Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0981
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à l'intégrité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.100-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-64287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64287"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64192"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64542"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64405"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53260"
},
{
"name": "CVE-2026-53365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53365"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-64508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64508"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64421"
},
{
"name": "CVE-2026-64341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64341"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-63970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63970"
},
{
"name": "CVE-2026-64559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64559"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64555"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64509"
},
{
"name": "CVE-2026-64307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64307"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-64227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64227"
},
{
"name": "CVE-2026-64481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64481"
},
{
"name": "CVE-2026-53005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53005"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64434"
},
{
"name": "CVE-2026-64558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64558"
},
{
"name": "CVE-2026-45944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45944"
},
{
"name": "CVE-2026-64286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64286"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64369"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64543"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-64493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64493"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64416"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64507"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0981",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-07-31",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00316",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00316.html"
}
]
}
CVE-2026-64542 (GCVE-0-2026-64542)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-03 09:32
VLAI
EPSS
VEX
Title
ipv6: ndisc: fix NULL deref in accept_untracked_na()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ndisc: fix NULL deref in accept_untracked_na()
accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)
and dereferences idev->cnf.accept_untracked_na without a NULL check,
even though its only caller ndisc_recv_na() already fetched and
NULL-checked idev for the same device.
Both reads of dev->ip6_ptr run in the same RCU read-side critical
section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr
between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()
without the synchronize_net() that orders the unregister path, so the
re-fetch returns NULL and oopses:
BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)
Read of size 4 at addr 0000000000000364
Call Trace:
<IRQ>
ndisc_recv_na (net/ipv6/ndisc.c:974)
icmpv6_rcv (net/ipv6/icmp.c:1193)
ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)
ip6_input_finish (net/ipv6/ip6_input.c:534)
ip6_input (net/ipv6/ip6_input.c:545)
ip6_mc_input (net/ipv6/ip6_input.c:635)
ipv6_rcv (net/ipv6/ip6_input.c:351)
</IRQ>
It is reachable by an unprivileged user via a network namespace.
Pass the caller's already validated idev instead of re-fetching it; the
idev stays alive for the whole RCU critical section, so it is safe even
after dev->ip6_ptr has been cleared.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 , < 160d3f0d7a556ceae505dcab521a37057b4ce28f
(git)
Affected: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 , < 62c719203cb521b64fab74da94a81bdde5c18808 (git) Affected: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 , < a6450f7cfae57b382cbaf66a577765c9a88b3c58 (git) Affected: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 , < 63d1c23764de2309cedbb779c75188d257a09d9b (git) Affected: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 , < d186e942365acece7c56d39da05dd63bf95b280a (git) |
|
| Linux | Linux |
Affected:
6.0
Unaffected: 0 , < 6.0 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "160d3f0d7a556ceae505dcab521a37057b4ce28f",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "62c719203cb521b64fab74da94a81bdde5c18808",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "a6450f7cfae57b382cbaf66a577765c9a88b3c58",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "63d1c23764de2309cedbb779c75188d257a09d9b",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "d186e942365acece7c56d39da05dd63bf95b280a",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ndisc: fix NULL deref in accept_untracked_na()\n\naccept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)\nand dereferences idev-\u003ecnf.accept_untracked_na without a NULL check,\neven though its only caller ndisc_recv_na() already fetched and\nNULL-checked idev for the same device.\n\nBoth reads of dev-\u003eip6_ptr run in the same RCU read-side critical\nsection, but a concurrent addrconf_ifdown() can clear dev-\u003eip6_ptr\nbetween them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()\nwithout the synchronize_net() that orders the unregister path, so the\nre-fetch returns NULL and oopses:\n\n BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)\n Read of size 4 at addr 0000000000000364\n Call Trace:\n \u003cIRQ\u003e\n ndisc_recv_na (net/ipv6/ndisc.c:974)\n icmpv6_rcv (net/ipv6/icmp.c:1193)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ip6_input (net/ipv6/ip6_input.c:545)\n ip6_mc_input (net/ipv6/ip6_input.c:635)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n \u003c/IRQ\u003e\n\nIt is reachable by an unprivileged user via a network namespace.\n\nPass the caller\u0027s already validated idev instead of re-fetching it; the\nidev stays alive for the whole RCU critical section, so it is safe even\nafter dev-\u003eip6_ptr has been cleared."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T09:32:42.268Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/160d3f0d7a556ceae505dcab521a37057b4ce28f"
},
{
"url": "https://git.kernel.org/stable/c/62c719203cb521b64fab74da94a81bdde5c18808"
},
{
"url": "https://git.kernel.org/stable/c/a6450f7cfae57b382cbaf66a577765c9a88b3c58"
},
{
"url": "https://git.kernel.org/stable/c/63d1c23764de2309cedbb779c75188d257a09d9b"
},
{
"url": "https://git.kernel.org/stable/c/d186e942365acece7c56d39da05dd63bf95b280a"
}
],
"title": "ipv6: ndisc: fix NULL deref in accept_untracked_na()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64542",
"datePublished": "2026-07-27T20:10:34.994Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-03T09:32:42.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64543 (GCVE-0-2026-64543)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).
L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:
BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
<IRQ>
tipc_disc_rcv (net/tipc/discover.c:149)
tipc_rcv (net/tipc/node.c:2126)
tipc_udp_recv (net/tipc/udp_media.c:391)
udp_rcv (net/ipv4/udp.c:2643)
ip_local_deliver_finish (net/ipv4/ip_input.c:241)
</IRQ>
Freed by task 181:
kfree (mm/slub.c:6565)
bearer_disable (net/tipc/bearer.c:418)
tipc_nl_bearer_disable (net/tipc/bearer.c:1001)
The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.
Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.
Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 , < 5e215bf1c47fdddf8203a0fe80a0ed594065f101
(git)
Affected: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 , < ec7d54d8cc1723921d671e3272b427c96366506f (git) Affected: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 , < a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2 (git) Affected: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 , < b65289e1c3f352a9f92c6e19713ddd647e033253 (git) Affected: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 , < 1579342d71133da7f00daa02c75cebec7372097b (git) |
|
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e215bf1c47fdddf8203a0fe80a0ed594065f101",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "ec7d54d8cc1723921d671e3272b427c96366506f",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "b65289e1c3f352a9f92c6e19713ddd647e033253",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "1579342d71133da7f00daa02c75cebec7372097b",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b-\u003edisc with tipc_disc_delete()\u0027s plain kfree(),\nbut tipc_disc_rcv() still dereferences b-\u003edisc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -\u003e tipc_rcv -\u003e tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n \u003cIRQ\u003e\n tipc_disc_rcv (net/tipc/discover.c:149)\n tipc_rcv (net/tipc/node.c:2126)\n tipc_udp_recv (net/tipc/udp_media.c:391)\n udp_rcv (net/ipv4/udp.c:2643)\n ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n \u003c/IRQ\u003e\n Freed by task 181:\n kfree (mm/slub.c:6565)\n bearer_disable (net/tipc/bearer.c:418)\n tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race \u2014 one thread floods TIPC discovery packets at the bearer\u0027s UDP port while another disables the bearer \u2014 and `bearer_disable()` clears `b-\u003eup` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d-\u003enet` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d-\u003eskb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d-\u003eskb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory \u2014 together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:50.642Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101"
},
{
"url": "https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f"
},
{
"url": "https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2"
},
{
"url": "https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253"
},
{
"url": "https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b"
}
],
"title": "tipc: fix use-after-free of the discoverer in tipc_disc_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64543",
"datePublished": "2026-07-27T20:10:35.565Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-05T12:42:50.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64544 (GCVE-0-2026-64544)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-07-27 20:10
VLAI
EPSS
VEX
Title
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
pefile_digest_pe_contents() computes the trailing-data hash length as
pelen - (hashed_bytes + certs_size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto_shash_update() which reads out of bounds and
panics on unmapped vmalloc guard pages.
BUG: unable to handle page fault for address: ffffc900038d8000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)
Call Trace:
<TASK>
__sha256_update (lib/crypto/sha256.c:208)
crypto_sha256_update (crypto/sha256.c:142)
verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)
kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)
__do_sys_kexec_file_load (kernel/kexec_file.c:406)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>
Kernel panic - not syncing: Fatal exception
Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
af316fc442ef23901bbfcec5af55e69ca6ce9563 , < 89efd998470a93284b7ad5a20d4e0e3c6858ae8e
(git)
Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < 7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c (git) Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < b798ada5a5d1cb4cc4cfa72074b1b463eca6c506 (git) Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < 627938383761fb4334b41ebe7ef438d6b8b19d60 (git) Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < e162bc386e71b5412425a38ee048e8d2185491b9 (git) Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < 6acd2fbd00f9c72aebefce63fc2e73e8f3d79061 (git) Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < 803591785d33cf13b6f73ce2796e8b9e6d5e6526 (git) Affected: af316fc442ef23901bbfcec5af55e69ca6ce9563 , < f7dd32c5179d7755de18e21d5674b08f9e5cb180 (git) |
|
| Linux | Linux |
Affected:
3.17
Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/verify_pefile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89efd998470a93284b7ad5a20d4e0e3c6858ae8e",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "b798ada5a5d1cb4cc4cfa72074b1b463eca6c506",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "627938383761fb4334b41ebe7ef438d6b8b19d60",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "e162bc386e71b5412425a38ee048e8d2185491b9",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "6acd2fbd00f9c72aebefce63fc2e73e8f3d79061",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "803591785d33cf13b6f73ce2796e8b9e6d5e6526",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "f7dd32c5179d7755de18e21d5674b08f9e5cb180",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/verify_pefile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents\n\npefile_digest_pe_contents() computes the trailing-data hash length as\npelen - (hashed_bytes + certs_size). A crafted PE can make the addition\nexceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.\nThis is passed to crypto_shash_update() which reads out of bounds and\npanics on unmapped vmalloc guard pages.\n\n BUG: unable to handle page fault for address: ffffc900038d8000\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)\n Call Trace:\n \u003cTASK\u003e\n __sha256_update (lib/crypto/sha256.c:208)\n crypto_sha256_update (crypto/sha256.c:142)\n verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)\n kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)\n __do_sys_kexec_file_load (kernel/kexec_file.c:406)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception\n\nValidate that the addition does not overflow and the result does not\nexceed pelen before the subtraction. Return -ELIBBAD on failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T20:10:36.101Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e"
},
{
"url": "https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c"
},
{
"url": "https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506"
},
{
"url": "https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60"
},
{
"url": "https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9"
},
{
"url": "https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061"
},
{
"url": "https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526"
},
{
"url": "https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180"
}
],
"title": "crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64544",
"datePublished": "2026-07-27T20:10:36.101Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-07-27T20:10:36.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64545 (GCVE-0-2026-64545)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
net, bpf: check master for NULL in xdp_master_redirect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: check master for NULL in xdp_master_redirect()
xdp_master_redirect() dereferences the result of
netdev_master_upper_dev_get_rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.
