
{
"url": "https://git.kernel.org/stable/c/a287620312dc6dcb9a093417a0e589bf30fcf38a"
}
],
"title": "vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53385",
"datePublished": "2026-07-19T11:59:32.732Z",
"dateReserved": "2026-06-09T07:44:35.401Z",
"dateUpdated": "2026-08-17T04:50:36.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53388 (GCVE-0-2026-53388)
Vulnerability from cvelistv5 – Published: 2026-07-19 11:59 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
fuse: re-lock request before replacing page cache folio
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before replacing page cache folio
fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.
Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 7c18691e0cfda29672f79bafde8abdb7710674f6
(git)
Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 5927b43a4f8d89e86930f524bf63e9c7e66f61b4 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 030fe3e9d8abdee303dd7e9e42f45082d382a407 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 46473ddccdc5065033e397d6e62c280dbcd3d9c2 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < af2892249d982a1c036ca456cc135374e68b6677 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < 0223f452532d9cd8a5e87c45de828fd93c99bd25 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < e28db6ac4792d065ab32565fd9f0a2361c3d4666 (git) Affected: ce534fb052928ce556639d7ecf01cbf4e01321e1 , < a078484921052d0badd827fcc2770b5cfc1d4120 (git) |
|
| Linux | Linux |
Affected:
2.6.35
Unaffected: 0 , < 2.6.35 (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c18691e0cfda29672f79bafde8abdb7710674f6",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "5927b43a4f8d89e86930f524bf63e9c7e66f61b4",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "030fe3e9d8abdee303dd7e9e42f45082d382a407",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "46473ddccdc5065033e397d6e62c280dbcd3d9c2",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "af2892249d982a1c036ca456cc135374e68b6677",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "0223f452532d9cd8a5e87c45de828fd93c99bd25",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "e28db6ac4792d065ab32565fd9f0a2361c3d4666",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "a078484921052d0badd827fcc2770b5cfc1d4120",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before replacing page cache folio\n\nfuse_try_move_folio() unlocks the request on entry but does not\nre-lock it on the success path. This means fuse_chan_abort() can end the\nrequest and free the fuse_io_args (eg fuse_readpages_end()) while the\nsubsequent copy chain logic after fuse_try_move_folio() accesses the\nfuse_io_args, leading to use-after-free issues.\n\nFix this by calling lock_request() before replace_page_cache_folio().\nThis ensures the request is locked on the success path which will\nprevent the fuse_io_args from being freed while the later copying logic\nruns, and also ensures that the ap-\u003efolios[i]-\u003emapping is never null\nsince ap-\u003efolios[i] will always point to the newfolio after\nreplace_page_cache_folio()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker\u0027s own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:39.284Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6"
},
{
"url": "https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4"
},
{
"url": "https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407"
},
{
"url": "https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2"
},
{
"url": "https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677"
},
{
"url": "https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25"
},
{
"url": "https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666"
},
{
"url": "https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120"
}
],
"title": "fuse: re-lock request before replacing page cache folio",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53388",
"datePublished": "2026-07-19T11:59:34.456Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:39.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53390 (GCVE-0-2026-53390)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
The permission-check ACE walk in smb_check_perm_dacl() validates the ACE
header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it
never checks that ace->size is actually large enough to contain
num_subauth sub-authorities before compare_sids() dereferences them.
CIFS_SID_BASE_SIZE covers the SID header up to but excluding the
sub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,
so the existing guards only guarantee the 8-byte SID base, i.e. zero
sub-authorities. compare_sids() then reads ace->sid.sub_auth[i] for
i < min(local_sid->num_subauth, ace->sid.num_subauth). The local
comparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()
result) always have at least one sub-authority, and an attacker controls
the ACE revision and authority bytes (which lie within the in-bounds SID
base), so they can match one of those SIDs and force the sub_auth read.
A crafted ACE with size == 16 and num_subauth >= 1 placed at the tail of
the security descriptor therefore causes a heap out-of-bounds read of up
to SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd
allocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()
into a buffer sized exactly to the on-disk data (kzalloc(sd_size) in
ndr_decode_v4_ntacl()), so the read lands past the allocation. The
malformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL
is not normalised before being written to the security.NTACL xattr) and
the read fires on a subsequent SMB2_CREATE access check, making this
reachable by an authenticated client on a share that uses ACL xattrs.
Add the missing num_subauth-versus-ace_size check, mirroring the
identical guards already present in the sibling parsers parse_dacl() and
smb_inherit_dacl().
