Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0957
Vulnerability from certfr_avis - Published: 2026-07-31 - Updated: 2026-07-31
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 6.1.177-1~deb11u1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-63807",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63807"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-53391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53391"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64246"
},
{
"name": "CVE-2026-53163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53163"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-53327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53327"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-53383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53383"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-63817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63817"
},
{
"name": "CVE-2026-63795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63795"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-63833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63833"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-64254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64254"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-53139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53139"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-53362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53362"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-23302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23302"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-53388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53388"
},
{
"name": "CVE-2026-23278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23278"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-53359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53359"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-53384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53384"
},
{
"name": "CVE-2026-23272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23272"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-52928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52928"
},
{
"name": "CVE-2026-53366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53366"
},
{
"name": "CVE-2026-53390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53390"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
}
],
"initial_release_date": "2026-07-31T00:00:00",
"last_revision_date": "2026-07-31T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0957",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-31T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-07-26",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00042",
"url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00042.html"
}
]
}
CVE-2026-63835 (GCVE-0-2026-63835)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-19 12:02
VLAI
EPSS
VEX
Title
batman-adv: v: prevent OGM aggregation on disabled hardif
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: v: prevent OGM aggregation on disabled hardif
When an interface gets disabled, the worker is correctly disabled by
batadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable().
In this process, the skb aggr_list is also freed.
But batadv_v_ogm_send_meshif() can still queue new skbs (via
batadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all
cores can no longer find the RCU protected list of hard interfaces. These
queued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.
The batadv_v_ogm_iface_disable() function must block
batadv_v_ogm_queue_on_if() to avoid leak of skbs.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < d462ced79dd430200cf888984e8005da77fc810b
(git)
Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < f79deaaf822ab0ee2424cf28781f9ab91576bea3 (git) Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < d3569327fc7395b2b0461a0a0cb77a0bb74786c0 (git) Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < 97644fdaaf6446ffbe182c5eb804fceb5b1a51b7 (git) Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < f04dde74399431fb07abbdd9cd5d0ed624771d04 (git) Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < 3d4548c96d6f21ac1a9b06c5f82f3ef439c87023 (git) Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < 86ab6b6fb5b82163bf6c45780bb72150021d7349 (git) Affected: f89255a02f1d75d8e1b9d1c31435fcb64840cb2a , < d11c00b95b2a3b3934007fc003dccc6fdcc061ad (git) |
|
| Linux | Linux |
Affected:
5.4
Unaffected: 0 , < 5.4 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_v.c",
"net/batman-adv/bat_v_ogm.c",
"net/batman-adv/types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d462ced79dd430200cf888984e8005da77fc810b",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "f79deaaf822ab0ee2424cf28781f9ab91576bea3",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "d3569327fc7395b2b0461a0a0cb77a0bb74786c0",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "97644fdaaf6446ffbe182c5eb804fceb5b1a51b7",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "f04dde74399431fb07abbdd9cd5d0ed624771d04",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "3d4548c96d6f21ac1a9b06c5f82f3ef439c87023",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "86ab6b6fb5b82163bf6c45780bb72150021d7349",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
},
{
"lessThan": "d11c00b95b2a3b3934007fc003dccc6fdcc061ad",
"status": "affected",
"version": "f89255a02f1d75d8e1b9d1c31435fcb64840cb2a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_v.c",
"net/batman-adv/bat_v_ogm.c",
"net/batman-adv/types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: v: prevent OGM aggregation on disabled hardif\n\nWhen an interface gets disabled, the worker is correctly disabled by\nbatadv_hardif_disable_interface() -\u003e ... -\u003e batadv_v_ogm_iface_disable().\nIn this process, the skb aggr_list is also freed.\n\nBut batadv_v_ogm_send_meshif() can still queue new skbs (via\nbatadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all\ncores can no longer find the RCU protected list of hard interfaces. These\nqueued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.\n\nThe batadv_v_ogm_iface_disable() function must block\nbatadv_v_ogm_queue_on_if() to avoid leak of skbs."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T12:02:26.574Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d462ced79dd430200cf888984e8005da77fc810b"
},
{
"url": "https://git.kernel.org/stable/c/f79deaaf822ab0ee2424cf28781f9ab91576bea3"
},
{
"url": "https://git.kernel.org/stable/c/d3569327fc7395b2b0461a0a0cb77a0bb74786c0"
},
{
"url": "https://git.kernel.org/stable/c/97644fdaaf6446ffbe182c5eb804fceb5b1a51b7"
},
{
"url": "https://git.kernel.org/stable/c/f04dde74399431fb07abbdd9cd5d0ed624771d04"
},
{
"url": "https://git.kernel.org/stable/c/3d4548c96d6f21ac1a9b06c5f82f3ef439c87023"
},
{
"url": "https://git.kernel.org/stable/c/86ab6b6fb5b82163bf6c45780bb72150021d7349"
},
{
"url": "https://git.kernel.org/stable/c/d11c00b95b2a3b3934007fc003dccc6fdcc061ad"
}
],
"title": "batman-adv: v: prevent OGM aggregation on disabled hardif",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63835",
"datePublished": "2026-07-19T12:02:26.574Z",
"dateReserved": "2026-07-19T07:54:57.015Z",
"dateUpdated": "2026-07-19T12:02:26.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63836 (GCVE-0-2026-63836)
Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-07-19 12:02
VLAI
EPSS
VEX
Title
batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
The cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in
batadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics.
