Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0982
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.262-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
},
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.180-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64376"
},
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-64275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64275"
},
{
"name": "CVE-2026-64274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64274"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64452"
},
{
"name": "CVE-2026-64483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64483"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-64409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64409"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-64489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64489"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64480"
},
{
"name": "CVE-2026-64399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64399"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-64454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64454"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2026-53400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
},
{
"name": "CVE-2026-64365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64365"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64514"
},
{
"name": "CVE-2026-64279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64279"
},
{
"name": "CVE-2026-64337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64337"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64430"
},
{
"name": "CVE-2026-64497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64497"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-64276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
},
{
"name": "CVE-2026-64475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64475"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64271"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64455"
},
{
"name": "CVE-2026-52942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52942"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-64445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64445"
},
{
"name": "CVE-2026-64500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64500"
},
{
"name": "CVE-2026-63806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
},
{
"name": "CVE-2026-64330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64330"
},
{
"name": "CVE-2026-64348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64348"
},
{
"name": "CVE-2026-64469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64469"
},
{
"name": "CVE-2026-64362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64362"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-64486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64486"
},
{
"name": "CVE-2026-64446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64446"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64338"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-64536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64536"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-64351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64351"
},
{
"name": "CVE-2026-23204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-64432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64432"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-53332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53332"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64296"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64370"
},
{
"name": "CVE-2026-43216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43216"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-64299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64299"
},
{
"name": "CVE-2026-64374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64374"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64345"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-64504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64504"
},
{
"name": "CVE-2026-64398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64398"
},
{
"name": "CVE-2026-64297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64297"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-64397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64397"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-64468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64468"
},
{
"name": "CVE-2026-64449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64449"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-63797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
},
{
"name": "CVE-2026-64456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64456"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64465"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-64442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64442"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64248"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64458"
},
{
"name": "CVE-2026-64476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64476"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-64318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64318"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-64394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64394"
},
{
"name": "CVE-2026-53177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-64435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64435"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64336"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64346"
},
{
"name": "CVE-2026-31610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31610"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-64342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64342"
},
{
"name": "CVE-2026-64360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64360"
},
{
"name": "CVE-2022-50114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50114"
},
{
"name": "CVE-2026-64478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64478"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64437"
},
{
"name": "CVE-2026-64335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64335"
},
{
"name": "CVE-2026-64301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64301"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-64395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64395"
},
{
"name": "CVE-2026-64273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64273"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2024-36013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36013"
},
{
"name": "CVE-2025-40196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40196"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-46135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46135"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-53393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
},
{
"name": "CVE-2026-64496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64496"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-64316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64316"
},
{
"name": "CVE-2026-64417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64417"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-64443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64443"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-64269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64269"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64482"
},
{
"name": "CVE-2026-64495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64495"
},
{
"name": "CVE-2026-64396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64396"
},
{
"name": "CVE-2026-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64324"
},
{
"name": "CVE-2026-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64329"
},
{
"name": "CVE-2026-64373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64373"
},
{
"name": "CVE-2026-64277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
},
{
"name": "CVE-2026-64503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64503"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-64403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64403"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-64487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64487"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-64429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64429"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-64350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64350"
},
{
"name": "CVE-2026-64250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64250"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-64448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64448"
},
{
"name": "CVE-2026-64347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64347"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2026-64393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64393"
},
{
"name": "CVE-2026-64419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64419"
},
{
"name": "CVE-2026-64372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64372"
},
{
"name": "CVE-2026-64444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64444"
},
{
"name": "CVE-2022-49803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49803"
},
{
"name": "CVE-2026-64331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64331"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64494"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64379"
},
{
"name": "CVE-2026-64420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64420"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
},
{
"name": "CVE-2026-64425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64425"
},
{
"name": "CVE-2026-64600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64600"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64505"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-64422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64422"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64484"
},
{
"name": "CVE-2026-64298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2023-52494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52494"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
},
{
"name": "CVE-2026-63829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
},
{
"name": "CVE-2026-64440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64440"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
},
{
"name": "CVE-2026-64359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64359"
},
{
"name": "CVE-2026-43219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43219"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0982",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00007",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00007.html"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00008",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00008.html"
}
]
}
CVE-2026-64306 (GCVE-0-2026-64306)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-07-25 08:49
VLAI
EPSS
VEX
Title
crypto: drbg - Fix returning success on failure in CTR_DRBG
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: drbg - Fix returning success on failure in CTR_DRBG
drbg_ctr_generate() sometimes returns success when it fails, leaving the
output buffer uninitialized. Fix it.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < 074db6db03a0aaa78f05ca9d4838053713796665
(git)
Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < 7b03312491f9fe6ba4d60c4023e7e61d2d1fed96 (git) Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < 75597e8774f319152744d24e0683d9393540a951 (git) Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < cc42fb40171c249bb859071d81b4eb007398a0bc (git) Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < bbbac12083eff489b35d848332f0dff311131344 (git) Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < 23b8b188cb32e5531d0f8d3af9506f8959cb369e (git) Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < a9e886f73dd717027028bb7e3bbca93601ecdfc7 (git) Affected: cde001e4c3c3625c60b68a83eb1f1c2572dee07a , < 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b (git) Affected: f60b0fa8bbddde66f1d197be07120264b555c84a (git) Affected: 3.12.44 , < 3.13 (semver) |
|
| Linux | Linux |
Affected:
4.1
Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/drbg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "074db6db03a0aaa78f05ca9d4838053713796665",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "7b03312491f9fe6ba4d60c4023e7e61d2d1fed96",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "75597e8774f319152744d24e0683d9393540a951",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "cc42fb40171c249bb859071d81b4eb007398a0bc",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "bbbac12083eff489b35d848332f0dff311131344",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "23b8b188cb32e5531d0f8d3af9506f8959cb369e",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "a9e886f73dd717027028bb7e3bbca93601ecdfc7",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"status": "affected",
"version": "f60b0fa8bbddde66f1d197be07120264b555c84a",
"versionType": "git"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.44",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/drbg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: drbg - Fix returning success on failure in CTR_DRBG\n\ndrbg_ctr_generate() sometimes returns success when it fails, leaving the\noutput buffer uninitialized. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:49:40.153Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665"
},
{
"url": "https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96"
},
{
"url": "https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951"
},
{
"url": "https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc"
},
{
"url": "https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344"
},
{
"url": "https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e"
},
{
"url": "https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7"
},
{
"url": "https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b"
}
],
"title": "crypto: drbg - Fix returning success on failure in CTR_DRBG",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64306",
"datePublished": "2026-07-25T08:49:40.153Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-07-25T08:49:40.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64312 (GCVE-0-2026-64312)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:40
VLAI
EPSS
VEX
Title
crypto: pcrypt - restore callback for non-parallel fallback
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - restore callback for non-parallel fallback
pcrypt installs pcrypt_aead_done() on the child AEAD request before
trying to submit it through padata. If padata_do_parallel() returns
-EBUSY, pcrypt falls back to calling the child AEAD directly.
