Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0981
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à l'intégrité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.100-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-64287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64287"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64192"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64542"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64405"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53260"
},
{
"name": "CVE-2026-53365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53365"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-64508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64508"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64421"
},
{
"name": "CVE-2026-64341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64341"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-63970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63970"
},
{
"name": "CVE-2026-64559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64559"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64555"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64509"
},
{
"name": "CVE-2026-64307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64307"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-64227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64227"
},
{
"name": "CVE-2026-64481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64481"
},
{
"name": "CVE-2026-53005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53005"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64434"
},
{
"name": "CVE-2026-64558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64558"
},
{
"name": "CVE-2026-45944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45944"
},
{
"name": "CVE-2026-64286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64286"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64369"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64543"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-64493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64493"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64416"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64507"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0981",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-07-31",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00316",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00316.html"
}
]
}
CVE-2026-64552 (GCVE-0-2026-64552)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
virtio-net: fix len check in receive_big()
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big()
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
Severity
8.4 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
82f9028e83944a9eee5229cbc6fee9be1de8a62d , < f9451d0fd5ba635dcabb49bfe456a6db734a8986
(git)
Affected: 946dec89c41726b94d31147ec528b96af0be1b5a , < 38e94d63e29f4a5c6eae87ee2c02101aaa321502 (git) Affected: 82fe78065450d2d07f36a22e2b6b44955cf5ca5b , < fbeb65154583879d556ea94cb2f15888e9470f3d (git) Affected: 0c716703965ffc5ef4311b65cb5d84a703784717 , < c7fc9adf4e006155f7f2aeda052fbcde25cdcc49 (git) Affected: 0c716703965ffc5ef4311b65cb5d84a703784717 , < e6b8463b7d791f3886d7584259d6e9f06a69f12e (git) Affected: 0c716703965ffc5ef4311b65cb5d84a703784717 , < 9e5ad06ea826322ce8c58b4a68442a96f600c3c4 (git) Affected: 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2 (git) Affected: 6.1.159 , < 6.1.178 (semver) Affected: 6.6.117 , < 6.6.145 (semver) Affected: 6.12.58 , < 6.12.97 (semver) Affected: 6.17.8 , < 6.18 (semver) |
|
| Linux | Linux |
Affected:
6.18
Unaffected: 0 , < 6.18 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9451d0fd5ba635dcabb49bfe456a6db734a8986",
"status": "affected",
"version": "82f9028e83944a9eee5229cbc6fee9be1de8a62d",
"versionType": "git"
},
{
"lessThan": "38e94d63e29f4a5c6eae87ee2c02101aaa321502",
"status": "affected",
"version": "946dec89c41726b94d31147ec528b96af0be1b5a",
"versionType": "git"
},
{
"lessThan": "fbeb65154583879d556ea94cb2f15888e9470f3d",
"status": "affected",
"version": "82fe78065450d2d07f36a22e2b6b44955cf5ca5b",
"versionType": "git"
},
{
"lessThan": "c7fc9adf4e006155f7f2aeda052fbcde25cdcc49",
"status": "affected",
"version": "0c716703965ffc5ef4311b65cb5d84a703784717",
"versionType": "git"
},
{
"lessThan": "e6b8463b7d791f3886d7584259d6e9f06a69f12e",
"status": "affected",
"version": "0c716703965ffc5ef4311b65cb5d84a703784717",
"versionType": "git"
},
{
"lessThan": "9e5ad06ea826322ce8c58b4a68442a96f600c3c4",
"status": "affected",
"version": "0c716703965ffc5ef4311b65cb5d84a703784717",
"versionType": "git"
},
{
"status": "affected",
"version": "3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.117",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.58",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.159",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap. page_to_skb()\nthen walks one frag past the page chain, storing a NULL page-\u003eprivate\ninto skb_shinfo()-\u003efrags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malicious input is the buffer length announced by the virtio backend (hypervisor, vhost-user/VDUSE daemon, or virtio-net hardware device), not data from a network peer; a conforming backend can never announce a length in the vulnerable gap. This is the local device-to-driver attack surface, matching how other malicious-virtio-device bugs are scored.\nAC:L - The backend deterministically controls feature negotiation, MTU (hence big_packets_num_skbfrags), and the announced len, so it can force big-packets mode and hit the 20-byte gap on the first packet with no race or memory-layout luck.\nPR:N - The attacking backend requires no credentials or privileges inside the victim kernel \u2014 it is outside the guest\u0027s security authority and simply completes an RX descriptor. No guest-side account is needed.\nUI:N - Triggered automatically in the NAPI receive path as soon as the backend completes a receive buffer; no victim action is required.