The reach guard only checks netif_is_bond_slave(). On bond slave release
bond_upper_dev_unlink() drops the upper-master adjacency before clearing
IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window
still passes netif_is_bond_slave() while master is already NULL, and
faults on master->flags at offset 0xb0:
BUG: kernel NULL pointer dereference, address: 00000000000000b0
RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)
Call Trace:
xdp_master_redirect (net/core/filter.c:4432)
bpf_prog_run_generic_xdp (include/net/xdp.h:700)
do_xdp_generic (net/core/dev.c:5608)
__netif_receive_skb_one_core (net/core/dev.c:6204)
process_backlog (net/core/dev.c:6319)
__napi_poll (net/core/dev.c:7729)
net_rx_action (net/core/dev.c:7792)
handle_softirqs (kernel/softirq.c:622)
__dev_queue_xmit (include/linux/bottom_half.h:33)
packet_sendmsg (net/packet/af_packet.c:3082)
__sys_sendto (net/socket.c:2252)
Kernel panic - not syncing: Fatal exception in interrupt
The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.
Severity
7.5 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < c99ca049e910d61ddbd28cc2c47242f2bfbb4970
(git)
Affected: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < e2a56441233131fe18a76001de347ecda217e40c (git) Affected: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < 3876318ea54e83eb70982b8280a3c5e4e32269bf (git) Affected: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < 4edbcacca09f92b85d3951b6add11894b20a84bc (git) Affected: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < 03b743586a2469744e96e9c1015096d07240935d (git) Affected: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < 89c103d702b25ceb2d097faf854deb47b53b17ff (git) Affected: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 , < e82d8cc4321c373dc46e741cd2dfdaa7921fddb7 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c99ca049e910d61ddbd28cc2c47242f2bfbb4970",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "e2a56441233131fe18a76001de347ecda217e40c",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "3876318ea54e83eb70982b8280a3c5e4e32269bf",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "4edbcacca09f92b85d3951b6add11894b20a84bc",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "03b743586a2469744e96e9c1015096d07240935d",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "89c103d702b25ceb2d097faf854deb47b53b17ff",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "e82d8cc4321c373dc46e741cd2dfdaa7921fddb7",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet, bpf: check master for NULL in xdp_master_redirect()\n\nxdp_master_redirect() dereferences the result of\nnetdev_master_upper_dev_get_rcu() without a NULL check, but that helper\nreturns NULL when the receiving device has no upper-master adjacency.\n\nThe reach guard only checks netif_is_bond_slave(). On bond slave release\nbond_upper_dev_unlink() drops the upper-master adjacency before clearing\nIFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window\nstill passes netif_is_bond_slave() while master is already NULL, and\nfaults on master-\u003eflags at offset 0xb0:\n\n BUG: kernel NULL pointer dereference, address: 00000000000000b0\n RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)\n Call Trace:\n xdp_master_redirect (net/core/filter.c:4432)\n bpf_prog_run_generic_xdp (include/net/xdp.h:700)\n do_xdp_generic (net/core/dev.c:5608)\n __netif_receive_skb_one_core (net/core/dev.c:6204)\n process_backlog (net/core/dev.c:6319)\n __napi_poll (net/core/dev.c:7729)\n net_rx_action (net/core/dev.c:7792)\n handle_softirqs (kernel/softirq.c:622)\n __dev_queue_xmit (include/linux/bottom_half.h:33)\n packet_sendmsg (net/packet/af_packet.c:3082)\n __sys_sendto (net/socket.c:2252)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThe missing check dates back to the original code; commit 1921f91298d1\n(\"net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master\")\nlater added the master-\u003eflags read where the fault now lands but kept the\nunconditional deref. Check master for NULL before use; a NULL master is\ntreated the same as one that is not up."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The faulting path is the XDP receive hook \u2014 packets arriving on a bond slave drive `bpf_prog_run_xdp`/`do_xdp_generic` \u2192 `xdp_master_redirect()`, so a remote attacker sending traffic to a bonded interface running an XDP_TX program (XDP load balancers/DDoS scrubbers on bonded uplinks are a mainstream deployment) supplies the triggering packets with no local access.\nAC:L - The attacker controls the packet side of the race and can sustain line-rate traffic so the multi-microsecond window between adjacency teardown and `IFF_SLAVE` clearing is hit essentially deterministically; where the attacker also holds the network configuration side (container/netns with bond and XDP control) both sides of the race are attacker-driven, which the kernel guidance classes as Low.\nPR:N - No credentials or authentication are needed to send frames to a bonded interface, and the fault occurs in softirq during receive processing before any socket, filesystem, or user-level authorization is consulted \u2014 matching the PR:N treatment of the sibling fix CVE-2026-53069 in this same function.\nUI:N - No victim action is required; the slave-release window is reached by routine and externally-induced events (bond reconfiguration, `bond_enslave` rollback, NIC hotplug/`NETDEV_UNREGISTER`), and the attacker need only keep traffic flowing.\nS:U - The NULL dereference and its consequences are confined to the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is a read of `master-\u003eflags` at fixed offset 0xb0 from a NULL pointer, which faults immediately; no memory contents are returned to the attacker and no kernel addresses are disclosed.\nI:N - There is no write primitive \u2014 the defect is a read-side dereference that faults before `master-\u003enetdev_ops-\u003endo_xdp_get_xmit_slave()` is reached, so no kernel data or control flow is modified.\nA:H - The dereference happens in softirq/interrupt context, producing \"Kernel panic - not syncing: Fatal exception in interrupt\" \u2014 a complete system crash rather than a recoverable oops, and it can be re-triggered on every reboot as long as traffic and bond reconfiguration continue."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:51.710Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970"
},
{
"url": "https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c"
},
{
"url": "https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf"
},
{
"url": "https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc"
},
{
"url": "https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d"
},
{
"url": "https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff"
},
{
"url": "https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7"
}
],
"title": "net, bpf: check master for NULL in xdp_master_redirect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64545",
"datePublished": "2026-07-27T20:10:36.659Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-05T12:42:51.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64546 (GCVE-0-2026-64546)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
drm/edid: fix OOB read in drm_parse_tiled_block()
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/edid: fix OOB read in drm_parse_tiled_block()
drm_parse_tiled_block() casts the DisplayID block to a
struct displayid_tiled_block and reads the full fixed layout up to
tile->topology_id[7] without checking block->num_bytes. The DisplayID
iterator only validates the declared payload length, so a crafted EDID
can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or
DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at
the end of a DisplayID extension. The read then runs past the end of the
exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.