That fallback must not keep the padata completion callback. Otherwise
an asynchronous completion runs pcrypt_aead_done() even though the
request was never enrolled in padata.
Restore the original request callback and callback data before calling
the child AEAD directly. This keeps the fallback path aligned with a
direct AEAD request while leaving the parallel path unchanged.
Severity
7.5 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
a92ccd3618e42333ac6f150ecdac14dca298bc7a , < 81ce16d938db9b88cdc231522c0358395ae8c6b5
(git)
Affected: 96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca , < 3920c5f6edc341729d20d0507e466c6d3b11f372 (git) Affected: 92834692a539b5b7f409e467a14667d64713b732 , < ae93c5b3e2a2968b56d772ca1d06615927b7cc36 (git) Affected: 5edae7a9a35606017ee6e05911c290acee9fee5a , < 82789a44415e3e31168229421b138278dfb16412 (git) Affected: 7ddab756f2de5b7b43c122ebebdf37f400fb2b6f , < 4711ca06bd169a2cbc9cc59a6de2ed512c41a880 (git) Affected: 662f2f13e66d3883b9238b0b96b17886179e60e2 , < c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf (git) Affected: 662f2f13e66d3883b9238b0b96b17886179e60e2 , < 83fa1397d5853de1e27dd52ec44b068ff358ca18 (git) Affected: 662f2f13e66d3883b9238b0b96b17886179e60e2 , < ed459fe319376e876de433d12b6c6772e612ca36 (git) Affected: dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6 (git) Affected: fca8aed12218f96b38e374ff264d78ea1fbd23cc (git) Affected: a8e0074ffb38c9a5964a221bb998034d016c93a2 (git) Affected: 5.10.231 , < 5.10.261 (semver) Affected: 5.15.174 , < 5.15.212 (semver) Affected: 6.1.120 , < 6.1.178 (semver) Affected: 6.6.64 , < 6.6.145 (semver) Affected: 6.12.2 , < 6.12.96 (semver) Affected: 4.19.325 , < 4.20 (semver) Affected: 5.4.287 , < 5.5 (semver) Affected: 6.11.11 , < 6.12 (semver) |
|
| Linux | Linux |
Affected:
6.13
Unaffected: 0 , < 6.13 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81ce16d938db9b88cdc231522c0358395ae8c6b5",
"status": "affected",
"version": "a92ccd3618e42333ac6f150ecdac14dca298bc7a",
"versionType": "git"
},
{
"lessThan": "3920c5f6edc341729d20d0507e466c6d3b11f372",
"status": "affected",
"version": "96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca",
"versionType": "git"
},
{
"lessThan": "ae93c5b3e2a2968b56d772ca1d06615927b7cc36",
"status": "affected",
"version": "92834692a539b5b7f409e467a14667d64713b732",
"versionType": "git"
},
{
"lessThan": "82789a44415e3e31168229421b138278dfb16412",
"status": "affected",
"version": "5edae7a9a35606017ee6e05911c290acee9fee5a",
"versionType": "git"
},
{
"lessThan": "4711ca06bd169a2cbc9cc59a6de2ed512c41a880",
"status": "affected",
"version": "7ddab756f2de5b7b43c122ebebdf37f400fb2b6f",
"versionType": "git"
},
{
"lessThan": "c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf",
"status": "affected",
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"versionType": "git"
},
{
"lessThan": "83fa1397d5853de1e27dd52ec44b068ff358ca18",
"status": "affected",
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"versionType": "git"
},
{
"lessThan": "ed459fe319376e876de433d12b6c6772e612ca36",
"status": "affected",
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"versionType": "git"
},
{
"status": "affected",
"version": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6",
"versionType": "git"
},
{
"status": "affected",
"version": "fca8aed12218f96b38e374ff264d78ea1fbd23cc",
"versionType": "git"
},
{
"status": "affected",
"version": "a8e0074ffb38c9a5964a221bb998034d016c93a2",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.231",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.287",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata. If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback. Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly. This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata-\u003epd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata-\u003epd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:40:51.303Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5"
},
{
"url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372"
},
{
"url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36"
},
{
"url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412"
},
{
"url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880"
},
{
"url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf"
},
{
"url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18"
},
{
"url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36"
}
],
"title": "crypto: pcrypt - restore callback for non-parallel fallback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64312",
"datePublished": "2026-07-25T08:49:43.940Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-05T12:40:51.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64313 (GCVE-0-2026-64313)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:40
VLAI
EPSS
VEX
Title
crypto: ecc - Fix carry overflow in vli multiplication
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ecc - Fix carry overflow in vli multiplication
The carry flag calculation fails when r01.m_high is saturated
(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.
The condition (r01.m_high < product.m_high) doesn't handle the case
where r01.m_high == product.m_high and an additional carry exists
from lower-bit overflow.
When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
introduced crypto/ecc.c, it split the muladd() function in the
micro-ecc library into separate mul_64_64() and add_128_128() helpers.
It seems the check got lost in translation.