\nS:U - The corruption and crash are confined to the kernel that owns the virtio-net driver, with no crossing into a different security-managing authority such as an IOMMU or hypervisor boundary.\nC:H - A controlled 16-byte out-of-bounds write past skb_shared_info into an adjacent skb head in the NAPI page-frag cache lets the attacker corrupt neighbouring network buffer metadata, which is leverageable to disclose adjacent kernel memory; nr_frags is also left one past MAX_SKB_FRAGS so downstream code reads out-of-bounds frag state.\nI:H - This is an out-of-bounds write past the end of the static skb_shinfo()-\u003efrags[] array with attacker-influenced index and size, corrupting adjacent slab/page-frag memory \u2014 per guidance an OOB write is High and is potentially leverageable for control-flow hijack.\nA:H - After the OOB write, a NULL page is stored as a frag and immediately dereferenced via compound_head() in softirq context, producing a guaranteed kernel oops; the backend can repeat this at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:58.536Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"
},
{
"url": "https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502"
},
{
"url": "https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d"
},
{
"url": "https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49"
},
{
"url": "https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e"
},
{
"url": "https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4"
}
],
"title": "virtio-net: fix len check in receive_big()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64552",
"datePublished": "2026-07-27T20:10:40.570Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:42:58.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64553 (GCVE-0-2026-64553)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-07-27 20:10
VLAI
EPSS
VEX
Title
net: psample: fix info leak in PSAMPLE_ATTR_DATA
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: psample: fix info leak in PSAMPLE_ATTR_DATA
psample open codes nla_put() presumably to avoid wiping
the data with 0s just to override it with packet data.
This open coding is missing clearing the pad, however,
each netlink attr is padded to 4B and data_len may
not be divisible by 4B.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6ae0a6286171154661b74f7f550f9441c6008424 , < 0d3ea2ccddda442077fc44f11d873209c97ec50b
(git)
Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < 7fe7e6949964aa8ee6305f09db2dc9eede977bb3 (git) Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9 (git) Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2 (git) Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < 48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6 (git) Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < a6cfb924ad74efce254e99c197d2e3863de70868 (git) Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < 794a0d8bdbb39e083ed42caccb86d687a9b53570 (git) Affected: 6ae0a6286171154661b74f7f550f9441c6008424 , < aedd02af1f8b0bceb7f42f5a21c41634ca9ed390 (git) |
|
| Linux | Linux |
Affected:
4.11
Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/psample/psample.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d3ea2ccddda442077fc44f11d873209c97ec50b",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "7fe7e6949964aa8ee6305f09db2dc9eede977bb3",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "a6cfb924ad74efce254e99c197d2e3863de70868",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "794a0d8bdbb39e083ed42caccb86d687a9b53570",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "aedd02af1f8b0bceb7f42f5a21c41634ca9ed390",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/psample/psample.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psample: fix info leak in PSAMPLE_ATTR_DATA\n\npsample open codes nla_put() presumably to avoid wiping\nthe data with 0s just to override it with packet data.\nThis open coding is missing clearing the pad, however,\neach netlink attr is padded to 4B and data_len may\nnot be divisible by 4B."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T20:10:41.159Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d3ea2ccddda442077fc44f11d873209c97ec50b"
},
{
"url": "https://git.kernel.org/stable/c/7fe7e6949964aa8ee6305f09db2dc9eede977bb3"
},
{
"url": "https://git.kernel.org/stable/c/e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9"
},
{
"url": "https://git.kernel.org/stable/c/befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2"
},
{
"url": "https://git.kernel.org/stable/c/48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6"
},
{
"url": "https://git.kernel.org/stable/c/a6cfb924ad74efce254e99c197d2e3863de70868"
},
{
"url": "https://git.kernel.org/stable/c/794a0d8bdbb39e083ed42caccb86d687a9b53570"
},
{
"url": "https://git.kernel.org/stable/c/aedd02af1f8b0bceb7f42f5a21c41634ca9ed390"
}
],
"title": "net: psample: fix info leak in PSAMPLE_ATTR_DATA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64553",
"datePublished": "2026-07-27T20:10:41.159Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-07-27T20:10:41.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64554 (GCVE-0-2026-64554)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:42
VLAI
EPSS
VEX
Title
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb
skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a
use-after-free write.
Save prevhdr's offset before skb_checksum_help() and recompute it after,
like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
fragment").
BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)
Write of size 1 at addr ffff888013ff5016 by task exploit/141
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip6_frag_next (net/ipv6/ip6_output.c:857)
br_ip6_fragment (net/ipv6/netfilter.c:212)
nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)
nf_hook_slow (net/netfilter/core.c:619)
br_forward_finish (net/bridge/br_forward.c:66)
__br_forward (net/bridge/br_forward.c:115)
maybe_deliver (net/bridge/br_forward.c:191)
br_flood (net/bridge/br_forward.c:245)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:442)
...
packet_sendmsg (net/packet/af_packet.c:3114)
...