Reject blocks shorter than the spec's 22-byte tiled payload before
reading the fixed struct, as drm_parse_vesa_mso_data() already does.
BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update
Read of size 2 at addr ffff888010077700 by task exploit/147
dump_stack_lvl (lib/dump_stack.c:94 ...)
print_report (mm/kasan/report.c:378 ...)
kasan_report (mm/kasan/report.c:595)
drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)
bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)
drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)
status_store (drivers/gpu/drm/drm_sysfs.c:219)
...
vfs_write (fs/read_write.c:595 fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
40d9b043a89e2301e1f97ade055a73ecc28e9afe , < c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0
(git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061 (git) Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 157727131ce8a52d8d9bc676c372ef82db6436c4 (git) Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d (git) Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 4f5484d25f85ad6c989bad5f6a43450cecfcfd28 (git) Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 9cc0f8e63e8c34cf43def35cbd305ba711181a1f (git) Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb (git) Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < faaa1e1155833e7d4ce7e3cfaf64c0d636b190db (git) |
|
| Linux | Linux |
Affected:
3.19
Unaffected: 0 , < 3.19 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_edid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "157727131ce8a52d8d9bc676c372ef82db6436c4",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "4f5484d25f85ad6c989bad5f6a43450cecfcfd28",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "9cc0f8e63e8c34cf43def35cbd305ba711181a1f",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "faaa1e1155833e7d4ce7e3cfaf64c0d636b190db",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_edid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile-\u003etopology_id[7] without checking block-\u003enum_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()\u0027d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec\u0027s 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n Read of size 2 at addr ffff888010077700 by task exploit/147\n dump_stack_lvl (lib/dump_stack.c:94 ...)\n print_report (mm/kasan/report.c:378 ...)\n kasan_report (mm/kasan/report.c:595)\n drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n status_store (drivers/gpu/drm/drm_sysfs.c:219)\n ...\n vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n ksys_write (fs/read_write.c:740)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The crafted EDID reaches the parser through a local device node \u2014 an unprivileged DRM client supplying a raw EDID buffer via the exynos vidi `DRM_AUTH` ioctl, or root via the connector\u0027s debugfs `edid_override` plus a sysfs re-probe. No network path exists, and local ioctl delivery is the lowest-friction vector (a physically attached malicious monitor/dock is an additional, equally automatic route).\nAC:L - The attacker fully controls the EDID bytes and only needs to place a tiled-display DisplayID block with a small `num_bytes` at the tail of the last extension block; `drm_edid_valid()` checks nothing but the header and checksums, which the attacker computes. No race and no memory-layout precondition is needed to trigger the read.\nPR:L - Handing an arbitrary EDID to `drm_edid_connector_update()` via `DRM_IOCTL_EXYNOS_VIDI_CONNECTION` requires only an authenticated DRM client (`DRM_AUTH`), i.e. an ordinary logged-in user with access to /dev/dri \u2014 no CAP_SYS_ADMIN and no root.\nUI:N - The attacker drives the connector probe itself through the ioctl, and on the hotplug path the EDID is read and parsed automatically by the kernel. No victim action is involved.\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the impact is confined to the kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Up to ~21 bytes of adjacent slab memory are read past the exact-size EDID allocation, and eight of those bytes are persisted into the connector\u0027s tile fields and handed back to userspace in the TILE property blob via `DRM_IOCTL_MODE_GETPROPBLOB`, giving a repeatable heap-content leak usable to defeat KASLR or recover neighbouring object data.\nI:N - The defect is purely a read; `drm_mode_create_tile_group()` copies the OOB source into a properly sized destination, so no out-of-bounds write or control-flow corruption occurs.\nA:H - The read runs past the end of the slab object and, for exact-fit allocations at a slab boundary, can touch unmapped memory; on KASAN or panic_on_warn kernels it is an immediate fatal report, and the resulting garbage tile geometry is propagated to the modesetting path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:52.793Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"
},
{
"url": "https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"
},
{
"url": "https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"
},
{
"url": "https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"
},
{
"url": "https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"
},
{
"url": "https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"
},
{
"url": "https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"
},
{
"url": "https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"
}
],
"title": "drm/edid: fix OOB read in drm_parse_tiled_block()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64546",
"datePublished": "2026-07-27T20:10:37.217Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-05T12:42:52.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64547 (GCVE-0-2026-64547)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:
BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...
Reject the frame when packet_len >= skb->len before reading.