Add proper handling for this boundary by accounting for the carry
from the lower addition.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < d11b2bb99bec1f5557c01cac42231e23745f49b8
(git)
Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < b709e0e768766abe29a49e1c1922a1604be602f4 (git) Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < 24a54dfa06d09813b4802a374fad3d2c0e16a884 (git) Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < 677450e5ef850c4d28b7956aa01104548c2a894e (git) Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < 5275e0fca256d081e2e7d4ba3dd8216c6e50d44e (git) Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < 774ddddf5eb26eeca177350413e3e2bc50930ee9 (git) Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < ebaae7c4251cc0cdb2602f334d4f08a3e82d271e (git) Affected: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 , < 27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406 (git) |
|
| Linux | Linux |
Affected:
4.8
Unaffected: 0 , < 4.8 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/ecc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d11b2bb99bec1f5557c01cac42231e23745f49b8",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "b709e0e768766abe29a49e1c1922a1604be602f4",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "24a54dfa06d09813b4802a374fad3d2c0e16a884",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "677450e5ef850c4d28b7956aa01104548c2a894e",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "5275e0fca256d081e2e7d4ba3dd8216c6e50d44e",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "774ddddf5eb26eeca177350413e3e2bc50930ee9",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "ebaae7c4251cc0cdb2602f334d4f08a3e82d271e",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/ecc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ecc - Fix carry overflow in vli multiplication\n\nThe carry flag calculation fails when r01.m_high is saturated\n(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.\n\nThe condition (r01.m_high \u003c product.m_high) doesn\u0027t handle the case\nwhere r01.m_high == product.m_high and an additional carry exists\nfrom lower-bit overflow.\n\nWhen commit 3c4b23901a0c (\"crypto: ecdh - Add ECDH software support\")\nintroduced crypto/ecc.c, it split the muladd() function in the\nmicro-ecc library into separate mul_64_64() and add_128_128() helpers.\nIt seems the check got lost in translation.\n\nAdd proper handling for this boundary by accounting for the carry\nfrom the lower addition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The concrete unauthenticated external path is Bluetooth LE Secure Connections, where a nearby peer\u0027s SMP Public Key message reaches the flawed ECC multiplication. Bluetooth requires proximity rather than routable network access.\nAC:L - The attacker controls the ECC operands and can repeatedly submit deliberately constructed values that trigger the carry error. No race, unpredictable memory layout, or victim-controlled state is required.\nPR:N - SMP permits a peer to negotiate Secure Connections and submit its public key before credential validation, DHKey confirmation, or bonding completes. No local account or capability is required.\nUI:N - The peer\u0027s public key is validated and the ECDH secret is computed before authentication-method completion. Headless and Just Works deployments require no human action.\nS:U - The vulnerable arithmetic and affected cryptographic consumers operate within the same kernel security authority. The vulnerability does not inherently cross a VM, IOMMU, or comparable security boundary.\nC:H - Incorrect field multiplication can undermine public-key validation and ECDH shared-secret computation. Faulty-curve or key-agreement attacks could expose secrets and all data protected by derived session keys.\nI:H - The same faulty multiplication supports ECDSA and ECRDSA verification, making false cryptographic results and signature or peer-authentication bypass defensible. This can authorize attacker-controlled content, code, or commands.\nA:H - Authentication bypass can authorize attacker-controlled code or commands capable of halting the system, while repeated crafted exchanges can prevent secure pairing. Safety-critical or headless devices dependent on the affected trust path can lose their protected function completely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:40:52.519Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d11b2bb99bec1f5557c01cac42231e23745f49b8"
},
{
"url": "https://git.kernel.org/stable/c/b709e0e768766abe29a49e1c1922a1604be602f4"
},
{
"url": "https://git.kernel.org/stable/c/24a54dfa06d09813b4802a374fad3d2c0e16a884"
},
{
"url": "https://git.kernel.org/stable/c/677450e5ef850c4d28b7956aa01104548c2a894e"
},
{
"url": "https://git.kernel.org/stable/c/5275e0fca256d081e2e7d4ba3dd8216c6e50d44e"
},
{
"url": "https://git.kernel.org/stable/c/774ddddf5eb26eeca177350413e3e2bc50930ee9"
},
{
"url": "https://git.kernel.org/stable/c/ebaae7c4251cc0cdb2602f334d4f08a3e82d271e"
},
{
"url": "https://git.kernel.org/stable/c/27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406"
}
],
"title": "crypto: ecc - Fix carry overflow in vli multiplication",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64313",
"datePublished": "2026-07-25T08:49:44.546Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-05T12:40:52.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64315 (GCVE-0-2026-64315)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:40
VLAI
EPSS
VEX
Title
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG
is enabled.
Severity
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
8d818c1055013d355d36188f21c7535687374f6c , < 1ec775f6a124cce6278ae58b7d1c78a3bc6eef23
(git)
Affected: 8d818c1055013d355d36188f21c7535687374f6c , < bcf3cf74dfb6981e18b22cbf561f859a0f7faa26 (git) Affected: 8d818c1055013d355d36188f21c7535687374f6c , < 6407dc85d0a4306681cf6c9be7f05e05dcb67a37 (git) Affected: 8d818c1055013d355d36188f21c7535687374f6c , < c8cfe11e48b2a4646fa662fcaa92e14810a28d46 (git) Affected: 8d818c1055013d355d36188f21c7535687374f6c , < 8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7 (git) Affected: 8d818c1055013d355d36188f21c7535687374f6c , < d0b8cafd529b4ec759190c6081f7a76efb563a8f (git) Affected: 8d818c1055013d355d36188f21c7535687374f6c , < 59057f5d4e9a195c6dd61695ad3bc4481ddf4f14 (git) Affected: 8d818c1055013d355d36188f21c7535687374f6c , < 8005dc808bcce7d6cc2ae015a3cde1683bee602d (git) |
|