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
764dd163ac922f8683b5bcd3007251ce7b26cd33 , < 8c10778ec674b67a07ea042fcba64270f3f38a5a
(git)
Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < 2731efa6364e47934c96eb69e01ea131e8af8030 (git) Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < 00c06ef8c018493943891a7d0ca82b71b24f3180 (git) Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < c141f69d0a0fb16964dbc293650047e69bda8af7 (git) Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < f2e6596d10783557aeb9668da2a3b4d19deb2001 (git) Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < 1c4f67c89fd27c4df4c70b135c2c59627698b3c0 (git) Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < 4ac981a8b7ce7aec99a52d08f8a8953e8e120067 (git) Affected: 764dd163ac922f8683b5bcd3007251ce7b26cd33 , < 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c10778ec674b67a07ea042fcba64270f3f38a5a",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "2731efa6364e47934c96eb69e01ea131e8af8030",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "00c06ef8c018493943891a7d0ca82b71b24f3180",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "c141f69d0a0fb16964dbc293650047e69bda8af7",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "f2e6596d10783557aeb9668da2a3b4d19deb2001",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "1c4f67c89fd27c4df4c70b135c2c59627698b3c0",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "4ac981a8b7ce7aec99a52d08f8a8953e8e120067",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()\n\nbr_ip6_fragment() gets prevhdr, a pointer into the skb head, from\nip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb\nskb_checksum_help() reallocates the head via pskb_expand_head(), leaving\nprevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a\nuse-after-free write.\n\nSave prevhdr\u0027s offset before skb_checksum_help() and recompute it after,\nlike commit ef0efcd3bd3f (\"ipv6: Fix dangling pointer when ipv6\nfragment\").\n\n BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)\n Write of size 1 at addr ffff888013ff5016 by task exploit/141\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n ip6_frag_next (net/ipv6/ip6_output.c:857)\n br_ip6_fragment (net/ipv6/netfilter.c:212)\n nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)\n nf_hook_slow (net/netfilter/core.c:619)\n br_forward_finish (net/bridge/br_forward.c:66)\n __br_forward (net/bridge/br_forward.c:115)\n maybe_deliver (net/bridge/br_forward.c:191)\n br_flood (net/bridge/br_forward.c:245)\n br_handle_frame_finish (net/bridge/br_input.c:229)\n br_handle_frame (net/bridge/br_input.c:442)\n ...\n packet_sendmsg (net/packet/af_packet.c:3114)\n ...\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable code is the bridge forwarding/refragmentation path, driven entirely by frames received on a bridge port from an L2 peer \u2014 typically a guest VM over tap/virtio or a container over veth, which per skbuff.h are exactly the sources that deliver CHECKSUM_PARTIAL skbs on receive. This is logically adjacent topology (bridged segment/overlay), not a routed internet path, so AV:A rather than N.\nAC:L - The attacker controls every precondition: send IPv6 fragments (forces conntrack reassembly and sets frag_max_size), set VIRTIO_NET_HDR_F_NEEDS_CSUM for CHECKSUM_PARTIAL, and target a broadcast/multicast/unknown-unicast MAC so br_flood calls deliver_clone() and makes the skb cloned. No race and no attacker-independent condition is involved; the corruption is deterministic once the packet is crafted.\nPR:N - A guest VM or container attached to the host bridge holds no credentials on the vulnerable host and needs none \u2014 it merely emits frames onto the segment. In the equivalent local variant the entire setup (bridge, veth, nft bridge conntrack, AF_PACKET with CAP_NET_RAW) is reachable from an unprivileged user namespace, so no real privilege is required either way.\nUI:N - The corruption happens automatically in softirq context while the bridge forwards the attacker\u0027s packet. No action by any user or administrator on the target is needed.\nS:U - The vulnerable component and the impacted resource are both the host kernel\u0027s network stack; no hypervisor, IOMMU, or sandbox boundary is bypassed by the bug itself. Standard kernel memory corruption is scored Unchanged.\nC:H - This is a use-after-free/out-of-bounds write on the slab; the freed skb head and the write target can be groomed by the attacker, and such heap corruption is routinely leveraged into arbitrary kernel memory disclosure. Per kernel scoring guidance, UAF/OOB corruption is High confidentiality impact.\nI:H - ip6_frag_next() writes NEXTHDR_FRAGMENT (0x2c) at skb_network_header(frag) plus an uncontrolled inter-allocation delta, giving a repeatable 1-byte heap write at a heap-groomable offset \u2014 once per emitted fragment. A controlled byte write into adjacent slab objects is a classic primitive for corrupting kernel data structures and escalating to control-flow hijack.\nA:H - KASAN reports a slab-use-after-free write followed by \"Kernel panic - not syncing: Fatal exception in interrupt\" because the fault occurs in softirq forwarding context, taking down the whole host rather than one task. The attacker can repeat it at will with a stream of crafted fragments."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:59.622Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a"
},
{
"url": "https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030"
},
{
"url": "https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180"
},
{
"url": "https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7"
},
{
"url": "https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001"
},
{
"url": "https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0"
},
{
"url": "https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067"
},
{
"url": "https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d"
}
],
"title": "netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64554",
"datePublished": "2026-07-27T20:10:41.726Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:42:59.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64555 (GCVE-0-2026-64555)
Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-05 12:43
VLAI
EPSS
VEX
Title
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
kvm_hyp_handle_mops() resets the single-step state machine as part of
rewinding state for a MOPS exception by modifying vcpu_cpsr() and
writing the result directly into hardware.