Severity
8.1 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
282cbbb476b9f35793452bc461934af4c7eca169 , < c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0
(git)
Affected: f20adc4ef7428bc485ee83fd1a592252fb87718b , < 988c93d3bba066d8669143e6ec30bb2be9608d53 (git) Affected: 325d4ac11f526cb8964cff14548ccf02d8c756d8 , < 36599894fa8536fefdf1e296c0af71b8b7226859 (git) Affected: 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c , < d5c81a095c86fe507c032d08f3a8cfc518444927 (git) Affected: 90089584b2e25c4510b7b987387b4405f0673ece , < 7627ff8c4f9919f14de562b0160ab4ec9d80b1f7 (git) Affected: d07b26f39246a82399661936dd0c853983cfade7 , < e36e35660adb9b8ef1435ac359151dda5f094c55 (git) Affected: d07b26f39246a82399661936dd0c853983cfade7 , < 1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b (git) Affected: 151b1799861fde38087c08f613abc2843ef597b0 (git) Affected: 5.15.210 , < 5.15.212 (semver) Affected: 6.1.176 , < 6.1.177 (semver) Affected: 6.6.140 , < 6.6.144 (semver) Affected: 6.12.84 , < 6.12.95 (semver) Affected: 6.18.25 , < 6.18.38 (semver) Affected: 7.0.2 , < 7.1 (semver) |
|
| Linux | Linux |
Affected:
7.1
Unaffected: 0 , < 7.1 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smbacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0",
"status": "affected",
"version": "282cbbb476b9f35793452bc461934af4c7eca169",
"versionType": "git"
},
{
"lessThan": "988c93d3bba066d8669143e6ec30bb2be9608d53",
"status": "affected",
"version": "f20adc4ef7428bc485ee83fd1a592252fb87718b",
"versionType": "git"
},
{
"lessThan": "36599894fa8536fefdf1e296c0af71b8b7226859",
"status": "affected",
"version": "325d4ac11f526cb8964cff14548ccf02d8c756d8",
"versionType": "git"
},
{
"lessThan": "d5c81a095c86fe507c032d08f3a8cfc518444927",
"status": "affected",
"version": "95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c",
"versionType": "git"
},
{
"lessThan": "7627ff8c4f9919f14de562b0160ab4ec9d80b1f7",
"status": "affected",
"version": "90089584b2e25c4510b7b987387b4405f0673ece",
"versionType": "git"
},
{
"lessThan": "e36e35660adb9b8ef1435ac359151dda5f094c55",
"status": "affected",
"version": "d07b26f39246a82399661936dd0c853983cfade7",
"versionType": "git"
},
{
"lessThan": "1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b",
"status": "affected",
"version": "d07b26f39246a82399661936dd0c853983cfade7",
"versionType": "git"
},
{
"status": "affected",
"version": "151b1799861fde38087c08f613abc2843ef597b0",
"versionType": "git"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThan": "6.6.144",
"status": "affected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThan": "6.12.95",
"status": "affected",
"version": "6.12.84",
"versionType": "semver"
},
{
"lessThan": "6.18.38",
"status": "affected",
"version": "6.18.25",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smbacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.6.140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.12.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.18.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds read in smb_check_perm_dacl()\n\nThe permission-check ACE walk in smb_check_perm_dacl() validates the ACE\nheader size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it\nnever checks that ace-\u003esize is actually large enough to contain\nnum_subauth sub-authorities before compare_sids() dereferences them.\n\nCIFS_SID_BASE_SIZE covers the SID header up to but excluding the\nsub_auth[] array, and offsetof(struct smb_ace, sid) is the ACE header,\nso the existing guards only guarantee the 8-byte SID base, i.e. zero\nsub-authorities. compare_sids() then reads ace-\u003esid.sub_auth[i] for\ni \u003c min(local_sid-\u003enum_subauth, ace-\u003esid.num_subauth). The local\ncomparison SIDs (sid_everyone, sid_unix_NFS_mode, and the id_to_sid()\nresult) always have at least one sub-authority, and an attacker controls\nthe ACE revision and authority bytes (which lie within the in-bounds SID\nbase), so they can match one of those SIDs and force the sub_auth read.\n\nA crafted ACE with size == 16 and num_subauth \u003e= 1 placed at the tail of\nthe security descriptor therefore causes a heap out-of-bounds read of up\nto SID_MAX_SUB_AUTHORITIES * sizeof(__le32) bytes past the pntsd\nallocation. The security descriptor is loaded by ksmbd_vfs_get_sd_xattr()\ninto a buffer sized exactly to the on-disk data (kzalloc(sd_size) in\nndr_decode_v4_ntacl()), so the read lands past the allocation. The\nmalformed descriptor can be stored verbatim via SMB2_SET_INFO (the DACL\nis not normalised before being written to the security.NTACL xattr) and\nthe read fires on a subsequent SMB2_CREATE access check, making this\nreachable by an authenticated client on a share that uses ACL xattrs.