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg_qi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1ec775f6a124cce6278ae58b7d1c78a3bc6eef23",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "bcf3cf74dfb6981e18b22cbf561f859a0f7faa26",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "6407dc85d0a4306681cf6c9be7f05e05dcb67a37",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "c8cfe11e48b2a4646fa662fcaa92e14810a28d46",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "d0b8cafd529b4ec759190c6081f7a76efb563a8f",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "59057f5d4e9a195c6dd61695ad3bc4481ddf4f14",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "8005dc808bcce7d6cc2ae015a3cde1683bee602d",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg_qi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - use print_hex_dump_devel to guard key hex dumps\n\nUse print_hex_dump_devel() for dumping sensitive key material in\n*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG\nis enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The exposed keys are obtained through local kernel-log interfaces such as /dev/kmsg or syslog; network consumers can cause key installation, but the secret is not returned remotely.\nAC:H - The DPAA2 CAAM implementation must be selected and its normally disabled dynamic-debug callsite must have been enabled by boot configuration or an administrator, a condition an unprivileged attacker cannot create.\nPR:L - On systems with dmesg_restrict disabled, an ordinary local user can read the global kernel log and can invoke the affected callbacks through AF_ALG without capabilities.\nUI:N - No victim action is required after the vulnerable logging configuration is active; services and protocol stacks install keys during normal operation.\nS:U - The disclosure and resulting compromise of kernel-protected cryptographic sessions remain within the host kernel\u0027s security authority.\nC:H - The dumps contain complete encryption and authentication keys, including RFC4106/RFC4543 salt material, enabling decryption of protected IPsec, SMB, or other traffic.\nI:H - Disclosed AEAD or authentication keys permit valid ciphertexts and authentication tags to be forged, enabling unauthorized modification of protected communications.\nA:H - An AF_ALG caller can trigger the unratelimited dumps continuously, potentially stalling systems using slow debug consoles, while stolen authentication keys can also sustain disruption of protected IPsec or SMB sessions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:40:53.595Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ec775f6a124cce6278ae58b7d1c78a3bc6eef23"
},
{
"url": "https://git.kernel.org/stable/c/bcf3cf74dfb6981e18b22cbf561f859a0f7faa26"
},
{
"url": "https://git.kernel.org/stable/c/6407dc85d0a4306681cf6c9be7f05e05dcb67a37"
},
{
"url": "https://git.kernel.org/stable/c/c8cfe11e48b2a4646fa662fcaa92e14810a28d46"
},
{
"url": "https://git.kernel.org/stable/c/8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7"
},
{
"url": "https://git.kernel.org/stable/c/d0b8cafd529b4ec759190c6081f7a76efb563a8f"
},
{
"url": "https://git.kernel.org/stable/c/59057f5d4e9a195c6dd61695ad3bc4481ddf4f14"
},
{
"url": "https://git.kernel.org/stable/c/8005dc808bcce7d6cc2ae015a3cde1683bee602d"
}
],
"title": "crypto: caam - use print_hex_dump_devel to guard key hex dumps",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64315",
"datePublished": "2026-07-25T08:49:45.787Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-05T12:40:53.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64316 (GCVE-0-2026-64316)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-07-25 08:49
VLAI
EPSS
VEX
Title
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() and gen_split_key() to avoid leaking secrets at runtime when
CONFIG_DYNAMIC_DEBUG is enabled.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6e005503199b9bf1b385949c05897fd6567b5af4 , < 45c0e3615e5bca5f1fc93357af8d19975c092d4f
(git)
Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < 8b56ba10105ca34a4b75f7e33d41d96a63815591 (git) Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < 9a53dc0a0ae0486e164e5af3de5f99ab42c5a23e (git) Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < ebd37eef6e4f435e18829c0c0c9ba3a6618cb2dd (git) Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < cea7302d5d05df74cfb4107897b1ca34163c06b9 (git) Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < 6f7b8e0321f3a8fbbd267d2ac15c671ab59e919e (git) Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < 8cf5fb0503129e53052fe29302379cf83891d0fb (git) Affected: 6e005503199b9bf1b385949c05897fd6567b5af4 , < 3f57657b6ea23f933371f2c2846322f441773cee (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg.c",
"drivers/crypto/caam/caamalg_qi.c",
"drivers/crypto/caam/caamhash.c",
"drivers/crypto/caam/key_gen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "45c0e3615e5bca5f1fc93357af8d19975c092d4f",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "8b56ba10105ca34a4b75f7e33d41d96a63815591",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "9a53dc0a0ae0486e164e5af3de5f99ab42c5a23e",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "ebd37eef6e4f435e18829c0c0c9ba3a6618cb2dd",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "cea7302d5d05df74cfb4107897b1ca34163c06b9",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "6f7b8e0321f3a8fbbd267d2ac15c671ab59e919e",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "8cf5fb0503129e53052fe29302379cf83891d0fb",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
},
{
"lessThan": "3f57657b6ea23f933371f2c2846322f441773cee",
"status": "affected",
"version": "6e005503199b9bf1b385949c05897fd6567b5af4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg.c",
"drivers/crypto/caam/caamalg_qi.c",
"drivers/crypto/caam/caamhash.c",
"drivers/crypto/caam/key_gen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - use print_hex_dump_devel to guard key hex dumps\n\nUse print_hex_dump_devel() for dumping sensitive key material in\n*_setkey() and gen_split_key() to avoid leaking secrets at runtime when\nCONFIG_DYNAMIC_DEBUG is enabled."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T08:49:46.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/45c0e3615e5bca5f1fc93357af8d19975c092d4f"
},
{
"url": "https://git.kernel.org/stable/c/8b56ba10105ca34a4b75f7e33d41d96a63815591"
},
{
"url": "https://git.kernel.org/stable/c/9a53dc0a0ae0486e164e5af3de5f99ab42c5a23e"
},
{
"url": "https://git.kernel.org/stable/c/ebd37eef6e4f435e18829c0c0c9ba3a6618cb2dd"
},
{
"url": "https://git.kernel.org/stable/c/cea7302d5d05df74cfb4107897b1ca34163c06b9"
},
{
"url": "https://git.kernel.org/stable/c/6f7b8e0321f3a8fbbd267d2ac15c671ab59e919e"
},
{
"url": "https://git.kernel.org/stable/c/8cf5fb0503129e53052fe29302379cf83891d0fb"
},
{
"url": "https://git.kernel.org/stable/c/3f57657b6ea23f933371f2c2846322f441773cee"
}
],
"title": "crypto: caam - use print_hex_dump_devel to guard key hex dumps",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64316",
"datePublished": "2026-07-25T08:49:46.415Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-07-25T08:49:46.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64317 (GCVE-0-2026-64317)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:40
VLAI
EPSS
VEX
Title
isofs: bound Rock Ridge symlink components to the SL record
Summary
In the Linux kernel, the following vulnerability has been resolved:
isofs: bound Rock Ridge symlink components to the SL record
get_symlink_chunk() and the SL handling in
parse_rock_ridge_inode_internal() walk the variable-length components of
a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte
header (flags, len) followed by len bytes of text, so it occupies
slp->len + 2 bytes. Both loops read slp->len and advance to the next
component, and get_symlink_chunk() additionally does
memcpy(rpnt, slp->text, slp->len), but neither checks that the component
lies within the SL record before dereferencing it.
A crafted SL record whose component declares a len that runs past the
record (rr->len) therefore triggers an out-of-bounds read of up to 255
bytes. When the record sits at the tail of its backing buffer - for
example a small kmalloc()ed continuation block reached through a CE
record - the read crosses the allocation; get_symlink_chunk() then
copies the out-of-bounds bytes into the symlink body returned to user
space by readlink(), disclosing adjacent kernel memory.
ISO 9660 images are routinely mounted from untrusted removable media -
desktop environments auto-mount them (e.g. via udisks2) without
CAP_SYS_ADMIN - so the record contents are attacker-controlled.