In the case of nested virtualization, vcpu_cpsr() is a synthetic value
such that the rest of KVM can deal with vEL2 cleanly. That means the
value requires translation before being written into hardware, which is
unfortunately missing from the MOPS handler.
Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state
altogether, which will be resynchronized on the next 'full' exit back
to KVM.
Severity
8.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
2de451a329cf662beeba71f63c7f83ee24ca6642 , < 10a568010e827108d149779908850afaec898846
(git)
Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < 884b44256041ec6b2dcbe8e6a67384d26145cba1 (git) Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < dd3b237eb7780d65eae296d3d3a70012b6e7a02f (git) Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < ff1022c3de46753eb7eba2f6efd990569e66ff95 (git) |
|
| Linux | Linux |
Affected:
6.7
Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/include/hyp/switch.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10a568010e827108d149779908850afaec898846",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
},
{
"lessThan": "884b44256041ec6b2dcbe8e6a67384d26145cba1",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
},
{
"lessThan": "dd3b237eb7780d65eae296d3d3a70012b6e7a02f",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
},
{
"lessThan": "ff1022c3de46753eb7eba2f6efd990569e66ff95",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/include/hyp/switch.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc4",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()\n\nkvm_hyp_handle_mops() resets the single-step state machine as part of\nrewinding state for a MOPS exception by modifying vcpu_cpsr() and\nwriting the result directly into hardware.\n\nIn the case of nested virtualization, vcpu_cpsr() is a synthetic value\nsuch that the rest of KVM can deal with vEL2 cleanly. That means the\nvalue requires translation before being written into hardware, which is\nunfortunately missing from the MOPS handler.\n\nFix it by directly modifying SPSR_EL2 and avoiding the synthetic state\naltogether, which will be resynchronized on the next \u0027full\u0027 exit back\nto KVM."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker must be executing code inside a KVM/arm64 guest on the affected host \u2014 reached via /dev/kvm and guest instruction execution, not over any network protocol. This is local access to the host machine.\nAC:L - A guest hypervisor at vEL2 triggers the MOPS exception at will by executing a main/epilogue MOPS instruction with ill-formed alignment/size parameters; there is no race and no dependence on CPU migration or single-step state, so corruption of hardware SPSR_EL2 is fully deterministic.\nPR:L - Exploitation only needs the ability to create and run a nested-capable VM (/dev/kvm access, typically granted to unprivileged tenants/kvm-group users) and to run code inside that guest\u0027s own EL2 \u2014 no privilege on the host itself.\nUI:N - The guest triggers the faulty exception path entirely on its own during normal vCPU execution; no host user or administrator action is involved.\nS:C - The bogus ERET lands the guest\u0027s PC at real EL2 under the host\u0027s own EL2 translation regime and stack, with stage-2 no longer applied \u2014 the impact crosses the guest/host virtualization boundary into a different security authority.\nC:H - Execution at EL2 with the host\u0027s TTBR0_EL2/TTBR1_EL2 active and guest-controlled registers gives read access to the entire host kernel address space and to other guests\u0027 memory.\nI:H - The guest obtains a controlled control-flow transfer into host kernel text at EL2 with all GPRs under its control, which is an arbitrary code execution / arbitrary write primitive against the host hypervisor.\nA:H - Even without successful exploitation, ERETing to an unmapped or non-executable address at EL2 takes an unexpected EL2 exception that ends in a hyp panic, bringing down the host and every VM on it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:43:00.692Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10a568010e827108d149779908850afaec898846"
},
{
"url": "https://git.kernel.org/stable/c/884b44256041ec6b2dcbe8e6a67384d26145cba1"
},
{
"url": "https://git.kernel.org/stable/c/dd3b237eb7780d65eae296d3d3a70012b6e7a02f"
},
{
"url": "https://git.kernel.org/stable/c/ff1022c3de46753eb7eba2f6efd990569e66ff95"
}
],
"title": "KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64555",
"datePublished": "2026-07-27T20:10:42.259Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:43:00.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64557 (GCVE-0-2026-64557)
Vulnerability from cvelistv5 – Published: 2026-07-29 08:01 – Updated: 2026-08-05 12:43
VLAI
EPSS
VEX
Title
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after
release_sock(parent). Once the parent lock is dropped the newly
enqueued child socket sk is reachable via the accept queue, so another
task can accept and free it before the callback dereferences sk,
resulting in a use-after-free.