\n\nAdd the missing num_subauth-versus-ace_size check, mirroring the\nidentical guards already present in the sibling parsers parse_dacl() and\nsmb_inherit_dacl()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reachable through ksmbd\u0027s in-kernel SMB2 server on TCP/445 via SMB2_SET_INFO (to store a crafted security descriptor) and SMB2_CREATE (to trigger the DACL walk), with packets handled from ksmbd_conn_handler_loop() through smb2_set_info()/smb2_open() into smb_check_perm_dacl().\nAC:L - An attacker fully controls the malformed ACE fields (size, num_subauth, revision, authority bytes) and can reliably place the ACE at the tail of a security descriptor, store it verbatim, then trigger the read on the next CREATE without depending on race timing or uncontrollable memory layout.\nPR:L - Exploitation requires a completed SMB2 session and share access: SMB2_SET_INFO needs FILE_WRITE_DAC/FILE_WRITE_OWNER on an open file, and the poisoned descriptor is only persisted on shares with ACL xattr support, which is authenticated low-privilege client access rather than pre-auth or host root.\nUI:N - No end-user action is required beyond the attacker sending crafted SMB2 protocol messages over the network; no victim must open a file, mount a share, or perform any interactive step.\nS:U - The vulnerability is confined to kernel heap memory reads during ksmbd DACL permission evaluation and does not cross a security boundary such as guest-to-host VM escape or sandbox escape.\nC:H - compare_sids() performs a heap out-of-bounds read of up to SID_MAX_SUB_AUTHORITIES (15) sub-authority dwords (60 bytes) past the kzalloc()-sized security descriptor buffer, exposing adjacent kernel heap contents even though the data is not returned in the SMB response.\nI:N - The flaw is a read-only out-of-bounds access in compare_sids() with no memory write, type confusion, or demonstrated control-flow hijack primitive; integrity is not directly compromised.\nA:H - Reading past the end of the kmalloc allocation can fault the kernel (oops/panic), and a malicious descriptor planted on a shared file can deny availability to any other authenticated client whose SMB2_CREATE triggers smb_check_perm_dacl()."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:41.549Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7488c85fd822959e9b5c22fbd9e7c8a21caf5e0"
},
{
"url": "https://git.kernel.org/stable/c/988c93d3bba066d8669143e6ec30bb2be9608d53"
},
{
"url": "https://git.kernel.org/stable/c/36599894fa8536fefdf1e296c0af71b8b7226859"
},
{
"url": "https://git.kernel.org/stable/c/d5c81a095c86fe507c032d08f3a8cfc518444927"
},
{
"url": "https://git.kernel.org/stable/c/7627ff8c4f9919f14de562b0160ab4ec9d80b1f7"
},
{
"url": "https://git.kernel.org/stable/c/e36e35660adb9b8ef1435ac359151dda5f094c55"
},
{
"url": "https://git.kernel.org/stable/c/1ef06004ed4bd6d3ed8c840d9d1a376b66d4935b"
}
],
"title": "ksmbd: fix out-of-bounds read in smb_check_perm_dacl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53390",
"datePublished": "2026-07-19T12:01:54.951Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:41.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53391 (GCVE-0-2026-53391)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a
netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately
calls strrchr(buf, '.') to locate the port separator. Both decodes
use xdr_stream_decode_string_dup(), and the current code checks only
"nlen < 0" / "rlen < 0" before dereferencing the returned string.
When the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()
returns 0 and xdr_stream_decode_string_dup() falls through to its
"*str = NULL; return ret" tail, leaving buf NULL with a return value
of 0. The "< 0" check does not catch this, and the next line is
strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from
any pNFS-flexfile client mounted against a malicious or compromised
metadata server.
Reject the zero-length cases explicitly so the decoder fails with
-EBADMSG (treated as a malformed GETDEVICEINFO body) instead of
panicking the client.