((mss * 8) ** 2) / (cwnd * 8)
In case cwnd is actually 0x20000000, it will be shifted by 3 bit to the
left end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around
and be 0 - resulting in:
((mss * 8) ** 2) / 0
This is of course invalid and cannot be calculated. The calculation should
must be simplified to avoid this overflow:
(mss ** 2) * 8 / cwnd
It will keep the precision enhancement from the scaling (by 8) but avoid
the overflow in the divisor.
In theory, there could still be an overflow in the dividend. It is at the
moment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an
imminent problem. But allowing it to use the whole u32 bit range, would
mean that it can still use up to 67 bits. To keep this calculation safe for
32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits -
or in other words: must never be larger than 16383.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 35264c4d46067d6312871488c810cef387f8c1f6
(git)
Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 1381b021bf886b793fa5ffb895a8efae7ba0318f (git) Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < d08b69da40a101df1e28bfe1e8fa7a09ffa41107 (git) Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < cd74176cf1685f35a2e5f212d15748bbfecb53b6 (git) Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f (git) Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 7d2a44bc6bbe39aed03c68864aa0e54e04a50278 (git) Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 585616dab0aa9c45bc11b2c8082ca78533bc00e9 (git) Affected: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e , < 33ccd52f3cc9ed46ce395199f89aa3234dc83314 (git) |
|
| Linux | Linux |
Affected:
4.8
Unaffected: 0 , < 4.8 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "35264c4d46067d6312871488c810cef387f8c1f6",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "1381b021bf886b793fa5ffb895a8efae7ba0318f",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "d08b69da40a101df1e28bfe1e8fa7a09ffa41107",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "cd74176cf1685f35a2e5f212d15748bbfecb53b6",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "7d2a44bc6bbe39aed03c68864aa0e54e04a50278",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "585616dab0aa9c45bc11b2c8082ca78533bc00e9",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "33ccd52f3cc9ed46ce395199f89aa3234dc83314",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid divide-by-zero for dec_cwnd\n\nThe cwnd is always MSS \u003c= cwnd \u003c= 0x20000000. But the calculation in\nbatadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics.\n\n ((mss * 8) ** 2) / (cwnd * 8)\n\nIn case cwnd is actually 0x20000000, it will be shifted by 3 bit to the\nleft end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around\nand be 0 - resulting in:\n\n ((mss * 8) ** 2) / 0\n\nThis is of course invalid and cannot be calculated. The calculation should\nmust be simplified to avoid this overflow:\n\n (mss ** 2) * 8 / cwnd\n\nIt will keep the precision enhancement from the scaling (by 8) but avoid\nthe overflow in the divisor.\n\nIn theory, there could still be an overflow in the dividend. It is at the\nmoment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an\nimminent problem. But allowing it to use the whole u32 bit range, would\nmean that it can still use up to 67 bits. To keep this calculation safe for\n32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits -\nor in other words: must never be larger than 16383."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T12:02:27.166Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/35264c4d46067d6312871488c810cef387f8c1f6"
},
{
"url": "https://git.kernel.org/stable/c/1381b021bf886b793fa5ffb895a8efae7ba0318f"
},
{
"url": "https://git.kernel.org/stable/c/d08b69da40a101df1e28bfe1e8fa7a09ffa41107"
},
{
"url": "https://git.kernel.org/stable/c/cd74176cf1685f35a2e5f212d15748bbfecb53b6"
},
{
"url": "https://git.kernel.org/stable/c/ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f"
},
{
"url": "https://git.kernel.org/stable/c/7d2a44bc6bbe39aed03c68864aa0e54e04a50278"
},
{
"url": "https://git.kernel.org/stable/c/585616dab0aa9c45bc11b2c8082ca78533bc00e9"
},
{
"url": "https://git.kernel.org/stable/c/33ccd52f3cc9ed46ce395199f89aa3234dc83314"
}
],
"title": "batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63836",
"datePublished": "2026-07-19T12:02:27.166Z",
"dateReserved": "2026-07-19T07:54:57.015Z",
"dateUpdated": "2026-07-19T12:02:27.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64188 (GCVE-0-2026-64188)
Vulnerability from cvelistv5 – Published: 2026-07-20 16:27 – Updated: 2026-07-27 04:58
VLAI
EPSS
VEX
Title
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
rmnet_dellink() removes the endpoint from the hash table with
hlist_del_init_rcu() and then immediately frees it with kfree(). However,
RCU readers on the receive path (rmnet_rx_handler ->
__rmnet_map_ingress_handler) may still hold a reference to the endpoint and
dereference ep->egress_dev after the memory has been freed. The endpoint is
a kmalloc-32 object, and the stale read at offset 8 corresponds to the
egress_dev pointer.