Rework the ->new_connection() op so the core, rather than the callback,
owns the child channel's lifetime. The op now receives a pre-allocated
new_chan and returns an errno instead of allocating and returning a
channel. l2cap_new_connection() allocates the child channel and links
it into the conn list via __l2cap_chan_add() before invoking the
callback, so the conn-list reference keeps the channel alive once
release_sock(parent) exposes the socket to other tasks.
Channel configuration that was duplicated in l2cap_sock_init() and the
various new_connection callbacks is consolidated into
l2cap_chan_set_defaults(), which now inherits from the parent channel
when one is supplied.
Severity
8.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8ffb929098a56939ac71509302eeab5b207bf262 , < b39298044e5534612511a2ff5de03ba5f6e7a820
(git)
Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 8c37e4338c801ebb8cee52436c01c41e009f6e87 (git) Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 84e718b6a814edc84159361f9f454a4e92ae91ae (git) Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 36da806f7fbaee56ad9e81859deec203f9728700 (git) Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 733e76e74e406c1d1ddc7369420dd8a47f48bb8a (git) Affected: 8ffb929098a56939ac71509302eeab5b207bf262 , < 6fef032af0092ed5ccb767239a9ac1bc38c08a40 (git) |
|
| Linux | Linux |
Affected:
3.13
Unaffected: 0 , < 3.13 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/6lowpan.c",
"net/bluetooth/l2cap_core.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b39298044e5534612511a2ff5de03ba5f6e7a820",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "84e718b6a814edc84159361f9f454a4e92ae91ae",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "36da806f7fbaee56ad9e81859deec203f9728700",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/6lowpan.c",
"net/bluetooth/l2cap_core.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)-\u003echan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the -\u003enew_connection() op so the core, rather than the callback,\nowns the child channel\u0027s lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable callback is reached only from L2CAP signalling handlers (`l2cap_connect`, `l2cap_le_connect_req`, `l2cap_ecred_conn_req`, `l2cap_connect_cfm`) processing connection requests received from a remote Bluetooth peer. Bluetooth radio range constitutes an adjacent network.\nAC:L - The attacker drives one side of the race by sending unlimited L2CAP connect requests and can induce the other side, since the local daemon accepts (immediately, for DEFER_SETUP listeners) and closes rejected/unauthorized children; on SMP the accepting task runs truly concurrently while the callback is still inside `release_sock()`, so the window is hit reliably with repeated attempts.\nPR:N - `l2cap_connect()` bypasses the link-mode and encryption-key-size checks entirely for PSM 0x0001 (SDP), where bluetoothd holds a listening L2CAP socket, so an unpaired and unauthenticated remote device can reach `l2cap_sock_new_connection_cb()`; LE CoC and low-security BR/EDR listeners are likewise reachable without credentials.\nUI:N - Incoming L2CAP connection requests are processed automatically by the kernel and accepted by the always-running Bluetooth daemon with no victim action, no pairing prompt, and no user confirmation.\nS:U - The corrupted `l2cap_chan`/`sock` objects and the resulting memory corruption are confined to the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free: the freed `l2cap_chan` slab object can be reallocated with attacker-groomed data and its fields are subsequently read back and transmitted to the attacker via the connect response and `l2cap_build_conf_req()`, and `__l2cap_chan_add()` deposits kernel list pointers into the reallocated object, giving a kernel-memory disclosure primitive.\nI:H - After the free, `l2cap_connect()`/`l2cap_le_connect_req()` write attacker-supplied PSM, SCID, MTU/MPS and BD_ADDR values plus list pointers into the freed object, and `__set_chan_timer()` arms delayed work whose function pointers live in that freed memory \u2014 a controlled write primitive suitable for heap spraying and control-flow hijack.\nA:H - Even without successful exploitation, the use-after-free reads and writes into freed slab memory and links a dead object into the conn list, reliably producing kernel oops/panic and corrupted list traversal on subsequent L2CAP operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:43:02.841Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"
},
{
"url": "https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"
},
{
"url": "https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"
},
{
"url": "https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"
},
{
"url": "https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"
},
{
"url": "https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"
}
],
"title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64557",
"datePublished": "2026-07-29T08:01:47.462Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:43:02.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64558 (GCVE-0-2026-64558)