Severity
7.5 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6b7f3cf96364eaf597940cb5c68a682894829915 , < 76b94cbd32aacf36a641956385a852635c6802b9
(git)
Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < c8e4e0c701d0192a2efb6df059c0f9e19678c23d (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 427ab81a811dab4bca9d19f82eec5847ae42646e (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 012d37a568bfbb2c9686f03ade75560bc7139956 (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 30aae62e50b4e074a90a9a5e15246548fbdc1182 (git) Affected: 6b7f3cf96364eaf597940cb5c68a682894829915 , < 41fe0f7b84f0cb822ae10ab08592996a592b2a25 (git) |
|
| Linux | Linux |
Affected:
4.0
Unaffected: 0 , < 4.0 (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/pnfs_nfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76b94cbd32aacf36a641956385a852635c6802b9",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
},
{
"lessThan": "c8e4e0c701d0192a2efb6df059c0f9e19678c23d",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
},
{
"lessThan": "6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
},
{
"lessThan": "427ab81a811dab4bca9d19f82eec5847ae42646e",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
},
{
"lessThan": "012d37a568bfbb2c9686f03ade75560bc7139956",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
},
{
"lessThan": "30aae62e50b4e074a90a9a5e15246548fbdc1182",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
},
{
"lessThan": "41fe0f7b84f0cb822ae10ab08592996a592b2a25",
"status": "affected",
"version": "6b7f3cf96364eaf597940cb5c68a682894829915",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/pnfs_nfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr\n\nnfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a\nnetaddr4 from a GETDEVICEINFO multipath-DS body, then immediately\ncalls strrchr(buf, \u0027.\u0027) to locate the port separator. Both decodes\nuse xdr_stream_decode_string_dup(), and the current code checks only\n\"nlen \u003c 0\" / \"rlen \u003c 0\" before dereferencing the returned string.\n\nWhen the on-wire opaque has length zero, xdr_stream_decode_opaque_inline()\nreturns 0 and xdr_stream_decode_string_dup() falls through to its\n\"*str = NULL; return ret\" tail, leaving buf NULL with a return value\nof 0. The \"\u003c 0\" check does not catch this, and the next line is\nstrrchr(NULL, \u0027.\u0027), a kernel NULL pointer dereference reachable from\nany pNFS-flexfile client mounted against a malicious or compromised\nmetadata server.\n\nReject the zero-length cases explicitly so the decoder fails with\n-EBADMSG (treated as a malformed GETDEVICEINFO body) instead of\npanicking the client."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario\u2014a compromised enterprise/HPC metadata server or autofs-managed pNFS mount\u2014no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive\u2014only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:42.650Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9"
},
{
"url": "https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d"
},
{
"url": "https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea"
},
{
"url": "https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e"
},
{
"url": "https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956"
},
{
"url": "https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182"
},
{
"url": "https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25"
}
],
"title": "NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53391",
"datePublished": "2026-07-19T12:01:55.521Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:42.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53397 (GCVE-0-2026-53397)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
nfsd: fix posix_acl leak on SETACL decode failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix posix_acl leak on SETACL decode failure
nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each
call nfs_stream_decode_acl() twice, first for NFS_ACL and then for
NFS_DFACL. Each successful call transfers ownership of a freshly
allocated posix_acl into argp->acl_access or argp->acl_default. If
the first call succeeds but the second fails, the decoder returns
false and argp->acl_access is left dangling.
ACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and
ACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.
Both only call fh_put() and have no knowledge of the ACL fields on
argp. The posix_acl_release() pairs sat at the out: labels inside
nfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()
skips pc_func when pc_decode returns false, so that cleanup is
unreachable on decode failure:
svc_process_common()
pc_decode() /* decode_setaclargs: false */
/* pc_func skipped */
pc_release() /* fh_put only -- ACLs leaked */
The orphaned posix_acl is leaked for the lifetime of the server.
Fix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),
which release both argp->acl_access and argp->acl_default in addition
to fh_put(), and wiring them as pc_release for their respective SETACL
procedures. pc_release runs on every path svc_process() takes after
decode, including decode failure, so the posix_acl_release() pairs are
removed from the proc functions' out: labels to keep ownership in one
place. This matches the existing release_getacl() pattern used by
the sibling GETACL procedures.
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < b2eb1ffd511d1b3c3e21122f97cbbccea411e277
(git)
Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < b94c4be77682aab06d65ca7296149e3bcfb37353 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 887f92ceccf3eacd5f2402db21254d66372fae00 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 1e96239fddcefacf6afe6c498357be68eacbcabc (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < bd69a825485168ef74e815ecb286754b570fdcc7 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 136b416593f1349cf6f72c8e3d18f0f204ee8545 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < a5b42c1e4ff2befaa6b96f7cbf32174751eba083 (git) Affected: a257cdd0e2179630d3201c32ba14d7fcb3c3a055 , < 0853ac544c590880d797b04daa33fcb72b6be0e1 (git) |