Reject any component that does not fit in the remaining record bytes
before using it. In get_symlink_chunk() return NULL, like the existing
output-buffer (plimit) checks, so a malformed record makes readlink()
fail with -EIO rather than silently returning a truncated target; in
parse_rock_ridge_inode_internal() stop the inode-size walk.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1015e1c4b2fadd9c09704e24738e46598778c869
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a22cb6bb54dc167047ea9e70d97dfbc2c15649e3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b736b12108fd116c41777628f5a333791604df26 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6bf41db09ef935d76fcc84ccf213b42c18de95ee (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b5699642640d6cff357638738c5293985cd5a53d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9830725078c8483c6831ec10222ae724806ea36b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5fa1d6a5ec2356d2107dead614437c66fa7138b1 (git) |
|
| Linux | Linux |
Affected:
2.6.12
Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/isofs/rock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1015e1c4b2fadd9c09704e24738e46598778c869",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a22cb6bb54dc167047ea9e70d97dfbc2c15649e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b736b12108fd116c41777628f5a333791604df26",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6bf41db09ef935d76fcc84ccf213b42c18de95ee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b5699642640d6cff357638738c5293985cd5a53d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9830725078c8483c6831ec10222ae724806ea36b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5fa1d6a5ec2356d2107dead614437c66fa7138b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/isofs/rock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: bound Rock Ridge symlink components to the SL record\n\nget_symlink_chunk() and the SL handling in\nparse_rock_ridge_inode_internal() walk the variable-length components of\na Rock Ridge \"SL\" (symbolic link) record. Each component is a two-byte\nheader (flags, len) followed by len bytes of text, so it occupies\nslp-\u003elen + 2 bytes. Both loops read slp-\u003elen and advance to the next\ncomponent, and get_symlink_chunk() additionally does\nmemcpy(rpnt, slp-\u003etext, slp-\u003elen), but neither checks that the component\nlies within the SL record before dereferencing it.\n\nA crafted SL record whose component declares a len that runs past the\nrecord (rr-\u003elen) therefore triggers an out-of-bounds read of up to 255\nbytes. When the record sits at the tail of its backing buffer - for\nexample a small kmalloc()ed continuation block reached through a CE\nrecord - the read crosses the allocation; get_symlink_chunk() then\ncopies the out-of-bounds bytes into the symlink body returned to user\nspace by readlink(), disclosing adjacent kernel memory.\n\nISO 9660 images are routinely mounted from untrusted removable media -\ndesktop environments auto-mount them (e.g. via udisks2) without\nCAP_SYS_ADMIN - so the record contents are attacker-controlled.\n\nReject any component that does not fit in the remaining record bytes\nbefore using it. In get_symlink_chunk() return NULL, like the existing\noutput-buffer (plimit) checks, so a malformed record makes readlink()\nfail with -EIO rather than silently returning a truncated target; in\nparse_rock_ridge_inode_internal() stop the inode-size walk."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An active unprivileged local user can use UDisks2 to mount an attacker-created ISO image and invoke readlink(); ISOFS is not directly mountable through an unprivileged user namespace.\nAC:L - The attacker fully controls the SL component length and CE continuation layout, reliably triggering the out-of-bounds read without a race or an uncontrollable condition.\nPR:L - Direct mounting requires CAP_SYS_ADMIN in the initial user namespace, but common UDisks2 policies permit an active ordinary desktop user to create a loop device and mount the image without administrator authentication.\nUI:N - The local attacker can mount the crafted image and read the symlink themselves, requiring no action by another user.\nS:U - The disclosure and possible crash occur within the host kernel\u0027s existing security authority and do not cross a virtualization or comparable scope boundary.\nC:H - Up to 255 bytes per malformed SL component are copied from beyond a controllably sized kernel allocation into readlink() output; repeated components or attempts can disclose kernel pointers, secrets, and substantial adjacent heap data.\nI:N - The flaw performs an out-of-bounds source read while all destination writes remain bounded to the symlink page, providing no kernel-memory overwrite or control-flow modification primitive.\nA:H - The out-of-bounds memcpy can cross into inaccessible or allocator-guarded memory and cause a kernel oops or panic, and a local attacker can trigger repeated allocations and reads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:40:54.676Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869"
},
{
"url": "https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee"
},
{
"url": "https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3"
},
{
"url": "https://git.kernel.org/stable/c/b736b12108fd116c41777628f5a333791604df26"
},
{
"url": "https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee"
},
{
"url": "https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d"
},
{
"url": "https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b"
},
{
"url": "https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1"
}
],
"title": "isofs: bound Rock Ridge symlink components to the SL record",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64317",
"datePublished": "2026-07-25T08:49:47.067Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-05T12:40:54.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64318 (GCVE-0-2026-64318)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:40
VLAI
EPSS
VEX
Title
partitions: aix: bound the pp_count scan to the ppe array
Summary
In the Linux kernel, the following vulnerability has been resolved:
partitions: aix: bound the pp_count scan to the ppe array
aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count. pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 09861651617ba0fec089e8b9477439e68398c110
(git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 5eacdb1967378f5e5591cd27a2d8cdee2df1a599 (git) Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < b5e9c09309e18fd9839ad007c238120353ca0cc4 (git) Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < fd94a779020f2ecc8b2607f4c20b34acb1763b9a (git) Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 4671bb74bba05fdd4acf670a35758c29e8c97b83 (git) Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < ce93228e2193a17d2c58b656e439bb39fe5c3af8 (git) Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e (git) Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 2dc0bfd2fe355fb930de63c2f2eb8ced8570c579 (git) |
|
| Linux | Linux |
Affected:
3.11
Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/partitions/aix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09861651617ba0fec089e8b9477439e68398c110",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "5eacdb1967378f5e5591cd27a2d8cdee2df1a599",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "b5e9c09309e18fd9839ad007c238120353ca0cc4",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "fd94a779020f2ecc8b2607f4c20b34acb1763b9a",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "4671bb74bba05fdd4acf670a35758c29e8c97b83",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "ce93228e2193a17d2c58b656e439bb39fe5c3af8",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
},
{
"lessThan": "2dc0bfd2fe355fb930de63c2f2eb8ced8570c579",
"status": "affected",
"version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/partitions/aix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npartitions: aix: bound the pp_count scan to the ppe array\n\naix_partition() reads the physical volume descriptor into a fixed-size\nstruct pvd and then scans its physical-partition-extent array:\n\n\tint numpps = be16_to_cpu(pvd-\u003epp_count);\n\t...\n\tfor (i = 0; i \u003c numpps; i += 1) {\n\t\tstruct ppe *p = pvd-\u003eppe + i;\n\t\t...\n\t\tlp_ix = be16_to_cpu(p-\u003elp_ix);\n\npvd points at a single kmalloc()\u0027d struct pvd whose ppe[] member holds a\nfixed ARRAY_SIZE(pvd-\u003eppe) (1016) entries, but the loop runs up to the\non-disk pp_count. pp_count is an unvalidated __be16 read straight from\nthe descriptor, so a crafted AIX image with pp_count larger than 1016\ndrives the loop to read pvd-\u003eppe[i] past the end of the allocation (up\nto 65535 entries, ~2 MB out of bounds).\n\nThe partition scan runs without mounting anything, when a block device\nwith a crafted AIX/IBM partition table appears (an attacker-supplied\nimage attached with losetup -P, or a device auto-scanned by udev), via\nmsdos_partition() -\u003e aix_partition().\n\nClamp the scan to the number of entries the ppe[] array can hold."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker with local code execution can supply a crafted image through an unprivileged UDisks loop-setup operation with partition scanning enabled. No network protocol directly invokes this parser.\nAC:L - On an affected build, attacker-controlled on-disk fields deterministically reach the oversized scan without a race or memory-layout requirement for triggering the out-of-bounds access.\nPR:L - A basic active desktop user can request loop setup through UDisks under its default policy, while the kernel loop configuration path itself has no capability check. Initial-namespace root is not required in this deployment.\nUI:N - The attacker can initiate loop setup and partition scanning directly, without requiring another user to mount or open the image.\nS:U - The vulnerable partition parser and the affected kernel memory belong to the same operating-system security authority, with no demonstrated VM, IOMMU, or sandbox boundary crossing.\nC:H - The attacker-controlled count can cause 16-bit reads across nearly 2 MiB beyond the approximately 32 KiB allocation, sampling unrelated kernel memory. This is substantially more than a small bounded disclosure.\nI:N - The faulty accesses are reads; the derived logical-volume index is range-checked, and subsequent writes remain within the allocated lvip and partition-state arrays. No out-of-bounds write or control-flow write primitive is present.\nA:H - The slab out-of-bounds access is KASAN-confirmed and can produce an oops or panic on hardened kernels or when the traversal reaches inaccessible memory. An attacker can repeat partition scans to sustain denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:40:55.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110"
},
{
"url": "https://git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599"
},
{
"url": "https://git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4"
},
{
"url": "https://git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a"
},
{
"url": "https://git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83"
},
{
"url": "https://git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8"
},
{
"url": "https://git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e"
},
{
"url": "https://git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579"
}
],
"title": "partitions: aix: bound the pp_count scan to the ppe array",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64318",
"datePublished": "2026-07-25T08:49:47.690Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-05T12:40:55.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64322 (GCVE-0-2026-64322)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:40
VLAI
EPSS
VEX
Title
udf: validate sparing table length as an entry count, not a byte count
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: validate sparing table length as an entry count, not a byte count
udf_load_sparable_map() accepts a sparing table when
sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize
is false, i.e. it treats reallocationTableLen as a number of BYTES that
must fit in the block. But the table is walked as an array of 8-byte
sparingEntry elements:
for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {
struct sparingEntry *entry = &st->mapEntry[i];
... entry->origLocation ...