Vulnerability from cvelistv5 – Published: 2026-07-29 16:31 – Updated: 2026-08-05 12:43
VLAI
EPSS
VEX
Title
s390/pkey: Check length in pkey_pckmo handler implementation
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in pkey_pckmo handler implementation
Explicitly check the length of the target buffer in the pkey_pckmo
implementation of the key_to_protkey() handler function. The handler
function fails, if the generated output data exceeds the length of the
provided target buffer.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 02028a24e26d85262ab9c8fc4344e1f3503007fc
(git)
Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 433e5e70cdc1edf382d28d08a885b22e2b98b7da (git) Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 614aa0491c7a190556c2345dddee0b6f5ed90989 (git) Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 1ac287e2af9a9112fe271427ef45eceb26bce8b4 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02028a24e26d85262ab9c8fc4344e1f3503007fc",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "433e5e70cdc1edf382d28d08a885b22e2b98b7da",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "614aa0491c7a190556c2345dddee0b6f5ed90989",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "1ac287e2af9a9112fe271427ef45eceb26bce8b4",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is entered through the PKEY_KBLOB2PROTK/PKEY_KBLOB2PROTK2 ioctls on the /dev/pkey character device, or via an AF_ALG setkey on the paes skciphers. Both require local system access; no network input reaches this code.\nAC:L - A single ioctl with a hand-crafted 176-byte protected-key token (type 0x00, version TOKVER_PROTECTED_KEY, keytype PKEY_KEYTYPE_HMAC_1024, len 160) deterministically triggers the 96-byte overflow; there is no race, no memory-layout dependency, and no hardware or wrapping-key prerequisite since the non-AES branch skips pckmo_verify_protkey().\nPR:L - /dev/pkey is registered as a miscdevice with .mode = 0666 and pkey_unlocked_ioctl() contains no capability or permission check, so any unprivileged local user can reach the bug; the paes/AF_ALG setkey path likewise requires no privileges.\nUI:N - The attacker triggers the overflow entirely on their own via a single ioctl or socket option call; no victim action, mount, or file open is involved.\nS:U - The corruption is confined to the kernel\u0027s own stack within the same security authority; exploitation yields kernel privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - The attacker gains a fully controlled 96-byte out-of-bounds stack write that can clobber adjacent locals, saved pointers and return addresses, which is readily leveraged into arbitrary kernel memory disclosure; the copy also leaves *protkeylen inflated to 160 while the buffer is 64 bytes, feeding an oversized length back to callers.\nI:H - This is an out-of-bounds write of 96 attacker-chosen bytes past the end of a kernel stack object (the last member of struct pkey_kblob2pkey), overwriting saved registers and the return address \u2014 a classic control-flow hijack / local privilege escalation primitive.\nA:H - Smashing the kernel stack past the canary reliably produces a stack-protector panic or an oops on return, and any unprivileged user can repeat it at will to crash the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:43:03.921Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"
},
{
"url": "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"
},
{
"url": "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"
},
{
"url": "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"
}
],
"title": "s390/pkey: Check length in pkey_pckmo handler implementation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64558",
"datePublished": "2026-07-29T16:31:21.591Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:43:03.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64559 (GCVE-0-2026-64559)
Vulnerability from cvelistv5 – Published: 2026-07-29 16:31 – Updated: 2026-08-05 12:43
VLAI
EPSS
VEX
Title
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
Explicitly check the buffer length request structure provided by
user-space and fail, if it exceeds the buffer size.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 0a9e34ccbe772b8f321388cdbdf4f22b94e513e7
(git)
Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 693bf91d4db134f9b1c2840c8e287eee3d993bac (git) Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < 7e7e03848c918aa0acad5ffd75d929e3afec1554 (git) Affected: 8fcc231ce3bea12b78bb94b280cdc03cff342435 , < b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970 (git) |
|