BUG: unable to handle page fault for address: ffffffffde942eef
Oops: 0002 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY
RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)
Call Trace:
<TASK>
__rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)
rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6096)
__netif_receive_skb_one_core (net/core/dev.c:6208)
netif_receive_skb (net/core/dev.c:6467)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2003)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
</TASK>
Add an rcu_head field to struct rmnet_endpoint and replace kfree() with
kfree_rcu() so the endpoint memory remains valid through the RCU grace
period. Also remove the rmnet_vnd_dellink() call and inline only the
nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set
ep->egress_dev to NULL during the grace period, creating a data race
with lockless readers.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ceed73a2cf4aff2921802aa3d21d45280677547d , < c4e676c3505c5058922dc1a6f1ded795f6758135
(git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 9918698cf3aee4032e12bb42fd5a951dc465339b (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 310b93246bfec7d4452507e0c15477377ed9f025 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 1078ae8175777e80c9637996fb4a46c55f0ce576 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 41e06fcc5df0774d212e70c5b503fc769492bce3 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 8b17adf6d4fb6bf61fa4c3f58366a7c082799a71 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < f193e38cb257d033060b63f1cfd94af076b3a2ab (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < d00c953a8f69921f484b629801766da68f27f658 (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4e676c3505c5058922dc1a6f1ded795f6758135",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "9918698cf3aee4032e12bb42fd5a951dc465339b",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "310b93246bfec7d4452507e0c15477377ed9f025",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "1078ae8175777e80c9637996fb4a46c55f0ce576",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "41e06fcc5df0774d212e70c5b503fc769492bce3",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "8b17adf6d4fb6bf61fa4c3f58366a7c082799a71",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "f193e38cb257d033060b63f1cfd94af076b3a2ab",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "d00c953a8f69921f484b629801766da68f27f658",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()\n\nrmnet_dellink() removes the endpoint from the hash table with\nhlist_del_init_rcu() and then immediately frees it with kfree(). However,\nRCU readers on the receive path (rmnet_rx_handler -\u003e\n__rmnet_map_ingress_handler) may still hold a reference to the endpoint and\ndereference ep-\u003eegress_dev after the memory has been freed. The endpoint is\na kmalloc-32 object, and the stale read at offset 8 corresponds to the\negress_dev pointer.\n\n BUG: unable to handle page fault for address: ffffffffde942eef\n Oops: 0002 [#1] SMP NOPTI\n CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY\n RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)\n Call Trace:\n \u003cTASK\u003e\n __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)\n rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)\n __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096)\n __netif_receive_skb_one_core (net/core/dev.c:6208)\n netif_receive_skb (net/core/dev.c:6467)\n tun_get_user (drivers/net/tun.c:1955)\n tun_chr_write_iter (drivers/net/tun.c:2003)\n vfs_write (fs/read_write.c:688)\n ksys_write (fs/read_write.c:740)\n \u003c/TASK\u003e\n\nAdd an rcu_head field to struct rmnet_endpoint and replace kfree() with\nkfree_rcu() so the endpoint memory remains valid through the RCU grace\nperiod. Also remove the rmnet_vnd_dellink() call and inline only the\nnr_rmnet_devs decrement, since rmnet_vnd_dellink() would set\nep-\u003eegress_dev to NULL during the grace period, creating a data race\nwith lockless readers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T04:58:35.734Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4e676c3505c5058922dc1a6f1ded795f6758135"
},
{
"url": "https://git.kernel.org/stable/c/9918698cf3aee4032e12bb42fd5a951dc465339b"
},
{
"url": "https://git.kernel.org/stable/c/310b93246bfec7d4452507e0c15477377ed9f025"
},
{
"url": "https://git.kernel.org/stable/c/1078ae8175777e80c9637996fb4a46c55f0ce576"
},
{
"url": "https://git.kernel.org/stable/c/41e06fcc5df0774d212e70c5b503fc769492bce3"
},
{
"url": "https://git.kernel.org/stable/c/8b17adf6d4fb6bf61fa4c3f58366a7c082799a71"
},
{
"url": "https://git.kernel.org/stable/c/f193e38cb257d033060b63f1cfd94af076b3a2ab"
},
{
"url": "https://git.kernel.org/stable/c/d00c953a8f69921f484b629801766da68f27f658"
}
],
"title": "net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64188",
"datePublished": "2026-07-20T16:27:47.216Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-07-27T04:58:35.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64191 (GCVE-0-2026-64191)
Vulnerability from cvelistv5 – Published: 2026-07-20 16:27 – Updated: 2026-07-27 04:58
VLAI
EPSS
VEX
Title
i2c: stub: Reject I2C block transfers with invalid length
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
i2c_smbus_data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG_I2C_STUB=m, not built by default)
that must be loaded with a chip_addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
stub_xfer() to read or write past the end of the union
i2c_smbus_data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
<TASK>
stub_xfer (drivers/i2c/i2c-stub.c:223)
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
__x64_sys_ioctl (fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
The bug exists because i2c-stub implements .smbus_xfer directly,
bypassing the I2C_SMBUS_BLOCK_MAX validation in
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
I2C_SMBUS_I2C_BLOCK_DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
4710317891e4824ce1510a6b5066abbd3e917750 , < 7e9072dbd5f2f17934751873450d2c22080ead80
(git)
Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 21e87f336ac6303fed54a69b1d0d79a23b25c8d0 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 3fd225f3e4cd67ec8ddab1afed9da03c7c43537c (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 1c4ffe6b4f04365485ed58d64c9bb86b46fc9037 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 4bd8635f28c135a08aac6badcd7d9b5cdb34335f (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 5f4d2bd028ebb6e4c09a9d64842546022321d4a7 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 0526931b16e5a118d367b7bfce7d797e63f7ac69 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e (git) |
|
| Linux | Linux |
Affected:
2.6.33
Unaffected: 0 , < 2.6.33 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-stub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e9072dbd5f2f17934751873450d2c22080ead80",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "21e87f336ac6303fed54a69b1d0d79a23b25c8d0",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "3fd225f3e4cd67ec8ddab1afed9da03c7c43537c",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "1c4ffe6b4f04365485ed58d64c9bb86b46fc9037",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "4bd8635f28c135a08aac6badcd7d9b5cdb34335f",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "5f4d2bd028ebb6e4c09a9d64842546022321d4a7",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "0526931b16e5a118d367b7bfce7d797e63f7ac69",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-stub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n \u003cTASK\u003e\n stub_xfer (drivers/i2c/i2c-stub.c:223)\n __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n __x64_sys_ioctl (fs/ioctl.c:583)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T04:58:48.249Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80"
},
{
"url": "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0"
},
{
"url": "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c"
},
{
"url": "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037"
},
{
"url": "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f"
},
{
"url": "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7"
},
{
"url": "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69"
},
{
"url": "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e"
}
],
"title": "i2c: stub: Reject I2C block transfers with invalid length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64191",
"datePublished": "2026-07-20T16:27:51.120Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-07-27T04:58:48.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64246 (GCVE-0-2026-64246)
Vulnerability from cvelistv5 – Published: 2026-07-24 15:31 – Updated: 2026-07-24 15:31
VLAI
EPSS
VEX
Title
power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
Move of_node_put(dn) after the of_match_node() call, which still needs
the node pointer. The node reference is correctly released after use.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < 93c7ee139721936b6fa717572e74d3994603ae13
(git)
Affected: e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < cdda7d384c05485a232ae9a849f6445accb095bf (git) Affected: e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < c04d606f8b35ee7d3ed243f63893a607e9d6c0bc (git) Affected: e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < 3928ae803dee044b01076c478c279c0bd54164cd (git) Affected: e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < 2205275be9be981e70ff29610b0117d8853fac70 (git) Affected: e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < d109e72f3fbccb540473285d17d7519584f7f76e (git) Affected: e2f471efe1d607a7aff38ce53ec717cebe4283d6 , < 8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/reset/linkstation-poweroff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93c7ee139721936b6fa717572e74d3994603ae13",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
},
{
"lessThan": "cdda7d384c05485a232ae9a849f6445accb095bf",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
},
{
"lessThan": "c04d606f8b35ee7d3ed243f63893a607e9d6c0bc",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
},
{
"lessThan": "3928ae803dee044b01076c478c279c0bd54164cd",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
},
{
"lessThan": "2205275be9be981e70ff29610b0117d8853fac70",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
},
{
"lessThan": "d109e72f3fbccb540473285d17d7519584f7f76e",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
},
{
"lessThan": "8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd",
"status": "affected",
"version": "e2f471efe1d607a7aff38ce53ec717cebe4283d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/reset/linkstation-poweroff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()\n\nMove of_node_put(dn) after the of_match_node() call, which still needs\nthe node pointer. The node reference is correctly released after use."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:31:14.709Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93c7ee139721936b6fa717572e74d3994603ae13"
},
{
"url": "https://git.kernel.org/stable/c/cdda7d384c05485a232ae9a849f6445accb095bf"
},
{
"url": "https://git.kernel.org/stable/c/c04d606f8b35ee7d3ed243f63893a607e9d6c0bc"
},
{
"url": "https://git.kernel.org/stable/c/3928ae803dee044b01076c478c279c0bd54164cd"
},
{
"url": "https://git.kernel.org/stable/c/2205275be9be981e70ff29610b0117d8853fac70"
},
{
"url": "https://git.kernel.org/stable/c/d109e72f3fbccb540473285d17d7519584f7f76e"
},
{
"url": "https://git.kernel.org/stable/c/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd"
}
],
"title": "power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64246",
"datePublished": "2026-07-24T15:31:14.709Z",
"dateReserved": "2026-07-19T15:36:31.772Z",
"dateUpdated": "2026-07-24T15:31:14.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64249 (GCVE-0-2026-64249)
Vulnerability from cvelistv5 – Published: 2026-07-24 15:31 – Updated: 2026-07-24 15:31
VLAI
EPSS
VEX
Title
fpga: region: fix use-after-free in child_regions_with_firmware()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fpga: region: fix use-after-free in child_regions_with_firmware()
Move of_node_put(child_region) after the error print to avoid accessing
freed memory when pr_err() references child_region.