Severity
8.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
904813cd8a0b334189da285bb05af0b18b062502 , < f42217fa7d535e9ec4151f7971f06f6ea65e850a
(git)
Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < c087749815379e9af2fdbeb08bfc33870b103958 (git) Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < e4a87126c085b097d29e17e3b7647295bba8be7c (git) Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < 685e92934f11d5e215dad58813e2f9955ac2f436 (git) Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < 4dc8484be3302d187274364820d3bef6c62bde32 (git) Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < b153cfe84b1340c69a13d0957665a2bfcf21239c (git) Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < ea866cab12db1a2100b400a8b03569e5bc0ee29a (git) Affected: 904813cd8a0b334189da285bb05af0b18b062502 , < 03f384bc0cb8d4a1301d4f5b0baef2d980258383 (git) |
|
| Linux | Linux |
Affected:
2.6.14
Unaffected: 0 , < 2.6.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/net1080.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f42217fa7d535e9ec4151f7971f06f6ea65e850a",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "c087749815379e9af2fdbeb08bfc33870b103958",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "e4a87126c085b097d29e17e3b7647295bba8be7c",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "685e92934f11d5e215dad58813e2f9955ac2f436",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "4dc8484be3302d187274364820d3bef6c62bde32",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "b153cfe84b1340c69a13d0957665a2bfcf21239c",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "ea866cab12db1a2100b400a8b03569e5bc0ee29a",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "03f384bc0cb8d4a1301d4f5b0baef2d980258383",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/net1080.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: net1080: validate packet_len before pad-byte access in rx_fixup\n\nFor an even packet_len, net1080_rx_fixup() reads the pad byte at\nskb-\u003edata[packet_len] before the skb-\u003elen != packet_len check further\ndown, and packet_len is only bounded against NC_MAX_PACKET. A malicious\nNetChip 1080 device can send a short frame advertising a large even\npacket_len (e.g. 0x4000), so the pad-byte read lands past the end of the\nskb:\n\n BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup\n Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14\n ...\n net1080_rx_fixup (drivers/net/usb/net1080.c:384)\n usbnet_bh (drivers/net/usb/usbnet.c:1589)\n process_one_work (kernel/workqueue.c:3322)\n bh_worker (kernel/workqueue.c:3708)\n tasklet_action (kernel/softirq.c:965)\n handle_softirqs (kernel/softirq.c:622)\n ...\n\nReject the frame when packet_len \u003e= skb-\u003elen before reading."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - net1080 implements a point-to-point Ethernet link over a USB host-to-host cable, so the malformed NC frame originates from the logically adjacent peer host/device on that link rather than from a local user; a compromised peer (or a gadget-mode board presenting 0525:1080, which autoloads the default-y driver) sends the frame over an already-established link with no physical interaction at attack time.\nAC:L - The attacker fully and deterministically controls packet_len and the frame length in every received frame, so the out-of-bounds read is triggered on demand with no race, no timing dependency, and no reliance on memory layout the attacker cannot influence.\nPR:N - The rx path runs in softirq/workqueue context on every received URB with no authentication, no capability check, and no local account on the target; USB/link-level peers are entirely untrusted and ungated.\nUI:N - The driver binds automatically via MODULE_DEVICE_TABLE and processes frames in usbnet_bh without any user action; on an already-connected host-to-host cable the victim does nothing at all.\nS:U - The out-of-bounds read stays within the kernel\u0027s own memory and security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The attacker controls the read offset across a ~32 KB range past a 1523-byte slab/page-frag object, and the comparison outcome is leaked back over the wire because only the matching path reaches nc_ensure_sync()\u0027s vendor control transfer, yielding a repeatable oracle for probing kernel heap contents rather than a bounded few-byte read.\nI:N - The path performs only a one-byte read; the subsequent skb-\u003elen != packet_len check still rejects the frame, and the skb_trim calls on the underflow paths are no-ops, so no kernel memory or network data is modified.\nA:H - The read reaches roughly 31 KB beyond the allocation, which can cross into a KFENCE guard page, an unmapped hole, or a page-frag boundary and oops in softirq context, and on KASAN/panic_on_warn hardened kernels it panics the machine outright \u2014 repeatable per frame."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:53.882Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a"
},
{
"url": "https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958"
},
{
"url": "https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c"
},
{
"url": "https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436"
},
{
"url": "https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32"
},
{
"url": "https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c"
},
{
"url": "https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a"
},
{
"url": "https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383"
}
],
"title": "net: usb: net1080: validate packet_len before pad-byte access in rx_fixup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64547",
"datePublished": "2026-07-27T20:10:37.786Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-05T12:42:53.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64548 (GCVE-0-2026-64548)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
When the scatterlist ring is full or nearly full, bpf_msg_push_data()
enters a copy fallback path and computes copy + len for the page
allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING
and both are u32, a crafted len can wrap the sum to a small value,
causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
Call Trace:
__asan_memcpy (mm/kasan/shadow.c:105)
bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)
bpf_prog_9ed8b5711920a7d7+0x2e/0x36
sk_psock_msg_verdict (net/core/skmsg.c:934)
tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)
__sys_sendto (net/socket.c:2206)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
Severity
8.4 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5
(git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < a12b1575f9feabd91695a9e9d004862f7195fa25 (git) Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d (git) Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 888706a76286c547bd035432602571e8024b5305 (git) Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < db77b6bb6e6edb79b10b4efcce346eec5582d588 (git) Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 4e40056bb5c829f0423f0a6694a0477726d2147e (git) Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < bd004716ba75fed6d185795c85cdc92540ebeaab (git) Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 0c0a8ed85349dae298712d79cb276acfeb794d82 (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "a12b1575f9feabd91695a9e9d004862f7195fa25",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "888706a76286c547bd035432602571e8024b5305",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "db77b6bb6e6edb79b10b4efcce346eec5582d588",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "4e40056bb5c829f0423f0a6694a0477726d2147e",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "bd004716ba75fed6d185795c85cdc92540ebeaab",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "0c0a8ed85349dae298712d79cb276acfeb794d82",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()\n\nWhen the scatterlist ring is full or nearly full, bpf_msg_push_data()\nenters a copy fallback path and computes copy + len for the page\nallocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING\nand both are u32, a crafted len can wrap the sum to a small value,\ncausing an undersized allocation followed by an out-of-bounds memcpy.