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a9e34ccbe772b8f321388cdbdf4f22b94e513e7",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "693bf91d4db134f9b1c2840c8e287eee3d993bac",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "7e7e03848c918aa0acad5ffd75d929e3afec1554",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in PKEY_VERIFYPROTK ioctl\n\nExplicitly check the buffer length request structure provided by\nuser-space and fail, if it exceeds the buffer size."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached only through the PKEY_VERIFYPROTK ioctl on the /dev/pkey character device, which requires local access to the system. There is no network-facing path to this code.\nAC:L - Triggering is fully deterministic \u2014 a single ioctl with protkey.len set to 0x20000010 wraps the u32 multiplication to a legal 128-bit keytype and drives the unchecked memcpy; no race, timing, or uncontrollable memory-layout condition is involved.\nPR:L - The pkey miscdevice is registered with .mode = 0666 and neither the open handler nor pkey_unlocked_ioctl performs any capability check, so any unprivileged local user (including a normal shell user on a shared IBM Z LPAR or z/VM guest) can issue the ioctl.\nUI:N - The attacker performs the entire attack via its own ioctl call; no action by any other user or administrator is needed.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked memcpy performs a huge out-of-bounds read that walks off the 64-byte on-stack protkey buffer through the entire kernel stack, relocating arbitrary kernel stack contents \u2014 including protected key material handled by this crypto driver \u2014 into heap objects, an unbounded kernel memory disclosure primitive.\nI:H - This is a massive slab out-of-bounds write into an 80-byte kmalloc-96 allocation whose first 64 bytes are entirely attacker-supplied and whose subsequent bytes come from groomable kernel-stack data, corrupting adjacent slab objects and providing a heap-overflow primitive suitable for control-flow hijacking.\nA:H - The smallest length that bypasses the keytype check requests a 512 MB copy, so the source pointer inevitably hits the VMAP_STACK guard page, producing an unhandled kernel fault/oops and panic after wide-scale heap corruption \u2014 a guaranteed, repeatable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:43:04.986Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a9e34ccbe772b8f321388cdbdf4f22b94e513e7"
},
{
"url": "https://git.kernel.org/stable/c/693bf91d4db134f9b1c2840c8e287eee3d993bac"
},
{
"url": "https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554"
},
{
"url": "https://git.kernel.org/stable/c/b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970"
}
],
"title": "s390/pkey: Check length in PKEY_VERIFYPROTK ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64559",
"datePublished": "2026-07-29T16:31:22.195Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:43:04.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64560 (GCVE-0-2026-64560)
Vulnerability from cvelistv5 – Published: 2026-07-29 16:47 – Updated: 2026-08-05 12:43
VLAI
EPSS
VEX
Title
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
Summary
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
Wongi and Jungwoo decoded and reported a non-leader exec() related race
which can result in an UAF:
sys_timer_delete() exec()
posix_cpu_timer_del()
// Observes old leader
p = pid_task(pid, pid_type); de_thread()
switch_leader();
release_task(old_leader)
__exit_signal(old_leader)
sighand = lock(old_leader, sighand);
posix_cpu_timers*_exit();
sighand = lock_task_sighand(p) unhash_task(old_leader);
sh = lock(p, sighand) old_leader->sighand = NULL;
unlock(sighand);
(p->sighand == NULL)
unlock(sh)
return NULL;
// Returns without action
if(!sighand)
return 0;
free_posix_timer();
This is "harmless" unless the deleted timer was armed and enqueued in
p->signal because on exec() a TGID targeted timer is inherited.
As sys_timer_delete() freed the underlying posix timer object
run_posix_cpu_timers() or any timerqueue related add/delete operations on
other timers will access the freed object's timerqueue node, which results
in an UAF.
There is a similar problem vs. posix_cpu_timer_set(). For regular posix
timers it just transiently returns -ESRCH to user space, but for the use
case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is
allocated on the stack.
Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops
to expire.
While debating solutions Frederic pointed out another problem:
posix_cpu_timer_del(tmr)
__exit_signal(p)
posix_cpu_timers*_exit(p);
unhash_task(p);
p->sighand = NULL;
sh = lock_task_sighand(p)
sighand = p->sighand;
if (!sighand)
return NULL;
lock(sighand);
if (!sh)
WARN_ON_ONCE(timer_queued(tmr));
On weakly ordered architectures it is not guaranteed that
posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()
when p->sighand is observed as NULL, which means the WARN() can be a false
positive.
Solve these issues by:
1) Changing the store in __exit_signal() to smp_store_release().
2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path
of lock_task_sighand().
3) Creating a helper function for looking up the task and locking sighand
which does not return when sighand == NULL. Instead it retries the
task lookup and only if that fails it gives up.
4) Using that helper in the three affected functions.
#1/#2 ensures that the reader side which observes sighand == NULL also
observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()
and the ones in unhash_task().
#3 ensures that the above described non-leader exec() situation is handled
gracefully. When the task lookup returns the old leader, but sighand ==
NULL then it retries. In the non-leader exec() case the subsequent task
lookup will observe the new leader due to #1/#2. In normal exit() scenarios
the subsequent lookup fails.