[ Yilun: Fix the Fixes tag ]
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
0fa20cdfcc1f68847cdfc47824476301eedc8297 , < e918942bcc5355ad5b44ba557935dffc0727b0eb
(git)
Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < 866184fc7ae42a0070f1141ae8c5dca7c24a59e2 (git) Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < 070b0ce947b18fa3dec0729695147f7e19599649 (git) Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < fbaf509ad7cb2f7dafe73ca20c956104cfcc9d68 (git) Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < e79afcb0a66d2b3c33e510eade902537e656fc00 (git) Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < 369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1 (git) Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < 5e098e40e8bac43ed58645c10d5fad781966efe4 (git) Affected: 0fa20cdfcc1f68847cdfc47824476301eedc8297 , < 54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3 (git) |
|
| Linux | Linux |
Affected:
4.10
Unaffected: 0 , < 4.10 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/fpga/of-fpga-region.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e918942bcc5355ad5b44ba557935dffc0727b0eb",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "866184fc7ae42a0070f1141ae8c5dca7c24a59e2",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "070b0ce947b18fa3dec0729695147f7e19599649",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "fbaf509ad7cb2f7dafe73ca20c956104cfcc9d68",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "e79afcb0a66d2b3c33e510eade902537e656fc00",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "5e098e40e8bac43ed58645c10d5fad781966efe4",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
},
{
"lessThan": "54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3",
"status": "affected",
"version": "0fa20cdfcc1f68847cdfc47824476301eedc8297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/fpga/of-fpga-region.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: region: fix use-after-free in child_regions_with_firmware()\n\nMove of_node_put(child_region) after the error print to avoid accessing\nfreed memory when pr_err() references child_region.\n\n[ Yilun: Fix the Fixes tag ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:31:16.458Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e918942bcc5355ad5b44ba557935dffc0727b0eb"
},
{
"url": "https://git.kernel.org/stable/c/866184fc7ae42a0070f1141ae8c5dca7c24a59e2"
},
{
"url": "https://git.kernel.org/stable/c/070b0ce947b18fa3dec0729695147f7e19599649"
},
{
"url": "https://git.kernel.org/stable/c/fbaf509ad7cb2f7dafe73ca20c956104cfcc9d68"
},
{
"url": "https://git.kernel.org/stable/c/e79afcb0a66d2b3c33e510eade902537e656fc00"
},
{
"url": "https://git.kernel.org/stable/c/369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1"
},
{
"url": "https://git.kernel.org/stable/c/5e098e40e8bac43ed58645c10d5fad781966efe4"
},
{
"url": "https://git.kernel.org/stable/c/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3"
}
],
"title": "fpga: region: fix use-after-free in child_regions_with_firmware()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64249",
"datePublished": "2026-07-24T15:31:16.458Z",
"dateReserved": "2026-07-19T15:36:31.772Z",
"dateUpdated": "2026-07-24T15:31:16.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64252 (GCVE-0-2026-64252)
Vulnerability from cvelistv5 – Published: 2026-07-24 15:31 – Updated: 2026-07-24 15:31
VLAI
EPSS
VEX
Title
MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
Summary
In the Linux kernel, the following vulnerability has been resolved:
MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
In 64-bit configurations calling the initial console output handler from
a kernel thread other than the initial one will result in a situation
where the stack has been placed in the XKPHYS 64-bit memory segment and
consequently so has been the buffer allocated there that is used as the
argument corresponding to the `%s' output conversion specifier for the
firmware's printf() entry point.