\n\n BUG: unable to handle page fault for address: ffffed104089a402\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n Call Trace:\n __asan_memcpy (mm/kasan/shadow.c:105)\n bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)\n bpf_prog_9ed8b5711920a7d7+0x2e/0x36\n sk_psock_msg_verdict (net/core/skmsg.c:934)\n tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)\n __sys_sendto (net/socket.c:2206)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd an overflow check before the allocation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable helper only runs from the sk_msg egress verdict path, reached via a local `sendmsg()`/`sendto()` syscall on a sockmap- or kTLS-attached socket (`tcp_bpf_sendmsg` \u2192 `sk_psock_msg_verdict`, `tls_sw_sendmsg`), as shown in the reported call trace. There is no remote-peer input path into `bpf_msg_push_data()`.\nAC:L - Both trigger conditions are fully attacker-controlled and deterministic: the copy-fallback path is forced by sending \u2265 MAX_SKB_FRAGS*PAGE_SIZE bytes in one sendmsg to fill the SG ring, and the wrapping `len` is a constant chosen by the sk_msg program. No race, timing window, or uncontrolled memory state is involved.\nPR:N - The act that triggers the corruption \u2014 `sendmsg()` on a socket already in the sockmap \u2014 requires no privileges whatsoever, and the same helper\u0027s prior flaw (CVE-2026-63926) was scored PR:N on this basis. `ARG_ANYTHING` means the verifier enforces no bound, so a deployed L7-proxy sk_msg program that derives `len` from message content (e.g. a signed `want - have` underflowing to a huge u32) hands the wrapping value to the kernel without any attacker privilege; where program authorship is needed, CAP_BPF+CAP_NET_ADMIN is delegable to unprivileged container users via a bpffs BPF token.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own socket writes and BPF program; no victim action, mount, or file access is required.\nS:U - The undersized allocation and out-of-bounds write corrupt kernel memory within the same security authority as the vulnerable code. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The wild-offset write plus the corrupted `sg.size`/element-length/`data_end` state (huge `len` added to `sg.size` while `sg_set_page()` records the wrapped length) lets adjacent kernel memory be exposed to the BPF program and pushed out on the socket, and the write primitive is readily convertible into an arbitrary kernel read.\nI:H - `memcpy(raw + front + len, from, back)` writes up to a full SG element of attacker-supplied payload roughly 4 GiB past a single-page allocation, with the offset tunable over a ~4 MiB window and the source page groomable \u2014 an attacker-controlled write into the direct map, sufficient for control-flow hijack and privilege escalation.\nA:H - The reported reproducer is an unrecoverable oops (\"unable to handle page fault for address: ffffed104089a402\") when the wild pointer hits unmapped direct-map space, and the ~4 GiB `sk_mem_charge()`/`sg.size` accounting corruption further destabilises the socket and allocator."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:54.942Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5"
},
{
"url": "https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25"
},
{
"url": "https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d"
},
{
"url": "https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305"
},
{
"url": "https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588"
},
{
"url": "https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e"
},
{
"url": "https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab"
},
{
"url": "https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82"
}
],
"title": "bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64548",
"datePublished": "2026-07-27T20:10:38.355Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-05T12:42:54.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64549 (GCVE-0-2026-64549)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-07-27 20:10
VLAI
EPSS
VEX
Title
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
bpa10x_setup() sends the vendor command 0xfc0e and passes the response
to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at
skb->data + 1, without checking the length:
bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
hci_set_fw_info(hdev, "%s", skb->data + 1);
A device that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the data, and the %s walk reads adjacent
slab memory until it meets a NUL. The same happens when the payload is
not NUL-terminated within skb->len. The out-of-bounds bytes end up in
the kernel log and the firmware-info debugfs file.
Print the revision string with a bounded "%.*s" limited to skb->len - 1
instead. This keeps the string readable for well-behaved devices while
never reading past the received data, and does not fail setup, so a
device returning a short or unterminated response keeps working.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ddd68ec8f4847b460c9f580076eafe13b031a6fd , < 1813add71e386f77b3040e6c8dc9b7b3ff965a6c
(git)
Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < bd56c23f1f8681a2857ee924a8bd3abf87c8913b (git) Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < 7a64f39ebe1bacd9004a62eceadac0b122ec3cc2 (git) Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < f80b4afe893dffa9fabdbf80fb4d6782b24a6793 (git) Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < 4b4008dda1d0c6e598d7865631ad4eda63a560f0 (git) Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < bfc9e7be289df11e8e38c98cd78019d67fdd0bd5 (git) Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < a8e169d308775039200bb9c905c7ce420db6e8c5 (git) Affected: ddd68ec8f4847b460c9f580076eafe13b031a6fd , < dd068ef044128db655f48323a4acfd5907e04903 (git) |
|
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/bpa10x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1813add71e386f77b3040e6c8dc9b7b3ff965a6c",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "bd56c23f1f8681a2857ee924a8bd3abf87c8913b",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "7a64f39ebe1bacd9004a62eceadac0b122ec3cc2",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "f80b4afe893dffa9fabdbf80fb4d6782b24a6793",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "4b4008dda1d0c6e598d7865631ad4eda63a560f0",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "bfc9e7be289df11e8e38c98cd78019d67fdd0bd5",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "a8e169d308775039200bb9c905c7ce420db6e8c5",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "dd068ef044128db655f48323a4acfd5907e04903",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/bpa10x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\nbpa10x_setup() sends the vendor command 0xfc0e and passes the response\nto bt_dev_info() and hci_set_fw_info() as a \"%s\" string starting at\nskb-\u003edata + 1, without checking the length:\n\n\tbt_dev_info(hdev, \"%s\", (char *)(skb-\u003edata + 1));\n\thci_set_fw_info(hdev, \"%s\", skb-\u003edata + 1);\n\nA device that returns a one-byte response (status only) leaves\nskb-\u003edata + 1 past the end of the data, and the %s walk reads adjacent\nslab memory until it meets a NUL. The same happens when the payload is\nnot NUL-terminated within skb-\u003elen. The out-of-bounds bytes end up in\nthe kernel log and the firmware-info debugfs file.\n\nPrint the revision string with a bounded \"%.*s\" limited to skb-\u003elen - 1\ninstead. This keeps the string readable for well-behaved devices while\nnever reading past the received data, and does not fail setup, so a\ndevice returning a short or unterminated response keeps working."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T20:10:38.894Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c"
},
{
"url": "https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b"
},
{
"url": "https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2"
},
{
"url": "https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793"
},
{
"url": "https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0"
},
{
"url": "https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5"
},
{
"url": "https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5"
},
{
"url": "https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903"
}
],
"title": "Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64549",
"datePublished": "2026-07-27T20:10:38.894Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-07-27T20:10:38.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64550 (GCVE-0-2026-64550)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:
BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
netif_receive_skb (net/core/dev.c:6460)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2001)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.