When the task lookup fails, the function also checks whether the timer is
still enqueued and issues a warning if that's the case. Unfortunately there
is nothing which can be done about it, but as the task is already not
longer visible the timer should not be accessed anymore. This check also
requires memory ordering, which is not provided when the first lookup
fails. To achieve that the check is preceeded by a smp_rmb() which pairs
with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that
the stores in posix_cpu_timers*_exit() are visible.
The history of the non-leader exec() issue goes back to the early days of
posix CPU timers, which stored a pointer to the group leader task in the
timer. That obviously fails when a non-leader exec() switches the leader.
commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems
with mt exec") added a temporary workaround for that in 2010 which surv
---truncated---
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < 67aa823e3e8c229c6d374df79c804f6721cb83b6
(git)
Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < d8bcb28abad857f1415da7656f19b2ada90af04f (git) Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa (git) Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < 12a891c773aeb5823d63dbd0cb2ab931d6c21c9b (git) Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < e74443f5db0037c556ef436fa64b88bf4ea08f83 (git) Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < 6a7ecc25abe6f0fecc6e62a05096987200edbd02 (git) Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < ad1cafa1bdaa71da85d71cac053838bbe97852b6 (git) Affected: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 , < 920f893f735e92ba3a1cd9256899a186b161928d (git) |
|
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.262 , ≤ 5.10.* (semver) Unaffected: 5.15.213 , ≤ 5.15.* (semver) Unaffected: 6.1.180 , ≤ 6.1.* (semver) Unaffected: 6.6.147 , ≤ 6.6.* (semver) Unaffected: 6.12.100 , ≤ 6.12.* (semver) Unaffected: 6.18.41 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/exit.c",
"kernel/signal.c",
"kernel/time/posix-cpu-timers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "67aa823e3e8c229c6d374df79c804f6721cb83b6",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "d8bcb28abad857f1415da7656f19b2ada90af04f",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "12a891c773aeb5823d63dbd0cb2ab931d6c21c9b",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "e74443f5db0037c556ef436fa64b88bf4ea08f83",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "6a7ecc25abe6f0fecc6e62a05096987200edbd02",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "ad1cafa1bdaa71da85d71cac053838bbe97852b6",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "920f893f735e92ba3a1cd9256899a186b161928d",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/exit.c",
"kernel/signal.c",
"kernel/time/posix-cpu-timers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.262",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.213",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.147",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.100",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.41",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.262",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.213",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.180",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.147",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.100",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.41",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n posix_cpu_timer_del()\n // Observes old leader\n p = pid_task(pid, pid_type);\t\tde_thread()\n \t\t\t\t\t switch_leader();\n\t\t\t\t\t release_task(old_leader)\n\t\t\t\t\t __exit_signal(old_leader)\n\t\t\t\t\t sighand = lock(old_leader, sighand);\n\t\t\t\t\t posix_cpu_timers*_exit();\n sighand = lock_task_sighand(p)\t unhash_task(old_leader);\n sh = lock(p, sighand)\t \t old_leader-\u003esighand = NULL;\n\t\t\t\t\t unlock(sighand);\n (p-\u003esighand == NULL)\n\tunlock(sh)\n\treturn NULL;\n\n // Returns without action\n if(!sighand)\n return 0;\n free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np-\u003esignal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object\u0027s timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it\u0027s the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t posix_cpu_timers*_exit(p);\n\t\t\t\t\t unhash_task(p);\n\t\t\t\t\t p-\u003esighand = NULL;\n sh = lock_task_sighand(p)\n sighand = p-\u003esighand;\n\tif (!sighand)\n\t return NULL;\n\tlock(sighand);\n\n if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p-\u003esighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n 1) Changing the store in __exit_signal() to smp_store_release().\n\n 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n of lock_task_sighand().\n\n 3) Creating a helper function for looking up the task and locking sighand\n which does not return when sighand == NULL. Instead it retries the\n task lookup and only if that fails it gives up.\n\n 4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand == NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand ==\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that\u0027s the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which surv\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker\u0027s own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race \u2014 one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` \u2014 and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step \u2014 timer creation, arming, deletion, and the concurrent non-leader exec \u2014 entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel\u0027s own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr-\u003efiring`, `ctmr-\u003ehandling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` \u2014 a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:43:06.059Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6"
},
{
"url": "https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f"
},
{
"url": "https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa"
},
{
"url": "https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b"
},
{
"url": "https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83"
},
{
"url": "https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02"
},
{
"url": "https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6"
},
{
"url": "https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d"
}
],
"title": "posix-cpu-timers: Prevent UAF caused by non-leader exec() race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64560",
"datePublished": "2026-07-29T16:47:17.602Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-05T12:43:06.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…