|
| Linux | Linux |
Affected:
2.6.13
Unaffected: 0 , < 2.6.13 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs2acl.c",
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b2eb1ffd511d1b3c3e21122f97cbbccea411e277",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "b94c4be77682aab06d65ca7296149e3bcfb37353",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "887f92ceccf3eacd5f2402db21254d66372fae00",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "1e96239fddcefacf6afe6c498357be68eacbcabc",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "bd69a825485168ef74e815ecb286754b570fdcc7",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "136b416593f1349cf6f72c8e3d18f0f204ee8545",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "a5b42c1e4ff2befaa6b96f7cbf32174751eba083",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
},
{
"lessThan": "0853ac544c590880d797b04daa33fcb72b6be0e1",
"status": "affected",
"version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs2acl.c",
"fs/nfsd/nfs3acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.13"
},
{
"lessThan": "2.6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak on SETACL decode failure\n\nnfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each\ncall nfs_stream_decode_acl() twice, first for NFS_ACL and then for\nNFS_DFACL. Each successful call transfers ownership of a freshly\nallocated posix_acl into argp-\u003eacl_access or argp-\u003eacl_default. If\nthe first call succeeds but the second fails, the decoder returns\nfalse and argp-\u003eacl_access is left dangling.\n\nACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and\nACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.\nBoth only call fh_put() and have no knowledge of the ACL fields on\nargp. The posix_acl_release() pairs sat at the out: labels inside\nnfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()\nskips pc_func when pc_decode returns false, so that cleanup is\nunreachable on decode failure:\n\n svc_process_common()\n pc_decode() /* decode_setaclargs: false */\n /* pc_func skipped */\n pc_release() /* fh_put only -- ACLs leaked */\n\nThe orphaned posix_acl is leaked for the lifetime of the server.\n\nFix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),\nwhich release both argp-\u003eacl_access and argp-\u003eacl_default in addition\nto fh_put(), and wiring them as pc_release for their respective SETACL\nprocedures. pc_release runs on every path svc_process() takes after\ndecode, including decode failure, so the posix_acl_release() pairs are\nremoved from the proc functions\u0027 out: labels to keep ownership in one\nplace. This matches the existing release_getacl() pattern used by\nthe sibling GETACL procedures."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in nfsd\u0027s NFS ACL program (RPC program 100227), reachable over the network via the in-kernel NFS server on TCP/UDP port 2049 when NFSD ACL support is enabled.\nAC:L - Once nfsd with ACL support is running, an attacker can reliably trigger the leak by sending a SETACL RPC with mask including both NFS_ACL and NFS_DFACL, a valid first ACL, and a malformed second ACL that fails decode.\nPR:N - Exploitation requires only network access as an NFS client with RPC credentials (AUTH_UNIX is spoofable) from a source IP matching an export entry; no local shell or real root on the server is needed.\nUI:N - Triggering the leak requires only crafted NFS ACL RPC packets; no victim user action such as mounting a filesystem or opening a file is required.\nS:U - The impact is confined to kernel memory consumption within the nfsd server context and does not cross a security boundary such as a VM, container, or IOMMU isolation boundary.\nC:N - This is a kmalloc leak of attacker-supplied ACL data with no out-of-bounds read, use-after-free, or other mechanism that exposes kernel memory to the attacker.\nI:N - The bug orphans allocated posix_acl objects without modifying file data, ACLs on disk, or any other integrity-protected resources.\nA:H - Each trigger permanently leaks a posix_acl allocation (up to ~16KB with max entries) for the server\u0027s lifetime; repeated remote SETACL requests can exhaust kernel memory and deny service to the NFS server and co-hosted workloads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:49.240Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277"
},
{
"url": "https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353"
},
{
"url": "https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00"
},
{
"url": "https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc"
},
{
"url": "https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7"
},
{
"url": "https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545"
},
{
"url": "https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083"
},
{
"url": "https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1"
}
],
"title": "nfsd: fix posix_acl leak on SETACL decode failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53397",
"datePublished": "2026-07-19T12:01:58.938Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:49.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53398 (GCVE-0-2026-53398)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:01 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
NFSD: Fix SECINFO_NO_NAME decode error cleanup
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Fix SECINFO_NO_NAME decode error cleanup
nfsd4_decode_secinfo_no_name() currently initializes sin_exp after
decoding sin_style. If the XDR stream is truncated, the decoder returns
nfserr_bad_xdr before sin_exp is initialized.
Since commit 3fdc54646234 ("NFSD: Reduce amount of struct
nfsd4_compoundargs that needs clearing"), the inline iops array is not
cleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore
leave sin_exp holding stale union contents from a previous operation.
The error response path still invokes nfsd4_secinfo_no_name_release(),
which calls exp_put() on a non-NULL sin_exp.
Initialize sin_exp before the first failable decode step, matching
nfsd4_decode_secinfo().