}
in udf_get_pblock_spar15() and udf_relocate_blocks(). A
reallocationTableLen of N therefore passes the check whenever
sizeof(*st) + N <= blocksize, yet the consumers index
sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the
block. On a crafted UDF image this is an out-of-bounds read in
udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the
same length to udf_update_tag(), whose crc_itu_t() reads far past the
block, and its memmove() through st->mapEntry[] is an out-of-bounds
write.
Validate reallocationTableLen as the entry count it is, with
struct_size().
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e
(git)
Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9 (git) Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 2d726135099313958f8975532a2e15322ff150ce (git) Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 7285276aa50d2839afb5957ffd491ad282dc8f72 (git) Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 2a219acb2ce674d99bbd1b7b35ed8c384dac7200 (git) Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 04f4599a9efb90992d072a814960edf0cd62805d (git) Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 7f7774b9da0ef17b87bfa238cf966ad0b3376150 (git) Affected: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 , < 3ec997bd5508e9b25210b5bbec89031629cdb093 (git) Affected: e240873cb4a9fd18de60a817100a96fe670d4359 (git) Affected: 9ae30e324a96d0328a575329d7a95a09b3318601 (git) Affected: b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa (git) Affected: a9f1af04f086656246f30354fb4564ce3b08c4a0 (git) Affected: 4836ee563d65bb492f907cbe267a5761b9693e4d (git) Affected: 2.6.32.60 , < 2.6.33 (semver) Affected: 2.6.34.14 , < 2.6.35 (semver) Affected: 3.0.37 , < 3.1 (semver) Affected: 3.2.23 , < 3.3 (semver) Affected: 3.4.5 , < 3.5 (semver) |
|
| Linux | Linux |
Affected:
3.5
Unaffected: 0 , < 3.5 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "2d726135099313958f8975532a2e15322ff150ce",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "7285276aa50d2839afb5957ffd491ad282dc8f72",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "2a219acb2ce674d99bbd1b7b35ed8c384dac7200",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "04f4599a9efb90992d072a814960edf0cd62805d",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "7f7774b9da0ef17b87bfa238cf966ad0b3376150",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "3ec997bd5508e9b25210b5bbec89031629cdb093",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"status": "affected",
"version": "e240873cb4a9fd18de60a817100a96fe670d4359",
"versionType": "git"
},
{
"status": "affected",
"version": "9ae30e324a96d0328a575329d7a95a09b3318601",
"versionType": "git"
},
{
"status": "affected",
"version": "b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa",
"versionType": "git"
},
{
"status": "affected",
"version": "a9f1af04f086656246f30354fb4564ce3b08c4a0",
"versionType": "git"
},
{
"status": "affected",
"version": "4836ee563d65bb492f907cbe267a5761b9693e4d",
"versionType": "git"
},
{
"lessThan": "2.6.33",
"status": "affected",
"version": "2.6.32.60",
"versionType": "semver"
},
{
"lessThan": "2.6.35",
"status": "affected",
"version": "2.6.34.14",
"versionType": "semver"
},
{
"lessThan": "3.1",
"status": "affected",
"version": "3.0.37",
"versionType": "semver"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.23",
"versionType": "semver"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.32.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.34.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate sparing table length as an entry count, not a byte count\n\nudf_load_sparable_map() accepts a sparing table when\n\n\tsizeof(*st) + le16_to_cpu(st-\u003ereallocationTableLen) \u003e sb-\u003es_blocksize\n\nis false, i.e. it treats reallocationTableLen as a number of BYTES that\nmust fit in the block. But the table is walked as an array of 8-byte\nsparingEntry elements:\n\n\tfor (i = 0; i \u003c le16_to_cpu(st-\u003ereallocationTableLen); i++) {\n\t\tstruct sparingEntry *entry = \u0026st-\u003emapEntry[i];\n\t\t... entry-\u003eorigLocation ...\n\t}\n\nin udf_get_pblock_spar15() and udf_relocate_blocks(). A\nreallocationTableLen of N therefore passes the check whenever\nsizeof(*st) + N \u003c= blocksize, yet the consumers index\nsizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the\nblock. On a crafted UDF image this is an out-of-bounds read in\nudf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the\nsame length to udf_update_tag(), whose crc_itu_t() reads far past the\nblock, and its memmove() through st-\u003emapEntry[] is an out-of-bounds\nwrite.\n\nValidate reallocationTableLen as the entry count it is, with\nstruct_size()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A crafted UDF image must be presented and mounted as local loop or removable block media; no network-facing path reaches this parser.\nAC:L - The attacker deterministically controls the entry count, table contents, block size, and accessed packet, with no race or condition outside attacker control.\nPR:L - Direct mounting requires initial-namespace CAP_SYS_ADMIN and user namespaces do not help, but common UDisks/polkit configurations let an active unprivileged local user mount attacker-controlled loop or removable media through a privileged broker.\nUI:N - The local attacker can request the brokered mount and trigger block translation themselves, requiring no action by a separate victim.\nS:U - Exploitation compromises the host kernel within its existing security authority and does not inherently cross a VM, IOMMU, or other scope boundary.\nC:H - The malformed count permits reads up to roughly eight times beyond the block, and relocation can expose adjacent kernel data through copied entries or returned mapping values.\nI:H - udf_relocate_blocks performs an out-of-bounds origLocation store and attacker-sized memmove through mapEntry[], potentially corrupting adjacent kernel pages and enabling control-flow hijacking.\nA:H - The extensive out-of-bounds reads and writes can reliably cause a kernel oops, panic, or fatal memory corruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:40:59.025Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e"
},
{
"url": "https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9"
},
{
"url": "https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce"
},
{
"url": "https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72"
},
{
"url": "https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200"
},
{
"url": "https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d"
},
{
"url": "https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150"
},
{
"url": "https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093"
}
],
"title": "udf: validate sparing table length as an entry count, not a byte count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64322",