This 64-bit address will then be truncated by 32-bit firmware, resulting
in an attempt to access the wrong memory location, which in turn will
cause all kinds of unpredictable behaviour, such as a kernel crash:
Console: colour dummy device 160x64
Calibrating delay loop... 49.36 BogoMIPS (lpj=192512)
pid_max: default: 32768 minimum: 301
CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800
Oops[#1]:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121
$ 0 : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0
$ 4 : 000000000203bd00 ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073
$ 8 : 0a303d7469000000 0000000000000000 0000000000000073 ffffffffbfc0f473
$12 : 0000000000000002 0000000000000000 ffffffff80684c1c 0000000000000000
$16 : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240
$20 : ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b
$24 : ffffffffffffffbf 000000000203bd00
$28 : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800
Hi : 0000000000000000
Lo : 0000000000000aa8
epc : ffffffffbfc08364 0xffffffffbfc08364
ra : ffffffffbfc08800 0xffffffffbfc08800
Status: 140120e2 KX SX UX KERNEL EXL
Cause : 00000008 (ExcCode 02)
BadVA : 000000000203bd00
PrId : 00000430 (R4000SC)
Modules linked in:
Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)
Stack : 0000000000000000 0000000000000000 0000000000000000 0000004d0000004d
80684cc0806a2a40 80596dc80000004d 8061000000000000 bfc0850c80684c38
0000000000000000 000000000203bd00 0000000000000000 0000000000000000
0000000000000000 00000000bfc0f3b4 0000000000000000 0000000000000000
0000000000000000 0000000000000000 0000000000000000 0000000000000000
0000000000000000 0000000000000000 0000000000000000 0000000000000000
0000002500000000 0000000000000000 0000000000000000 802c1a7400000000
0203bd0080596dc8 0203bd4d69000000 6c61632000000018 5f746567646e6172
6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320
806a0a38806b0000 806a0a38806b0000 00000000806b0000 80683c58806b0000
...
Call Trace:
Code: a082ffff 03e00008 00601021 <80820000> 00001821 10400005 24840001 80820000 24630001
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Fatal exception in interrupt
KN04 V2.1k (PC: 0xa0026768, SP: 0x806848e8)
>>
In this case the pointer in $4 was truncated from 0x980000000203bd00 to
0x000000000203bd00.
This may happen when no final console driver has been enabled in the
configuration and consequently the initial console continues being used
late into bootstrap or with an upcoming change that will switch the zs
driver to use a platform device, which in turn will make the console
handover happen only after other kernel threads have already been
started.
Fix the issue by making the buffer static and initdata, and therefore
placed in the CKSEG0 32-bit compatibility segment, observing that the
console output handler is called with the console lock held, implying
no need for this code to be reentrant. Add an assertion to verify the
buffer actually has been placed in a compatibility segment.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9e22b6fc6532cd566dad6d89d8fb3885248e364a
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1c80327dedf05b8c8ca025b76c21235b19dd3a86 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 35212f2adc2cf15122b96b987519de235b855e46 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 07c245bc39f94481fd75ff1ed54f7ab97111f3dd (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7fb13fd35110ebe95eb053faf79d018f51144d85 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/mips/dec/prom/console.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e22b6fc6532cd566dad6d89d8fb3885248e364a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1c80327dedf05b8c8ca025b76c21235b19dd3a86",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "35212f2adc2cf15122b96b987519de235b855e46",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "07c245bc39f94481fd75ff1ed54f7ab97111f3dd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7fb13fd35110ebe95eb053faf79d018f51144d85",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/mips/dec/prom/console.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: DEC: Prevent initial console buffer from landing in XKPHYS\n\nIn 64-bit configurations calling the initial console output handler from\na kernel thread other than the initial one will result in a situation\nwhere the stack has been placed in the XKPHYS 64-bit memory segment and\nconsequently so has been the buffer allocated there that is used as the\nargument corresponding to the `%s\u0027 output conversion specifier for the\nfirmware\u0027s printf() entry point.\n\nThis 64-bit address will then be truncated by 32-bit firmware, resulting\nin an attempt to access the wrong memory location, which in turn will\ncause all kinds of unpredictable behaviour, such as a kernel crash:\n\n Console: colour dummy device 160x64\n Calibrating delay loop... 49.36 BogoMIPS (lpj=192512)\n pid_max: default: 32768 minimum: 301\n CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800\n Oops[#1]:\n CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121\n $ 0 : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0\n $ 4 : 000000000203bd00 ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073\n $ 8 : 0a303d7469000000 0000000000000000 0000000000000073 ffffffffbfc0f473\n $12 : 0000000000000002 0000000000000000 ffffffff80684c1c 0000000000000000\n $16 : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240\n $20 : ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b\n $24 : ffffffffffffffbf 000000000203bd00\n $28 : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800\n Hi : 0000000000000000\n Lo : 0000000000000aa8\n epc : ffffffffbfc08364 0xffffffffbfc08364\n ra : ffffffffbfc08800 0xffffffffbfc08800\n Status: 140120e2 KX SX UX KERNEL EXL\n Cause : 00000008 (ExcCode 02)\n BadVA : 000000000203bd00\n PrId : 00000430 (R4000SC)\n Modules linked in:\n Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)\n Stack : 0000000000000000 0000000000000000 0000000000000000 0000004d0000004d\n 80684cc0806a2a40 80596dc80000004d 8061000000000000 bfc0850c80684c38\n 0000000000000000 000000000203bd00 0000000000000000 0000000000000000\n 0000000000000000 00000000bfc0f3b4 0000000000000000 0000000000000000\n 0000000000000000 0000000000000000 0000000000000000 0000000000000000\n 0000000000000000 0000000000000000 0000000000000000 0000000000000000\n 0000002500000000 0000000000000000 0000000000000000 802c1a7400000000\n 0203bd0080596dc8 0203bd4d69000000 6c61632000000018 5f746567646e6172\n 6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320\n 806a0a38806b0000 806a0a38806b0000 00000000806b0000 80683c58806b0000\n ...