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5e76b25d7cc82c148d391c0c43b884e6427cb302 , < 8836405abdc53ca3dd5fc68b2cf6f8f012fad011
(git)
Affected: 07b68ff5c71cf4ed5443016d8eb116863c0a4d88 , < 49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439 (git) Affected: 3fdc546462348b8a497c72bc894e0cde9f10fc40 , < 5ec37edcb534f3fc92304be236d37f08e6545585 (git) Affected: 3fdc546462348b8a497c72bc894e0cde9f10fc40 , < 1e04be34cafae119e82bcaccd6d28a20f72a3647 (git) Affected: 3fdc546462348b8a497c72bc894e0cde9f10fc40 , < 161d1aaeb04d620d3692639700512bb5038c1e10 (git) Affected: 3fdc546462348b8a497c72bc894e0cde9f10fc40 , < c8a24effd96d4779e2ad779654682304491c55a5 (git) Affected: 3fdc546462348b8a497c72bc894e0cde9f10fc40 , < 46eb17d45be69d28c7a23ea03283b207426a8232 (git) Affected: 3fdc546462348b8a497c72bc894e0cde9f10fc40 , < 9e18e83b8846a5c3fe13fc8a464b4865d33996c6 (git) Affected: 5.10.220 , < 5.10.260 (semver) Affected: 5.15.154 , < 5.15.211 (semver) |
|
| Linux | Linux |
Affected:
6.1
Unaffected: 0 , < 6.1 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8836405abdc53ca3dd5fc68b2cf6f8f012fad011",
"status": "affected",
"version": "5e76b25d7cc82c148d391c0c43b884e6427cb302",
"versionType": "git"
},
{
"lessThan": "49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439",
"status": "affected",
"version": "07b68ff5c71cf4ed5443016d8eb116863c0a4d88",
"versionType": "git"
},
{
"lessThan": "5ec37edcb534f3fc92304be236d37f08e6545585",
"status": "affected",
"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40",
"versionType": "git"
},
{
"lessThan": "1e04be34cafae119e82bcaccd6d28a20f72a3647",
"status": "affected",
"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40",
"versionType": "git"
},
{
"lessThan": "161d1aaeb04d620d3692639700512bb5038c1e10",
"status": "affected",
"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40",
"versionType": "git"
},
{
"lessThan": "c8a24effd96d4779e2ad779654682304491c55a5",
"status": "affected",
"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40",
"versionType": "git"
},
{
"lessThan": "46eb17d45be69d28c7a23ea03283b207426a8232",
"status": "affected",
"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40",
"versionType": "git"
},
{
"lessThan": "9e18e83b8846a5c3fe13fc8a464b4865d33996c6",
"status": "affected",
"version": "3fdc546462348b8a497c72bc894e0cde9f10fc40",
"versionType": "git"
},
{
"lessThan": "5.10.260",
"status": "affected",
"version": "5.10.220",
"versionType": "semver"
},
{
"lessThan": "5.15.211",
"status": "affected",
"version": "5.15.154",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.10.220",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix SECINFO_NO_NAME decode error cleanup\n\nnfsd4_decode_secinfo_no_name() currently initializes sin_exp after\ndecoding sin_style. If the XDR stream is truncated, the decoder returns\nnfserr_bad_xdr before sin_exp is initialized.\n\nSince commit 3fdc54646234 (\"NFSD: Reduce amount of struct\nnfsd4_compoundargs that needs clearing\"), the inline iops array is not\ncleared between RPC calls. A failed SECINFO_NO_NAME decode can therefore\nleave sin_exp holding stale union contents from a previous operation.\n\nThe error response path still invokes nfsd4_secinfo_no_name_release(),\nwhich calls exp_put() on a non-NULL sin_exp.\n\nInitialize sin_exp before the first failable decode step, matching\nnfsd4_decode_secinfo()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in nfsd4_decode_secinfo_no_name() on the NFSv4 COMPOUND RPC decode path; nfsd is an in-kernel network file server reached remotely over TCP/UDP port 2049 by any client that can connect.\nAC:L - An attacker on the same TCP connection can first send a valid SECINFO_NO_NAME compound to leave a dangling sin_exp in the reused iops[] slot, then send a truncated SECINFO_NO_NAME to trigger nfserr_bad_xdr and nfsd4_secinfo_no_name_release() without re-initializing sin_exp.\nPR:N - Exploitation requires only network reachability to nfsd and standard NFSv4.1 session setup (EXCHANGE_ID/CREATE_SESSION/SEQUENCE); default exports accept RPC_AUTH_NULL with no local privileges, matching an unauthenticated remote attacker on a misconfigured or internet-exposed NFS server.\nUI:N - No victim user action is required; the attacker triggers the bug entirely by sending crafted NFSv4 COMPOUND RPC requests to the server.\nS:U - Impact is confined to kernel nfsd/export-cache memory mismanagement on the NFS server; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The stale sin_exp causes exp_put()/cache_put() on an uninitialized or already-freed svc_export pointer, corrupting export-cache refcounts and creating a use-after-free that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Incorrect kref_put() on a dangling or garbage svc_export pointer is exploitable memory corruption that can lead to further heap manipulation and potential arbitrary kernel code execution, not merely a bounded error.\nA:H - Calling exp_put() on an invalid pointer reliably causes kernel oops/panic or premature export-cache destruction, producing high availability impact including NFS service disruption and possible full kernel crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:50.328Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011"
},
{
"url": "https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439"
},
{
"url": "https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585"
},
{
"url": "https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647"
},
{
"url": "https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10"
},
{
"url": "https://git.kernel.org/stable/c/c8a24effd96d4779e2ad779654682304491c55a5"
},
{
"url": "https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232"
},
{
"url": "https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6"
}
],
"title": "NFSD: Fix SECINFO_NO_NAME decode error cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53398",
"datePublished": "2026-07-19T12:01:59.507Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:50.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53403 (GCVE-0-2026-53403)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.
store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.
Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1458a4d804550b7101e8bb02c1cb941088e4c0c7
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8707f02ac9f5f632039b60df2c9f3dc914709f72 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0d8c7f21ad8529d5c181e61f86be35b887ae2e4d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7640b4f68acb54c2c4f6b4a8aee0e9849dacd929 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < eea16b6f805c0b1fb2f72f0f771088ea45356956 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 88913059c77e171f44ba829282d42dde0d458811 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7f08fc10fa3d3366dc3af723970bd03d7d6d10e3 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1458a4d804550b7101e8bb02c1cb941088e4c0c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8707f02ac9f5f632039b60df2c9f3dc914709f72",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0d8c7f21ad8529d5c181e61f86be35b887ae2e4d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7640b4f68acb54c2c4f6b4a8aee0e9849dacd929",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eea16b6f805c0b1fb2f72f0f771088ea45356956",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88913059c77e171f44ba829282d42dde0d458811",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7f08fc10fa3d3366dc3af723970bd03d7d6d10e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var\n\ninfo-\u003evar, a framebuffer\u0027s current mode, is expected to have a matching\nentry in info-\u003emodelist. var_to_display() relies on this and treats a\nfailed fb_match_mode() as \"This should not happen\". fb_set_var() keeps it\ntrue by adding the mode to the list on every change, and\ndo_register_framebuffer() does the same at registration.\n\nstore_modes() replaces the modelist from userspace. fb_new_modelist()\nvalidates the new modes but does not check that info-\u003evar still has a\nmatch. It relies on fbcon_new_modelist() to re-point consoles, but that\nonly handles consoles mapped to the framebuffer. With fbcon unbound there\nare none, so info-\u003evar is left describing a mode that is no longer in the\nlist.\n\nA later console takeover runs var_to_display(), where fb_match_mode()\nreturns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it\nto display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.\n\nKeep the current mode in the list in fb_new_modelist(), the same way\nfb_set_var() does."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:56.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1458a4d804550b7101e8bb02c1cb941088e4c0c7"
},
{
"url": "https://git.kernel.org/stable/c/8707f02ac9f5f632039b60df2c9f3dc914709f72"
},
{
"url": "https://git.kernel.org/stable/c/0d8c7f21ad8529d5c181e61f86be35b887ae2e4d"
},
{
"url": "https://git.kernel.org/stable/c/7640b4f68acb54c2c4f6b4a8aee0e9849dacd929"
},
{
"url": "https://git.kernel.org/stable/c/4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e"
},
{
"url": "https://git.kernel.org/stable/c/eea16b6f805c0b1fb2f72f0f771088ea45356956"
},
{
"url": "https://git.kernel.org/stable/c/88913059c77e171f44ba829282d42dde0d458811"
},
{
"url": "https://git.kernel.org/stable/c/7f08fc10fa3d3366dc3af723970bd03d7d6d10e3"
}
],
"title": "fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53403",
"datePublished": "2026-07-19T12:02:02.382Z",
"dateReserved": "2026-06-09T07:44:35.403Z",
"dateUpdated": "2026-08-17T04:50:56.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63794 (GCVE-0-2026-63794)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:50
VLAI
EPSS
VEX
Title
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
In sev_dbg_crypt(), the per-iteration transfer length is bounded by
the source page offset (PAGE_SIZE - s_off) but not by the destination
page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt
path (__sev_dbg_encrypt_user) performs a read-modify-write using a
single-page intermediate buffer (dst_tpage):
1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16)
before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE,
the PSP writes beyond the end of the 4096-byte dst_tpage allocation.
2. The subsequent memcpy()/copy_from_user() into
page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows
by up to 15 bytes under the same condition.
Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -
the PSP is instructed to write round_up(4097, 16) = 4112 bytes to
a 4096-byte buffer.
Fix by also bounding len by (PAGE_SIZE - d_off), the same check that
sev_send_update_data() already performs for its single-page guest
region.