Severity
7.3 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ceed73a2cf4aff2921802aa3d21d45280677547d , < ed25befc8c36f896b5878f9078faddb67fd7e2d0
(git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < a54d76d176e50d2fdbd39b7231efe256170339e4 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 00f4c366dbca16a40772c3b7ec2d8cba839e9724 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 3868c3244369ab709a90c9aad7534d406009b824 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 14eb0c9491385d5361a292ea4974aec0e6887299 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 1b12612c367e4be9b0814c0468e7e687835315b4 (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef (git) Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < f0f1887a9e30712a1df03e152dce6fb91344b1f3 (git) |
|
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed25befc8c36f896b5878f9078faddb67fd7e2d0",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "a54d76d176e50d2fdbd39b7231efe256170339e4",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "00f4c366dbca16a40772c3b7ec2d8cba839e9724",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "3868c3244369ab709a90c9aad7534d406009b824",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "14eb0c9491385d5361a292ea4974aec0e6887299",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "1b12612c367e4be9b0814c0468e7e687835315b4",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "231a8a4b76cb1b1827b3b19d7b3603642f5aaaef",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "f0f1887a9e30712a1df03e152dce6fb91344b1f3",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: validate MAP frame length before ingress parsing\n\nWhen ingress deaggregation is disabled, rmnet_map_ingress_handler() passes\nthe skb straight to __rmnet_map_ingress_handler(), skipping the length\nvalidation that rmnet_map_deaggregate() performs on the aggregated path.\nThe parser then dereferences the MAP header and csum header/trailer based on\nthe on-wire pkt_len without checking skb-\u003elen, so a short frame is read out\nof bounds:\n\n BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet\n Read of size 1 at addr ffff88801118ed00 by task exploit/147\n Call Trace:\n ...\n rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)\n __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)\n rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)\n __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)\n netif_receive_skb (net/core/dev.c:6460)\n tun_get_user (drivers/net/tun.c:1955)\n tun_chr_write_iter (drivers/net/tun.c:2001)\n vfs_write (fs/read_write.c:688)\n ksys_write (fs/read_write.c:740)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n ...\n\nFactor that validation out of rmnet_map_deaggregate() into\nrmnet_map_validate_packet_len() and run it on the no-aggregation path too.\nThe MAP header is bounds-checked first, since this path can receive a frame\nshorter than the header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached by `write()` to a tun fd owned by the attacker, exactly as in the reporter\u0027s KASAN trace (`tun_chr_write_iter` \u2192 `netif_receive_skb` \u2192 `rmnet_rx_handler`), requiring a local account. Although rmnet can be stacked on an Ethernet device (commit 74692caf1b0b), the universally available and demonstrated vector is local.\nAC:L - Every precondition is attacker-chosen \u2014 the `data_format` flags (deaggregation off, CKSUMV4 on) via `IFLA_RMNET_FLAGS`, the frame length, and the `pkt_len`/`pad` fields that select the OOB offset \u2014 with no race, timing, or uncontrolled memory-layout dependency. The trigger is a single deterministic `write()` that can be repeated indefinitely to sweep offsets.\nPR:L - Only an unprivileged local account is needed: `/dev/net/tun` is world-accessible, and both `TUNSETIFF` and `rtnl_newlink` gate on namespace-scoped `ns_capable`/`netlink_net_capable(CAP_NET_ADMIN)`, which `unshare -Urn` grants without real root.\nUI:N - The attacker creates the tun device, the rmnet link, and writes the malformed frame entirely on its own. No victim action or pre-existing configuration is required.\nS:U - The out-of-bounds access and its consequences are confined to kernel memory within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an attacker-positioned read up to 65535 bytes past a small slab object, and the result is disclosed back to userspace through the unprivileged rmnet ethtool counters \u2014 because the pseudo-header checksum is computed from the attacker\u0027s own IP header, the exact 16-bit heap word at a chosen offset is recoverable in a few probes, yielding a precise heap-read primitive for KASLR bypass and secret disclosure.\nI:L - There is no arbitrary write, but out-of-bounds data determines `skb-\u003eip_summed = CHECKSUM_UNNECESSARY`, causing packets whose checksums were never validated to be accepted by the IP stack as verified. On the MAP-command path `rmnet_map_send_ack()` also writes `cmd-\u003ecmd_type` past the end of a short frame after `skb_trim()` underflows into a no-op.\nA:H - A 64 KB overshoot from a small kmalloc object can land on an unmapped page (guard pages, DEBUG_PAGEALLOC/hardened allocators, memory-region edges), faulting in kernel context and producing an oops; on the real WWAN receive path (ipa/qmi_wwan/mhi_net NAPI) this executes in softirq, where the fault is a panic. KASAN builds abort immediately, as the reporter\u0027s trace shows."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:56.021Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0"
},
{
"url": "https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4"
},
{
"url": "https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724"
},
{
"url": "https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824"
},
{
"url": "https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299"
},
{
"url": "https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4"
},
{
"url": "https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef"
},
{
"url": "https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3"
}
],
"title": "net: qualcomm: rmnet: validate MAP frame length before ingress parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64550",
"datePublished": "2026-07-27T20:10:39.459Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:42:56.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64551 (GCVE-0-2026-64551)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
sctp: validate STALE_COOKIE cause length before reading staleness
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE_COOKIE cause length before reading staleness
When an ERROR chunk with a STALE_COOKIE cause is received in the
COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure
of Staleness that follows the cause header:
err = (struct sctp_errhdr *)(chunk->skb->data);
stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
err is the first cause in the chunk, not the STALE_COOKIE cause that
caused the dispatch, and nothing guarantees the staleness field is
present. sctp_walk_errors() only requires a cause to be as long as the
4-byte header, so for a STALE_COOKIE cause of length 4 the read runs
past the cause, and for a minimal ERROR chunk past skb->tail. The value
is echoed to the peer in the Cookie Preservative of the reply INIT,
leaking uninitialized memory.
sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so
check its length there and pass it to sctp_sf_do_5_2_6_stale(), which
reads that cause instead of the first one. A STALE_COOKIE cause too
short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into
COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket
in a user and network namespace.
Severity
9.1 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6022da37786701df1fc5dd946a6dcba59d5473b1
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 861f884f5471632c731cbbd612a1c072e391a624 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 588706ebaf8cdb4a4161602949eba365514b1db1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a257b41ddfe9e327b26581ad2777f04b23ac73f5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 08a8f2d13f703924316e9aeac863a88ef50990c7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ebe0a55d954fa8da383b6192edb8f763dcb002d5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1cd23ca80784223fa2204e16203f754da4e821f8 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6022da37786701df1fc5dd946a6dcba59d5473b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "861f884f5471632c731cbbd612a1c072e391a624",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "588706ebaf8cdb4a4161602949eba365514b1db1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a257b41ddfe9e327b26581ad2777f04b23ac73f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08a8f2d13f703924316e9aeac863a88ef50990c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ebe0a55d954fa8da383b6192edb8f763dcb002d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1cd23ca80784223fa2204e16203f754da4e821f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr = (struct sctp_errhdr *)(chunk-\u003eskb-\u003edata);\n\tstale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb-\u003etail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in the SCTP receive-side state machine and is driven entirely by an attacker-crafted ERROR chunk arriving over the network; no local access is needed. Per kernel guidance, net/ stack bugs reachable via received packets (SCTP explicitly) are Network.\nAC:L - The attacker fully controls the trigger: acting as the SCTP peer it answers INIT with INIT-ACK to place the association in COOKIE_ECHOED, then sends a minimal ERROR chunk with a 4-byte STALE_COOKIE cause as the last chunk in the packet. There is no race, no memory-layout dependency, and the vtag needed is the one the victim itself advertised in its INIT.\nPR:N - SCTP association setup is unauthenticated; the only check is sctp_vtag_verify() against a tag the peer already received in the victim\u0027s INIT. The attacker needs no credentials or privileges on the target system.\nUI:N - No human user action is required \u2014 SCTP client daemons (SIGTRAN, Diameter, cluster transports) establish and retry associations automatically, and an on-path attacker can inject the ERROR into an in-progress handshake. In the local variant an unprivileged process creates both sides itself with no user involved.\nS:U - The out-of-bounds read and the resulting disclosure stay within the kernel\u0027s own security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - Uninitialized kernel memory past skb-\u003etail is read and then transmitted straight back to the attacker inside the reply INIT\u0027s Cookie Preservative parameter, and the attack can be repeated indefinitely to sample recycled network-buffer memory that may contain remnants of other connections\u0027 traffic. This is a remote, unauthenticated, repeatable kernel heap disclosure oracle, matching the C:H treatment given to the sibling SCTP uninit-read CVE-2026-53225.\nI:N - The bug is a pure read; nothing in kernel memory or in the victim\u0027s association state is modified. The only affected value is a protocol field in a packet sent to the attacker itself.\nA:H - The read runs past the end of the received packet data, a memory-safety violation whose target is not proven to remain inside the skb\u0027s allocation across all receive paths (GSO/frag_list segments, UDP-encapsulated and linearized skbs), so it can fault and oops; kernel guidance and the CNA\u0027s scoring of the equivalent SCTP out-of-bounds-read bug both treat this class as A:H."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:57.104Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6022da37786701df1fc5dd946a6dcba59d5473b1"
},
{
"url": "https://git.kernel.org/stable/c/861f884f5471632c731cbbd612a1c072e391a624"
},
{
"url": "https://git.kernel.org/stable/c/588706ebaf8cdb4a4161602949eba365514b1db1"
},
{
"url": "https://git.kernel.org/stable/c/a257b41ddfe9e327b26581ad2777f04b23ac73f5"
},
{
"url": "https://git.kernel.org/stable/c/08a8f2d13f703924316e9aeac863a88ef50990c7"
},
{
"url": "https://git.kernel.org/stable/c/ebe0a55d954fa8da383b6192edb8f763dcb002d5"
},
{
"url": "https://git.kernel.org/stable/c/bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0"
},
{
"url": "https://git.kernel.org/stable/c/1cd23ca80784223fa2204e16203f754da4e821f8"
}
],
"title": "sctp: validate STALE_COOKIE cause length before reading staleness",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64551",
"datePublished": "2026-07-27T20:10:40.012Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:42:57.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…