"datePublished": "2026-07-25T08:49:50.180Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-08-05T12:40:59.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64323 (GCVE-0-2026-64323)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
udf: validate VAT header length against the VAT inode size
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size
udf_load_vat() takes the virtual partition's start offset straight from
the on-disk VAT 2.0 header without checking it against the VAT inode
size:
map->s_type_specific.s_virtual.s_start_offset =
le16_to_cpu(vat20->lengthHeader);
map->s_type_specific.s_virtual.s_num_entries =
(sbi->s_vat_inode->i_size -
map->s_type_specific.s_virtual.s_start_offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds
the VAT inode size, the s_num_entries subtraction underflows to a huge
count, which defeats the "block > s_num_entries" bound in
udf_get_pblock_virt15(); and on the ICB-inline path that function reads
((__le32 *)(iinfo->i_data + s_start_offset))[block]
so a large s_start_offset indexes past the inode's in-ICB data. Mounting
a crafted UDF image with a virtual (VAT) partition then triggers an
out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one
entry within the VAT inode.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fa5e08156335d0687c85b4e724db9448fb166601 , < 0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934
(git)
Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 883962731420ec271ed8c1cd76524f4b17faa982 (git) Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63 (git) Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb (git) Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 55287a3555ff0515b3aff181d2c08c0462a41709 (git) Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad (git) Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < 74580fdf022909e184223cacc364feb826982d96 (git) Affected: fa5e08156335d0687c85b4e724db9448fb166601 , < d8202786b3d75125c84ebc4de6d946f92fde0ee8 (git) |
|
| Linux | Linux |
Affected:
2.6.26
Unaffected: 0 , < 2.6.26 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "883962731420ec271ed8c1cd76524f4b17faa982",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "55287a3555ff0515b3aff181d2c08c0462a41709",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "74580fdf022909e184223cacc364feb826982d96",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "d8202786b3d75125c84ebc4de6d946f92fde0ee8",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate VAT header length against the VAT inode size\n\nudf_load_vat() takes the virtual partition\u0027s start offset straight from\nthe on-disk VAT 2.0 header without checking it against the VAT inode\nsize:\n\n\tmap-\u003es_type_specific.s_virtual.s_start_offset =\n\t\tle16_to_cpu(vat20-\u003elengthHeader);\n\tmap-\u003es_type_specific.s_virtual.s_num_entries =\n\t\t(sbi-\u003es_vat_inode-\u003ei_size -\n\t\t\tmap-\u003es_type_specific.s_virtual.s_start_offset) \u003e\u003e 2;\n\nlengthHeader is a fully attacker-controlled 16-bit value. If it exceeds\nthe VAT inode size, the s_num_entries subtraction underflows to a huge\ncount, which defeats the \"block \u003e s_num_entries\" bound in\nudf_get_pblock_virt15(); and on the ICB-inline path that function reads\n\n\t((__le32 *)(iinfo-\u003ei_data + s_start_offset))[block]\n\nso a large s_start_offset indexes past the inode\u0027s in-ICB data. Mounting\na crafted UDF image with a virtual (VAT) partition then triggers an\nout-of-bounds read.\n\nReject a VAT whose header length does not leave room for at least one\nentry within the VAT inode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable parser is reached by mounting a crafted local UDF image or removable volume; no network-facing protocol reaches it.\nAC:L - The VAT type, inline allocation, header length, and virtual block index are attacker-controlled on disk, with no race or uncontrollable condition required.\nPR:L - Although direct mounting requires init-namespace CAP_SYS_ADMIN, common UDisks/polkit deployments let an active unprivileged local user create a loop device and request the mount.\nUI:N - In the low-privilege UDisks scenario, the attacker can initiate the mount and trigger VAT resolution without another user\u0027s action.\nS:U - The vulnerable UDF parser and affected kernel resources remain within the host kernel\u0027s security authority.\nC:H - The underflow permits repeatable 32-bit reads at attacker-selected offsets potentially many gigabytes beyond the VAT buffer, enabling disclosure of kernel memory.\nI:N - The primitive only reads a mapping value, and virtual UDF partitions are forcibly read-only; no kernel-memory write primitive results.\nA:H - A sufficiently large attacker-selected index can fault in kernel context and cause an oops or panic, enabling repeatable system-wide denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:00.093Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934"
},
{
"url": "https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982"
},
{
"url": "https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63"
},
{
"url": "https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb"
},
{
"url": "https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709"
},
{
"url": "https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad"
},
{
"url": "https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96"
},
{
"url": "https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8"
}
],
"title": "udf: validate VAT header length against the VAT inode size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64323",
"datePublished": "2026-07-25T08:49:51.097Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-08-05T12:41:00.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64324 (GCVE-0-2026-64324)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
udf: validate free block extents against the partition length
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: validate free block extents against the partition length
udf_free_blocks() checks the logical block number and count against the
partition length, but drops the extent offset from that final bound. A
crafted extent can pass the guard while logicalBlockNum + offset + count
points past the partition, which later indexes past the space bitmap
array.
A single ftruncate(2) on a file backed by such an extent reliably
panics the kernel. This is a local availability issue. On desktop
systems where UDisks/polkit allows the active user to mount removable
UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply
the crafted filesystem and trigger the panic by truncating a writable
file on it. Systems that require root or CAP_SYS_ADMIN to mount the
image have a higher prerequisite.
No confidentiality or integrity impact is claimed: the reproduced
primitive is an out-of-bounds read of a bitmap pointer slot followed by
a kernel panic.