==================================================================
BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd]
Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214
CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY
Tainted: [U]=USER, [W]=WARN
Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x54/0x70
print_report+0xbc/0x260
kasan_report+0xa2/0xd0
kasan_check_range+0x25f/0x2c0
__asan_memcpy+0x40/0x70
sev_dbg_crypt+0x993/0xd10 [kvm_amd]
sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd]
kvm_vm_ioctl+0x65d/0x6d0 [kvm]
__se_sys_ioctl+0xb2/0x100
do_syscall_64+0xe8/0x870
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb
memcg:ff11000112827d82
flags: 0x1400000000000000(node=1|zone=1)
raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
Disabling lock debugging due to kernel taint
[sean: add sample KASAN splat, Fixes, and stable@]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < f701ae476cb92a3a3d8844bb39bb63b4512684c8
(git)
Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 64f2449841ffc7d203183aa4c748c9c77951ecc5 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 9349b50f4b11f135fe73b56cb2c2c872d8bc71d7 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 889c2a9c59897ca912bf39df5bb92555a0a13df4 (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < e1a0fe288dee07b7da25a71e007c1ecd1080315b (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 720949ed666f34ff28ffdfe1471a5861d1e41fdf (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 2753a097d1fe24c4351c608048612c74108aa89f (git) Affected: 24f41fb23a39bc2b6f190dcef35a5813a4bf183a , < 78ee2d50185a037b3d2452a97f3dad69c3f7f389 (git) |
|
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f701ae476cb92a3a3d8844bb39bb63b4512684c8",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "64f2449841ffc7d203183aa4c748c9c77951ecc5",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "9349b50f4b11f135fe73b56cb2c2c872d8bc71d7",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "889c2a9c59897ca912bf39df5bb92555a0a13df4",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "e1a0fe288dee07b7da25a71e007c1ecd1080315b",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "720949ed666f34ff28ffdfe1471a5861d1e41fdf",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "2753a097d1fe24c4351c608048612c74108aa89f",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
},
{
"lessThan": "78ee2d50185a037b3d2452a97f3dad69c3f7f389",
"status": "affected",
"version": "24f41fb23a39bc2b6f190dcef35a5813a4bf183a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path\n\nIn sev_dbg_crypt(), the per-iteration transfer length is bounded by\nthe source page offset (PAGE_SIZE - s_off) but not by the destination\npage offset (PAGE_SIZE - d_off). When d_off \u003e s_off, the encrypt\npath (__sev_dbg_encrypt_user) performs a read-modify-write using a\nsingle-page intermediate buffer (dst_tpage):\n\n 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off \u0026 15), 16)\n before issuing the PSP command. If len + (d_off \u0026 15) \u003e PAGE_SIZE,\n the PSP writes beyond the end of the 4096-byte dst_tpage allocation.\n\n 2. The subsequent memcpy()/copy_from_user() into\n page_address(dst_tpage) + (d_off \u0026 15) of \u0027len\u0027 bytes overflows\n by up to 15 bytes under the same condition.\n\nTrigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE -\nthe PSP is instructed to write round_up(4097, 16) = 4112 bytes to\na 4096-byte buffer.\n\nFix by also bounding len by (PAGE_SIZE - d_off), the same check that\nsev_send_update_data() already performs for its single-page guest\nregion.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214\n\n CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY\n Tainted: [U]=USER, [W]=WARN\n Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x54/0x70\n print_report+0xbc/0x260\n kasan_report+0xa2/0xd0\n kasan_check_range+0x25f/0x2c0\n __asan_memcpy+0x40/0x70\n sev_dbg_crypt+0x993/0xd10 [kvm_amd]\n sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd]\n kvm_vm_ioctl+0x65d/0x6d0 [kvm]\n __se_sys_ioctl+0xb2/0x100\n do_syscall_64+0xe8/0x870\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n\n The buggy address belongs to the physical page:\n page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb\n memcg:ff11000112827d82\n flags: 0x1400000000000000(node=1|zone=1)\n raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003eff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ^\n ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ==================================================================\n Disabling lock debugging due to kernel taint\n\n[sean: add sample KASAN splat, Fixes, and stable@]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:58.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f701ae476cb92a3a3d8844bb39bb63b4512684c8"
},
{
"url": "https://git.kernel.org/stable/c/64f2449841ffc7d203183aa4c748c9c77951ecc5"
},
{
"url": "https://git.kernel.org/stable/c/9349b50f4b11f135fe73b56cb2c2c872d8bc71d7"
},
{
"url": "https://git.kernel.org/stable/c/889c2a9c59897ca912bf39df5bb92555a0a13df4"
},
{
"url": "https://git.kernel.org/stable/c/e1a0fe288dee07b7da25a71e007c1ecd1080315b"
},
{
"url": "https://git.kernel.org/stable/c/720949ed666f34ff28ffdfe1471a5861d1e41fdf"
},
{
"url": "https://git.kernel.org/stable/c/2753a097d1fe24c4351c608048612c74108aa89f"
},
{
"url": "https://git.kernel.org/stable/c/78ee2d50185a037b3d2452a97f3dad69c3f7f389"
}
],
"title": "KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63794",
"datePublished": "2026-07-19T12:02:03.488Z",
"dateReserved": "2026-07-19T07:54:57.012Z",
"dateUpdated": "2026-08-17T04:50:58.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…