\n Call Trace:\n\n Code: a082ffff 03e00008 00601021 \u003c80820000\u003e 00001821 10400005 24840001 80820000 24630001\n\n ---[ end trace 0000000000000000 ]---\n Kernel panic - not syncing: Fatal exception in interrupt\n\n KN04 V2.1k (PC: 0xa0026768, SP: 0x806848e8)\n \u003e\u003e\n\nIn this case the pointer in $4 was truncated from 0x980000000203bd00 to\n0x000000000203bd00.\n\nThis may happen when no final console driver has been enabled in the\nconfiguration and consequently the initial console continues being used\nlate into bootstrap or with an upcoming change that will switch the zs\ndriver to use a platform device, which in turn will make the console\nhandover happen only after other kernel threads have already been\nstarted.\n\nFix the issue by making the buffer static and initdata, and therefore\nplaced in the CKSEG0 32-bit compatibility segment, observing that the\nconsole output handler is called with the console lock held, implying\nno need for this code to be reentrant. Add an assertion to verify the\nbuffer actually has been placed in a compatibility segment."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:31:19.344Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e22b6fc6532cd566dad6d89d8fb3885248e364a"
},
{
"url": "https://git.kernel.org/stable/c/1c80327dedf05b8c8ca025b76c21235b19dd3a86"
},
{
"url": "https://git.kernel.org/stable/c/8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7"
},
{
"url": "https://git.kernel.org/stable/c/ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f"
},
{
"url": "https://git.kernel.org/stable/c/35212f2adc2cf15122b96b987519de235b855e46"
},
{
"url": "https://git.kernel.org/stable/c/6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e"
},
{
"url": "https://git.kernel.org/stable/c/07c245bc39f94481fd75ff1ed54f7ab97111f3dd"
},
{
"url": "https://git.kernel.org/stable/c/7fb13fd35110ebe95eb053faf79d018f51144d85"
}
],
"title": "MIPS: DEC: Prevent initial console buffer from landing in XKPHYS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64252",
"datePublished": "2026-07-24T15:31:19.344Z",
"dateReserved": "2026-07-19T15:36:31.773Z",
"dateUpdated": "2026-07-24T15:31:19.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64254 (GCVE-0-2026-64254)
Vulnerability from cvelistv5 – Published: 2026-07-24 15:31 – Updated: 2026-07-24 15:31
VLAI
EPSS
VEX
Title
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
Summary
In the Linux kernel, the following vulnerability has been resolved:
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown
path ends up calling pci_iounmap() on the same iomem with some offset,
which is unnecessary and triggers a kernel warning like the following:
Trying to vunmap() nonexistent vm area (0000000069a5ffe8)
WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937
[...]
Call trace:
vunmap+0x58/0x68 (P)
iounmap+0x34/0x48
pci_iounmap+0x2c/0x40
ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]
pci_device_remove+0x48/0xf8
device_remove+0x50/0x88
device_release_driver_internal+0x1c8/0x228
driver_detach+0x50/0xb0
bus_remove_driver+0x74/0x100
driver_unregister+0x34/0x68
pci_unregister_driver+0x34/0xa0
ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]
[...]
Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 , < eb47b9bffd07a47b84910847cb5ea066ce184055
(git)
Affected: e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 , < 06f6dd2ff2bd07eaf7178a807407ff27e85122b4 (git) Affected: e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 , < a4be4a1308f02bff79a30eea2d04ead5b63685f2 (git) Affected: e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 , < 81371dbd23601f67f01372817fdbab42c5601e43 (git) Affected: e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 , < 9764a786ba98db58f0725913c369e721253aba33 (git) Affected: e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 , < d876153680e3d721d385e554def919bce3d18c74 (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.38 , ≤ 6.18.* (semver) Unaffected: 7.1.3 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/hw/epf/ntb_hw_epf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb47b9bffd07a47b84910847cb5ea066ce184055",
"status": "affected",
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"versionType": "git"
},
{
"lessThan": "06f6dd2ff2bd07eaf7178a807407ff27e85122b4",
"status": "affected",
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"versionType": "git"
},
{
"lessThan": "a4be4a1308f02bff79a30eea2d04ead5b63685f2",
"status": "affected",
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"versionType": "git"
},
{
"lessThan": "81371dbd23601f67f01372817fdbab42c5601e43",
"status": "affected",
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"versionType": "git"
},
{
"lessThan": "9764a786ba98db58f0725913c369e721253aba33",
"status": "affected",
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"versionType": "git"
},
{
"lessThan": "d876153680e3d721d385e554def919bce3d18c74",
"status": "affected",
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/hw/epf/ntb_hw_epf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR\n\nWhen BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown\npath ends up calling pci_iounmap() on the same iomem with some offset,\nwhich is unnecessary and triggers a kernel warning like the following:\n\n Trying to vunmap() nonexistent vm area (0000000069a5ffe8)\n WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937\n [...]\n Call trace:\n vunmap+0x58/0x68 (P)\n iounmap+0x34/0x48\n pci_iounmap+0x2c/0x40\n ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]\n pci_device_remove+0x48/0xf8\n device_remove+0x50/0x88\n device_release_driver_internal+0x1c8/0x228\n driver_detach+0x50/0xb0\n bus_remove_driver+0x74/0x100\n driver_unregister+0x34/0x68\n pci_unregister_driver+0x34/0xa0\n ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]\n [...]\n\nFix it by unmapping only when PEER_SPAD and CONFIG use difference bars."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:31:22.293Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055"