Use the already computed logicalBlockNum + offset + count value for the
partition length check. Also make load_block_bitmap() reject an
out-of-range block group before indexing s_block_bitmap[], so corrupted
callers cannot walk past the flexible array.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
934f815345c09c290a9b9a9cfdddc203ec2117e8 , < fdd6229d2ae9914c1f25d1041db0f4f312a4fa76
(git)
Affected: 22cc7323f090646c8cfb5939e6f15bdc2ed3fd27 , < b54aee5652fcd7c23a0904a4623ec462c3edc70c (git) Affected: 7c4fa9ebfce69619d132fe703dc2e2cf62a13723 , < 12af328d2ee8d68e81ba612246d0b54b22d23e1f (git) Affected: 5cc9745e2ea11aef7d5c9a42bc36f6cd3e1b4cc3 , < fb49099206c5c57af28a157249fa7bcb5518f99e (git) Affected: 56e69e59751d20993f243fb7dd6991c4e522424c , < 9442d75429b0c556292a7454fe888d54259f5240 (git) Affected: 56e69e59751d20993f243fb7dd6991c4e522424c , < 335202ab25b01fdd45889ff25eab70864686dea3 (git) Affected: 56e69e59751d20993f243fb7dd6991c4e522424c , < be87de7789a82a030a4896bc7683415ec9fa6f2b (git) Affected: 56e69e59751d20993f243fb7dd6991c4e522424c , < 5f0419457f89dce1a3f1c8e62a3adf2f39ab8168 (git) Affected: 097420e48e30f51e8f4f650b5c946f5af63ec1a3 (git) Affected: 5def895b42ef16a2da6402818cba8d7ec8ede1ef (git) Affected: 05fb2bf477d3fe5421bd4cb699574737f52bd88b (git) Affected: 5.10.224 , < 5.10.261 (semver) Affected: 5.15.165 , < 5.15.212 (semver) Affected: 6.1.105 , < 6.1.178 (semver) Affected: 6.6.46 , < 6.6.145 (semver) Affected: 4.19.320 , < 4.20 (semver) Affected: 5.4.282 , < 5.5 (semver) Affected: 6.10.5 , < 6.11 (semver) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/udf/balloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fdd6229d2ae9914c1f25d1041db0f4f312a4fa76",
"status": "affected",
"version": "934f815345c09c290a9b9a9cfdddc203ec2117e8",
"versionType": "git"
},
{
"lessThan": "b54aee5652fcd7c23a0904a4623ec462c3edc70c",
"status": "affected",
"version": "22cc7323f090646c8cfb5939e6f15bdc2ed3fd27",
"versionType": "git"
},
{
"lessThan": "12af328d2ee8d68e81ba612246d0b54b22d23e1f",
"status": "affected",
"version": "7c4fa9ebfce69619d132fe703dc2e2cf62a13723",
"versionType": "git"
},
{
"lessThan": "fb49099206c5c57af28a157249fa7bcb5518f99e",
"status": "affected",
"version": "5cc9745e2ea11aef7d5c9a42bc36f6cd3e1b4cc3",
"versionType": "git"
},
{
"lessThan": "9442d75429b0c556292a7454fe888d54259f5240",
"status": "affected",
"version": "56e69e59751d20993f243fb7dd6991c4e522424c",
"versionType": "git"
},
{
"lessThan": "335202ab25b01fdd45889ff25eab70864686dea3",
"status": "affected",
"version": "56e69e59751d20993f243fb7dd6991c4e522424c",
"versionType": "git"
},
{
"lessThan": "be87de7789a82a030a4896bc7683415ec9fa6f2b",
"status": "affected",
"version": "56e69e59751d20993f243fb7dd6991c4e522424c",
"versionType": "git"
},
{
"lessThan": "5f0419457f89dce1a3f1c8e62a3adf2f39ab8168",
"status": "affected",
"version": "56e69e59751d20993f243fb7dd6991c4e522424c",
"versionType": "git"
},
{
"status": "affected",
"version": "097420e48e30f51e8f4f650b5c946f5af63ec1a3",
"versionType": "git"
},
{
"status": "affected",
"version": "5def895b42ef16a2da6402818cba8d7ec8ede1ef",
"versionType": "git"
},
{
"status": "affected",
"version": "05fb2bf477d3fe5421bd4cb699574737f52bd88b",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.224",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.165",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.105",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.46",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.320",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.282",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/udf/balloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.320",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.282",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate free block extents against the partition length\n\nudf_free_blocks() checks the logical block number and count against the\npartition length, but drops the extent offset from that final bound. A\ncrafted extent can pass the guard while logicalBlockNum + offset + count\npoints past the partition, which later indexes past the space bitmap\narray.\n\nA single ftruncate(2) on a file backed by such an extent reliably\npanics the kernel. This is a local availability issue. On desktop\nsystems where UDisks/polkit allows the active user to mount removable\nUDF media without CAP_SYS_ADMIN, an unprivileged local user can supply\nthe crafted filesystem and trigger the panic by truncating a writable\nfile on it. Systems that require root or CAP_SYS_ADMIN to mount the\nimage have a higher prerequisite.\n\nNo confidentiality or integrity impact is claimed: the reproduced\nprimitive is an out-of-bounds read of a bitmap pointer slot followed by\na kernel panic.\n\nUse the already computed logicalBlockNum + offset + count value for the\npartition length check. Also make load_block_bitmap() reject an\nout-of-range block group before indexing s_block_bitmap[], so corrupted\ncallers cannot walk past the flexible array."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached through a local ftruncate(2) on a crafted, mounted UDF filesystem; no network protocol reaches this path.\nAC:L - The attacker controls the malicious extent and truncation offset, and a single ftruncate(2) reliably triggers the fault without a race or uncontrollable condition.\nPR:L - UDF cannot be mounted through an unprivileged user namespace, but default [UDisks policy](https://storaged.org/doc/udisks2-api/latest/udisks-polkit-ac tions.html) permits an active unprivileged user to mount removable media without administrator authentication.\nUI:N - The attacking local user can mount the supplied removable filesystem and truncate its writable file directly; no separate victim action is required.\nS:U - The vulnerable UDF code and the affected kernel resources remain within the host kernel\u0027s security authority; ordinary kernel privilege escalation does not change scope.\nC:H - Although the reproduced path is an out-of-bounds pointer-slot read followed by panic, a zero-valued out-of-range slot causes read_block_bitmap() to write a buffer_head pointer through that attacker-selected slot. Under the required higher-severity rule, this exploitable kernel heap corruption can enable code execution and unrestricted disclosure.\nI:H - The conditional out-of-bounds buffer_head pointer store corrupts kernel heap memory at an attacker-selected array index and can potentially alter control-relevant objects. This supports control-flow hijacking or arbitrary modification under the required higher-severity assumption.\nA:H - The [upstream report](https://lkml.iu.edu/2605.1/15216.html) confirms that one ftruncate(2) reliably panics the kernel, causing complete system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:01.169Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76"
},
{
"url": "https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c"
},
{
"url": "https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f"
},
{
"url": "https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e"
},
{
"url": "https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240"
},
{
"url": "https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3"
},
{
"url": "https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b"
},
{
"url": "https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168"
}
],
"title": "udf: validate free block extents against the partition length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64324",
"datePublished": "2026-07-25T08:49:52.063Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-08-05T12:41:01.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…