},
{
"url": "https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4"
},
{
"url": "https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2"
},
{
"url": "https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43"
},
{
"url": "https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33"
},
{
"url": "https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74"
}
],
"title": "NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64254",
"datePublished": "2026-07-24T15:31:22.293Z",
"dateReserved": "2026-07-19T15:36:31.773Z",
"dateUpdated": "2026-07-24T15:31:22.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64529 (GCVE-0-2026-64529)
Vulnerability from cvelistv5 – Published: 2026-07-25 09:24 – Updated: 2026-07-27 05:01
VLAI
EPSS
VEX
Title
crypto: qat - remove unused character device and IOCTLs
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - remove unused character device and IOCTLs
The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.
The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.
Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.
Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.
Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.
Severity
7.8 (High)
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 071590a44cbc38483fceb1ab943363ec26868e1b
(git)
Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 1de076f43e64bf65fbe7280a269c70e0e60518df (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 6848a6e39cac44fdb7cb88f0f777df62172d1551 (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < b1ea97076bd0a5196290deba172034e480646727 (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < b8ebf008696de1ec08c90d51f94d7e40bd448be1 (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < de2cc38489b629927910b1aeff69bba7bd5c6f1b (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < 3ae49dd04dbb11fb73f17f58a982dba128abe83a (git) Affected: d8cba25d2c68992a6e7c1d329b690a9ebe01167d , < d237230728c567297f2f98b425d63156ab2ed17f (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1.2 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/userspace-api/ioctl/ioctl-number.rst",
"drivers/crypto/intel/qat/qat_common/adf_cfg.c",
"drivers/crypto/intel/qat/qat_common/adf_cfg.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
"drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "071590a44cbc38483fceb1ab943363ec26868e1b",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "1de076f43e64bf65fbe7280a269c70e0e60518df",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "6848a6e39cac44fdb7cb88f0f777df62172d1551",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "b1ea97076bd0a5196290deba172034e480646727",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "b8ebf008696de1ec08c90d51f94d7e40bd448be1",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "de2cc38489b629927910b1aeff69bba7bd5c6f1b",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "3ae49dd04dbb11fb73f17f58a982dba128abe83a",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
},
{
"lessThan": "d237230728c567297f2f98b425d63156ab2ed17f",
"status": "affected",
"version": "d8cba25d2c68992a6e7c1d329b690a9ebe01167d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/userspace-api/ioctl/ioctl-number.rst",
"drivers/crypto/intel/qat/qat_common/adf_cfg.c",
"drivers/crypto/intel/qat/qat_common/adf_cfg.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_common.h",
"drivers/crypto/intel/qat/qat_common/adf_cfg_user.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c",
"drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - remove unused character device and IOCTLs\n\nThe QAT driver exposes a character device (qat_adf_ctl) with IOCTLs\nfor device configuration, start, stop, status query and enumeration.\nThese IOCTLs are not part of any public uAPI header and have no known\nin-tree or out-of-tree users. Device lifecycle is already managed via\nsysfs.\n\nThe ioctl interface also increases the attack surface and is the\nsubject of a number of bug reports.\n\nRemove the character device, the IOCTL definitions, and the related\ndata structures (adf_dev_status_info, adf_user_cfg_key_val,\nadf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused\nadf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal\nmodule_init/module_exit hooks for workqueue, AER, and crypto/compression\nalgorithm registration.\n\nClean up leftover dead code that was only reachable from the removed\nIOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),\nadf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),\nadf_get_vf_real_id() and the unused ADF_CFG macros.\n\nAdditionally, drop the entry associated to QAT IOCTLs in\nioctl-number.rst."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T05:01:41.855Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b"
},
{
"url": "https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df"
},
{
"url": "https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a"
},
{
"url": "https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551"
},
{
"url": "https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727"
},
{
"url": "https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1"
},
{
"url": "https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b"
},
{
"url": "https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a"
},
{
"url": "https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f"
}
],
"title": "crypto: qat - remove unused character device and IOCTLs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64529",
"datePublished": "2026-07-25T09:24:18.750Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-07-27T05:01:41.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…